The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
adscan v2.1.1 adds KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. authentication for flag collection and group-membership checks
└──▷ GET THIS VERSION
$ git clone --branch v2.1.1 https://github.com/ADScanPro/adscan.git
# already have the repo? check out this version:$ git checkout v2.1.1
kerberos enum-users subcommand with a new custom wordlist for higher hit-rates on real names.
1 detail in Everything
1 more release in this issue
· 2025-07-01 → 2025-07-18
PayloadsAllTheThings 4.2 adds new vuln pages for PHP variable pollution and reverse proxy misconfigs, plus expanded injection and deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution. techniques.
└──▷ GET THIS VERSION
$ git clone --branch 4.2 https://github.com/swisskyrepo/PayloadsAllTheThings.git
# already have the repo? check out this version:$ git checkout 4.2
New External Variable Modification section covering PHP extract() vulnerabilities, variable pollution, and security implications.
New Reverse Proxy Misconfigurations page covering common Nginx misconfiguration patterns.
Adds worstfit technique and fullwidth character bypass methods to the Command Injection section.
New Google Sheets exploitation content in CSV Injection, including IMPORTXML and IMPORTRANGE formulas for data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..
Adds lightyear tool coverage for blind file read primitives in the File Inclusion section.
+3 moreshow less
New CVE exploitation content, insecure flags, and PDF rendering attack vectors added to the Headless Browser section.
Comprehensive JSON deserialization section (Jackson and others) added to Java Deserialization.
New PDO Prepared Statements section added to SQL Injection.
The firmware for the HackRF+PortaPack H1/H2/H4/H4M.
Mayhem v2.2.0 adds Hopper RF jamming app, NOAA APT decoder, FREQMAN support, new Apps menu, and IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. screen brightness control
└──▷ GET THIS VERSION
$ git clone --branch v2.2.0 https://github.com/portapack-mayhem/mayhem-firmware.git
# already have the repo? check out this version:$ git checkout v2.2.0
Adds hopper app for RF jamming with support for all jammer modes and a 1ms hop option (plus 0ms freeze UI option)
Adds NOAA APT decoder capability in the Audio app
Integrates FREQMAN file support for frequency management across subghz applications
Reorganizes the main interface by moving all games into a new Games menu and nesting the Debug menu under Utilities
Feature-rich, stable and customizable Flipper Zero firmware.
Momentum Firmware mntm-011 adds Sub-GHzSub-GHzRadio frequencies below 1 GHz (typically 300–900 MHz) used by IoT devices, key fobs, garage doors, and industrial sensors; cyber tools target this band to capture, replay, or analyze those wireless signals. Playlist Creator, NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. Type 4/NDEF parsing, Infrared Decode only mode, and new APIs
└──▷ GET THIS VERSION
$ git clone --branch mntm-011 https://github.com/Next-Flip/Momentum-Firmware.git
# already have the repo? check out this version:$ git checkout mntm-011
Adds Sub-GHz Playlist Creator app for creating playlists of captured signals
Adds standalone Weather Station, POCSAG Pager, and TPMS Reader apps under Apps > Sub-GHz
Adds NFC Type 4 (NDEF on NTAG4xx/MIFARE DESFire) protocol support with full NDEF parsing plugin
Adds new NTAG413 DNA and NTAG424 DNA detection protocol for NFC
Adds Infrared Decode only mode to ignore RAW signals in the learn scene
+7 moreshow less
Adds submenu_remove_item() function to the app API for menu manipulation
Adds Ventra ULEV1 parser support in the NFC app
Adds keeloq ironlogic (il100) smart clone cloner support in Sub-GHz
Adds TM01x Dallas write support in the iButton app
Adds Always ON backlight option for the display
Adds Deauthentication mode to the FlipWiFi app
Expands NFC APIs by exposing ISO14443-3A listener (emulation) and ISO15693-3 device/poller/listener capabilities for apps
12 details in Everything
└──▷ BREAKING ON UPGRADE
!Removed Weather Station, POCSAG and TPMS protocols from the main Sub-GHz app; functionality is now only available in dedicated external apps under Apps > Sub-GHz
Flipper Zero Unleashed Firmware, an unlocked alternative firmware.
Unleashed Firmware unlshd-082 adds SubGHz protocol support (V2 Phoenix, Keeloq variants), NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. Type 4 tags, TM01x iButton write, and GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. API extensions.
└──▷ GET THIS VERSION
$ git clone --branch unlshd-082 https://github.com/DarkFlippers/unleashed-firmware.git
# already have the repo? check out this version:$ git checkout unlshd-082
Adds SubGHz: Roger (static 28 bit) protocol support with manual add capability
Adds SubGHz: V2 Phoenix full support including button switch, manual add, and counter decrypt/encrypt
Adds SubGHz: Keeloq support for Motorline, Rosh, Pecinin, Rossi, Merlin, Steelmate with manual add
Adds SubGHz: Marantec protocol with CRC verification display and manual add support
A tool that detects cell site simulators (IMSI catchers) on a cheap mobile hotspot.
Rayhunter v0.5.0 adds three new heuristics (IMSIIMSIA unique 15-digit number that globally identifies a subscriber on a cellular network, stored on the SIM card. Cyber tools target or capture it to track devices or correlate identities across mobile networks. Requested v2, Incomplete SIB, NAS Null Cipher) and in-device NAS parsing.
└──▷ GET THIS VERSION
$ git clone --branch v0.5.0 https://github.com/EFForg/rayhunter.git
# already have the repo? check out this version:$ git checkout v0.5.0
Adds IMSI Requested v2 heuristic which cuts down false positives and detects IMEI requested events
Adds Incomplete SIB heuristic that alerts when a SIB message lacks the expected chain of SIBs
Adds NAS Null Cipher heuristic to detect tower requests for null ciphers during security setup
Enables in-device NAS parsing via the new on-device NAS parser, unlocking the new heuristics
naabu v2.3.5 adds network policy support, dynamic result filtering, and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. binary builds.
└──▷ GET THIS VERSION
$ git clone --branch v2.3.5 https://github.com/projectdiscovery/naabu.git
# already have the repo? check out this version:$ git checkout v2.3.5
Adds dynamic result filtering to refine port scan output on the fly.
dnsrecon 1.5.0 ships a REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., enabling programmatic DNS recon via HTTP instead of CLI invocation.
└──▷ GET THIS VERSION
$ git clone --branch 1.5.0 https://github.com/darkoperator/dnsrecon.git
# already have the repo? check out this version:$ git checkout 1.5.0
└──▷ TRY IT
Stand up the DNSrecon REST API locally so other tools or scripts can query it over HTTP.
$ python restdnsrecon.py
New REST API for DNSrecon, launched via restdnsrecon.py, enables programmatic access to recon capabilities over HTTP.
1 detail in Everything
1 more release in this issue
· 2025-07-20 → 2025-07-27
BloodHound v8.0.0 adds ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. inheritance pathfinding, Explore table view, forest trust selectors, and database deletion by source kind.
└──▷ GET THIS VERSION
$ git clone --branch v8.0.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v8.0.0
Adds ACL inheritance pathfinding and a dropdown UI for visualizing ACL inheritance chains.
Adds an Explore graph data table with column management, row selection, JSON download, and copy-cell-to-clipboard support.
Adds an Incoming Forest Trust Builders selector for cross-forest trust analysis.
Adds a Search Asset Group Tags API endpoint.
Adds a Single Findings API endpoint.
+10 moreshow less
Adds an ACL inheritance API endpoint.
Adds deletion by source kind in Database Management.
Adds source_kind field to the OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. schema.
Adds IsReadOnlyDC computer attribute ingestion.
Supports HasSIDHistory on Group objects.
AGT Selectors endpoint now supports pagination.
AGT history now records analysis enabled/disabled actions.
Tiering list now records history entries.
Adds visual icon indicator for disabled tiers in the Explore UI.
Bundles SharpHound v2.7.0.
15 details in Everything
└──▷ BREAKING ON UPGRADE
!The AGT history endpoint has been renamed (see BED-6280); existing integrations or bookmarks using the old endpoint path will break.
!Power users no longer have app config permissions; any workflow relying on power users reading or writing app config will stop working.
1 more release in this issue
· 2025-07-09 → 2025-07-29
BloodHound v7.6.0 adds multi-tier analysis, Azure PIMPIMProtocol Independent Multicast, an IETF routing protocol that distributes IP multicast traffic across networks without depending on a specific unicast routing protocol, letting tools monitor or manipulate multicast group traffic./role coverage, a table view in Explore, and custom query import/export.
└──▷ GET THIS VERSION
$ git clone --branch v7.6.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v7.6.0
Adds multi-tier analysis support for Asset Group Tags (AGT), enabling tiered attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis beyond Tier Zero.
Adds AZRoleApprover edge to model Azure PIM role approval relationships for post-processing.
Adds AZRoleEligible edge expansion for Tier Zero tagging, capturing eligible Azure role principals.
Adds KindAZRoleEligibilityScheduleInstance to Azure converters for richer PIM data ingestion.
Adds a table view in the Explore tab for browsing nodes and edges in a structured, sortable format.
+5 moreshow less
Adds a summary view in the Explore tab for quick environmental overviews.
Adds an analysis_enabled flag to asset group tags, allowing per-tag analysis toggling.
Adds a Zone Management default view for managing security zones.
Retires the 'Automatically add parent OUs and containers of Tier Zero AD objects to Tier Zero' Early Access setting, with Tier Zero expansion now handled by the Asset Group Tag engine.
Requires AzureHound collector v2.6.0 for full Azure data collection compatibility.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!The 'Automatically add parent OUs and containers of Tier Zero AD objects to Tier Zero' Early Access setting is retired and no longer functional; Tier Zero OU/container expansion is now handled exclusively by the Asset Group Tag engine.
!This release requires AzureHound v2.6.0; older collector versions will not be fully supported.
evil-winrm-py v1.2.0 adds a short ewp alias, customizable User-Agent header, and auto-defaulting KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. SPN prefix.
└──▷ GET THIS VERSION
$ git clone --branch v1.2.0 https://github.com/adityatelange/evil-winrm-py.git
# already have the repo? check out this version:$ git checkout v1.2.0
└──▷ TRY IT
Blend in with legitimate WinRM traffic by spoofing a custom User-Agent during a red-team engagement.
Adds ewp as a shorter entry-point alias alongside evil-winrm-py for faster invocation.
New --user-agent argument lets operators customize the WinRM client User-Agent string (defaults to the standard Microsoft WinRM Client value).
Automatically applies an http SPN prefix when none is supplied, reducing Kerberos Server not found in database errors in Kerberos-authenticated sessions.
Codacy Cloud July 2025 adds severity gates for security, API token expiration, and Lizard as default complexity tool
Add severity gate policy to enforce minimum severity thresholds for security issues in Codacy Gate Policies
Filter segments within Coding Standards and Gate Policies by repository using Codacy Segments integration with GitHub custom properties
Scan DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. API targets without authentication headers for Business tier customers using the Static API authentication for DAST targets capability
Use Lizard as the default complexity tool supporting C, C++, Objective-C, Rust, C#, Go, Java, JavaScript, TypeScript, PHP, Python, Ruby, Scala, and Swift
Veracode CLI v2.41.0 adds auth login for OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. onboarding and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export formats to SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. agent scans
Introduces veracode auth login command for seamless user onboarding via OAuth2
Adds CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. and SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format. output format support to veracode sca SBOM generation
Adds ability to include directory path in artifact name with veracode package
Veracode CLI v2.41.0 adds auth login, custom vuln DB paths, and improved package/sca capabilities.
Introduces the auth login command to support seamless onboarding via OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs.
Adds the ability for the veracode scan command to specify a custom location for vulnerability database downloads
Enables SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. agent-based scans with SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation supporting CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. and SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format. formats via the veracode sca command
Snyk API & Web announces Critical severity: visible in the UI September 2, 2025, with assignment to eligible newly scanned findings from September 16.
From September 16, 2025, assigns Critical severity to eligible findings with CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. scores of 9.0 or higher; existing findings change only when detected in a new scan after that date.
1 detail in Everything
14 more releases in this issue
· 2025-07-09 → 2025-07-31
Snyk GA release adds Snyk Generated Pull Request report with global package manager filters and per-repo PR tracking tables.
Makes the Snyk Generated Pull Request report generally available for organizational and group-level visibility into Snyk-generated manual and auto-fix PRs.
Adds a global filter by specific package managers to the new PR report
Adds a new table within the drawer view to track PRs created for a specific repository
Snyk’s Developer IDE and CLI usage report adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. adoption metrics, requiring CLI v1.1298.1 for the new visibility.
Adds Top-Level MCP Scan Count metric to the Developer IDE and CLI usage report.
Adds a Usage Breakdown Chart to the Developer IDE and CLI usage report visualizing split between CLI, IDE plugins, and Agentic Scans (MCP).
Adds an MCP Host Breakdown Chart to the Developer IDE and CLI usage report breaking down Agentic Scans by host application.
Snyk Essentials announces SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. Project and Organization asset context, available beginning July 30.
Adds SCM Project enrichment from BitBucket and Azure DevOps to asset data
Adds SCM Organization enrichment representing GitHub/ADO organizations, Bitbucket workspaces, and GitLab groups
Snyk introduces an opt-in Early Access tenant analytics experience with customizable dashboards and a report catalog for Enterprise users with group reporting permissions.
Adds the ability to build customizable analytics dashboards using new widgets.
Enables users with group reporting permissions to access tenant-level analytics for all authorized groups.
Snyk Code announces mongoose, express-mongo-sanitize, JAX-RS, sqlx, and Slick coverage plus cross-file analysis improvements for August 5, 2025.
Adds mongoose framework support for JavaScript/TypeScript detection
Adds express-mongo-sanitize library support for JavaScript/TypeScript detection
Adds JAX-RS framework support for Java detection
Adds sqlx library support for Go detection
Adds Slick framework support for Scala detection
+2 moreshow less
Introduces initial detection coverage for CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-330 (insecure random number generation) in Python
Enhances inter-file analysis to track data sanitization across multiple files, reducing false positives
Snyk Agent Fix announces opt-in Early Access for GitHub pull requests using @snyk /fix and @snyk /apply to generate and commit suggested fixes.
Adds @snyk /fix in GitHub PR inline comments to generate and display code fix suggestions.
Adds @snyk /apply in GitHub PR comments to apply suggested fixes as a new commit.
Adds ability to generate multiple fix suggestions within the same PR for applicable SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. findings
Snyk IDE plugins v2.23.0/v2.15.0 add PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. auth and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support; remove several features.
Adds Personal Access Token (PAT) as a supported authentication method across all IDE plugins, in addition to existing OAuth and legacy token methods
Enables automatic detection of Snyk VS Code extension to support the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCP) in GitHub Copilot for integrated AI security experiences
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The Code Quality Findings feature is removed from Snyk Code
!JavaScript CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. Library Detection in HTML, JS, and TS files is no longer supported
!Container Image Detection in Kubernetes YAML Files is no longer supported
Snyk MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Early Access adds folder trust, new tools (snyk_aibom, snyk_trust, etc.), and removes --experimental flag in CLI v1.1298.0
Adds --disable-trust flag to disable the explicit folder trust mechanism required for MCP scans
Introduces new MCP tools: snyk_aibom, snyk_container_scan, snyk_iac_scan, snyk_sbom_scan, and snyk_trust
Removes the requirement for the --experimental flag to use Snyk MCP, streamlining CLI invocation
Snyk CLI v1.1298.0 adds PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. authentication, clearer dependency graphs, improved Maven progress output, and CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale./VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. container scanning.
Adds support for Personal Access Token (PAT) authentication in the CLI
Improves output and progress indication through the Dverbose flag for long-running Maven test, monitor, and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. scans with dense dependency graphs.
Enhanced --print-graph output for Node.js by adding type and classifier information to Node IDs
Adds default support for NPM/Yarn package aliases to improve dependency resolution.
--gradle-normalize-deps flag now correctly shows all internal dependencies for coordinates with multiple artifacts
+2 moreshow less
Adds support for scanning RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 10 images using Red Hat's new CSAF/VEX vulnerability data format
Adds accurate scanning support for updated Chainguard Wolf image file locations
7 details in Everything
└──▷ BREAKING ON UPGRADE
!Updated glibc requirements for Linux users may break existing installations that do not meet the new baseline.
Snyk Code announces MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server entry-point analysis for Spring AI, FastMCP, and supported JavaScript/Python packages from July 23, 2025.
Adds support for MCP (Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) server sources as new application entry points in Snyk Code analysis.
Extends security coverage to agentic workflows by tracing data entering applications via MCP servers.
Recognizes Spring AI (org.springframework.ai) Java framework as a new supported source.
Recognizes FastMCP and modelcontextprotocol/typescript-sdk JavaScript libraries as new supported sources.
Recognizes FastMCP, modelcontextprotocol/python-sdk, and aiofiles Python packages as new supported sources.
Mend SAST is a static application security testing service that scans source code for vulnerabilities and helps teams prioritize remediation.
Mend SAST 25.7.1 adds exact line numbers to code remediation suggestions and improves JS entry point detection.
└──▷ HOW TO FIND IT
View exact line numbers for remediation suggestions alongside the diff in the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform.
📍In the Mend AppSec Platform, review a finding to see code snippets with explicit line numbers.
Code Remediation Suggestions now display exact line numbers in addition to the existing code diff view.
React event-handlers defined in separate files are now picked up as entry points when analyzing JavaScript code.
2 details in Everything
2 more releases in this issue
· 2025-07-14 → 2025-07-28
GitLab 18.2 adds AWS Secrets Manager/SSM in CI, Duo Agent IDE platform, immutable container tags, Security Inventory beta, and GLQL sorting
Adds aws_secrets_manager and aws_ssm_parameter_store support as new secret sources in GitLab CI/CD configuration to enable native AWS secret retrieval without third-party tools
Introduces the Duo Agent Platform beta for VS Code and JetBrains IDEs, bringing agentic chat and agent flows directly into the editor with Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) support
Enables immutable container tags (Beta) in the next-generation container registry to protect critical image tags from modification after creation using up to 5 RE2RE2A regular-expression engine developed by Google that guarantees linear-time matching, preventing the catastrophic backtracking that plagues PCRE-style engines and making it safe to run untrusted patterns. regex protection rules per project
Adds Security Inventory beta for Ultimate tier users to provide a centralized view of security posture, coverage gaps, and configuration status across all projects and groups
Adds TRIVY_PLATFORM environment variable support in Container Scanning to allow scanning multi-architecture container images on Linux Arm64 runners without emulation
+11 moreshow less
Enables TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip.MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. support in DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans for comprehensive security testing of applications requiring time-based one-time passwords
Allows administrators to toggle audit streams as active or inactive via the UI to temporarily deactivate streaming to destinations like AWS and GCP
Adds filter functionality for all audit streaming destinations including by event type, groups, and projects through the UI
Adds new GLQL sorting and pagination capabilities for views, allowing sort by due dates, health status, and popularity with a Load more system
Introduces [work_item:<id>] syntax in GitLab Flavored Markdown for unified referencing of issues, epics, and work items including cross-project references
Adds initialDetectedPipeline and latestDetectedPipeline fields to the Vulnerability GraphQL API to retrieve commit information when vulnerabilities were introduced and last detected
Enables pattern-based branch exceptions in merge request approval policies (configurable via UI or policy.yml) to bypass requirements for specific source-target branch combinations like release/* to main
Shows dependency paths in vulnerability details and project/group dependency lists to distinguish between direct and transitive library imports
Adds service account tokens to the credentials inventory for better visibility into authentication methods across the software supply chainsoftware supply chainThe dependencies, tools and processes used to build and deliver software. Compromising one part can affect the products or organizations that rely on it.
Allows Mistral Small model usage on GitLab Duo Self-Hosted as the first fully compatible open source model for Duo Chat and Code Suggestions
Introduces custom admin roles in beta for GitLab Self-Managed instances to grant granular permissions in the Admin Area without full root access
Mend SCA v25.7.1 adds library violation count columns, In Review/'Issue Created statuses, and org-level Dependencies Findings reports.
Adds new sortable/filterable security violation count columns in the main table and side panels for direct libraries
Adds In Review and Issue Created statuses for direct libraries in the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform
Enables generation of Dependencies Findings reports at the organization level
c/side releases a new notifications engine supporting webhook endpoints and AWS S3 export for real-time alert visibility.
Adds webhook notification support to the dashboard domain settings, enabling real-time alerts to Slack, Discord, or other platforms via an endpoint URL.
1 detail in Everything
1 more release in this issue
· 2025-07-01 → 2025-07-17
Adds /rule_update API endpoint for real-time Fastly DDoSDDoSDistributed Denial of Service: an attack that floods a target system with traffic from many sources simultaneously, exhausting its resources so legitimate requests cannot be served. protection rule actions
6 more releases in this issue
· 2025-07-03 → 2025-07-23
DDoSDDoSDistributed Denial of Service: an attack that floods a target system with traffic from many sources simultaneously, exhausting its resources so legitimate requests cannot be served. Protection GET API endpoints now accessible to any user role with service access
Relaxed validation on ddos_protection_action and ddos_protection_traffic_attribute parameters in Fastly DDoSDDoSDistributed Denial of Service: an attack that floods a target system with traffic from many sources simultaneously, exhausting its resources so legitimate requests cannot be served. Protection API.
Adds flexibility to events and event rules endpoints by relaxing validation on the ddos_protection_action parameter.
Relaxes validation of the ddos_protection_traffic_attribute parameter in the traffic stats endpoint.
Fastly adds the + operator to request search for AND-logic on multiple signal tags.
└──▷ TRY IT
Find requests triggering both command execution and path traversal detections simultaneously.
$ tag:CMDEXE +tag:TRAVERSAL
Adds + operator to the request search query syntax, allowing users to find requests containing multiple specific tags (e.g., tag:CMDEXE +tag:TRAVERSAL).
Enables precise filtering of WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. signals by requiring all specified tag conditions in a single search query.
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. agent 4.68.0 adds Windows registry key preservation and improved SQLI detection.
Enhances DDoSDDoSDistributed Denial of Service: an attack that floods a target system with traffic from many sources simultaneously, exhausting its resources so legitimate requests cannot be served. Protection API with traffic_percentage in stats endpoint and include=traffic_stats for event rules.
Adds the traffic_percentage field to the traffic stats endpoint of the DDoS Protection API for visibility into attack patterns relative to overall traffic.
BunkerWeb 1.6.3-rc2 adds PRO setup wizard steps, Linux CrowdSec auto-install, and TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. env var alias
└──▷ GET THIS VERSION
$ git clone --branch 1.6.3-rc2 https://github.com/bunkerity/bunkerweb.git
# already have the repo? check out this version:$ git checkout 1.6.3-rc2
└──▷ TRY IT
Use the new env var alias when configuring BunkerWeb via environment variables.
Dalfox is an XSS scanner that automates parameter analysis, reflected/stored/DOM-based XSS detection, and WAF fingerprinting for web apps.
Dalfox v2.12.0 adds custom blind XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. payloads, markdown reports, raw HTTP pipe mode, API key auth, and new XSS bypass payloads.
└──▷ GET THIS VERSION
$ git clone --branch v2.12.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:$ git checkout v2.12.0
└──▷ TRY IT
Inject a custom blind XSS payload (e.g., pointing to your own callback server) instead of relying on built-in blind payloads.
Adds --custom-blind-xss-payload flag to supply user-defined blind XSS payloads at scan time.
Adds DELETE endpoints to the server API for scan data management.
Adds API key-based authentication for server mode.
Adds CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. and JSONP support for server mode.
Adds raw HTTP request support to pipe mode, enabling scans directly from raw request files.
+4 moreshow less
Adds markdown report format as an output option.
Adds new <object> and <embed> codebase XSS payloads for filter-bypass coverage.
Adds advanced XSS scanning features (PR #765).
Improves help message with grouped flag display for easier navigation.
New -p flag routes analysis traffic through a proxy, enabling scanning of internal or restricted targets.
Adds 11 new insecure header checks across four commits, expanding detection coverage.
Warns when IP blocking or tool interference may produce unreliable results.
Displays a warning when no HTTP response headers are received from a target.
Adds 1 new fingerprint header detection.
+2 moreshow less
Normalizes response HTTP header values for more consistent analysis output.
Improved OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Secure Headers Project Best Practices check.
Invicti adds IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data./BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. detection, Docker agents, CI/CD dynamic targets, and LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. vulnerability scanning
Adds IDOR (Insecure Direct Object Reference) and BOLA (Broken Object Level Authorization) vulnerability detection in APIs.
Supports Dynamic targets for integration into CI/CD pipelines.
Adds Docker-based internal scanning agents with concurrent scan support.
Introduces LLM vulnerability detection capabilities including Command Injection, SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly., Insecure Output Handling, Tool Usage Exposure, Prompt Injection, System Prompt Leakage, and Fingerprinting.
Detection Engine 2.144 adds detectors for Weights & Biases, Bitbucket App Passwords, and Mercado Pago tokens.
Adds Weights & Biases API Key detector to identify secrets in codebases
Adds Bitbucket App Password detector as a new surface for access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. detection
Adds Mercado Pago Access Token detector with verification checker for payment service credentials
3 details in Everything
2 more releases in this issue
· 2025-07-02 → 2025-07-25
Detection Engine v2.143 adds new secret detectors and validation checkers for GitLab, Coze, Tavus, Heroku, Tableau, Notion, and Salesforce.
Adds ssh_password_with_port detector to match SSH credentials including specific ports
Adds detection support for GitLab incoming mail tokens
Adds detection support for Coze personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.
Adds detection support for Tavus API keys
Adds detection support for Heroku Platform Keys (prefixed variants)
+10 moreshow less
Adds detection support for Tableau Cloud PATsPATsA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.
Adds detection support for Notion Integration Token v2 format
Adds validation checker for Coze Personal Access Tokens
Adds validation checker for Tavus API Keys
Adds validation checker for Heroku Platform Keys
Adds validation checker for Tableau Cloud PATs
Adds validation checker for Notion Integration Token v2
Adds validation checker for Salesforce OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. tokens
Enhances JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. detectors to only catch signed JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage.
Improves Generic High Entropy Secret detector to ignore IDs in ServiceNow migration files
Adds Azure Client Secrets authentication to Azure App Connections in Infisical v0.143.0
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.143.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.143.0-postgres
9 more releases in this issue
· 2025-07-03 → 2025-07-30
Adds secrets detection engine and GitHub App sync gateway to Infisical v0.142.0
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.142.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.142.0-postgres
Adds secrets detection in secret manager capability to scan for leaked credentials within stored secrets.
Adds a new Gateway for GitHub App Connections & Secret Syncs enabling bidirectional sync between GitHub Apps and Infisical.
Infisical v0.141.0-postgres introduces multi-environment support for secret/access policies and refactors Azure OAuth env var handling.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.141.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.141.0-postgres
└──▷ HOW TO FIND IT
When applying secret or access policies to multiple environments at once (e.g., staging and prod) in the UI.
📍In the Infisical console, go to Secrets › Policies and enable multi-environment selection for the policy you are creating or editing.
When configuring Azure OAuth connections in a cyber tool service container where previous shared env vars caused collisions across multiple apps.
📍export AZURE_APP_1_CLIENT_ID='xxx'
export AZURE_APP_1_TENANT_ID='yyy'
# ... separate vars for each app connection as introduced in this release
Allow multiple environments on secret and access policies — enable scoped policies across several environments simultaneously instead of a single environment.
Separate Azure OAuth env vars to different env variables for each app connection — split shared Azure OAuth configuration into distinct environment variables per application connection.
Auto-redeploy on sync for Render, Azure CS auth, and frontend column resize
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.140.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.140.0-postgres
Adds auto redeploy trigger in Secret Sync when target is Render, so secrets pushed to Infisical automatically restart the deployment
Adds support for Client Secrets authentication when connecting an Azure Cloud Services app via Secret Import
Adds horizontal column resizing to the Secret Dashboard Environment View in the frontend
Infisical v0.139.2 adds project audit logs pages and AWS ABACABACAttribute-based access control, where rules evaluate facts about the user, resource and request. Access can depend on conditions such as department, data sensitivity or device status. attributes for machine identities.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.139.2-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.139.2-postgres
Add AWS attributes for ABAC to machine identities enables attribute-based access controlattribute-based access controlAttribute-based access control, where rules evaluate facts about the user, resource and request. Access can depend on conditions such as department, data sensitivity or device status. using AWS context.
project-audit-logs pages added to the UI for tracking project-level actions.
Infisical v0.139 adds Bitbucket Secret Sync, Digital Ocean App Platform sync, and SQL gateway connections with rotation.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.139.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.139.0-postgres
feat(app-connection): Gateway support for SQL App Connections + Secret Rotations
Infisical v0.138.0 adds Railway, Cloudflare Workers, Supabase and Checkly secrets sync, AWS IRSAIRSAAn AWS mechanism that lets a Kubernetes pod assume an IAM role via a service account, so tools running in EKS can call AWS APIs without embedding long-lived credentials. auth, native FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. support, CLI --output-file, server admin overrides, and offline docs
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.138.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.138.0-postgres
Adds INFISICAL_RAILWAY_SECRET_SYNC_ENABLED and related overrides to enable automatic Railway secret sync
Adds INFISICAL_CLOUDFLARE_WORKERS_SYNC_ENABLED and related overrides to enable Cloudflare Workers secrets sync
Adds INFISICAL_SUPABASE_APP_CONNECTION_ENABLED and INFISICAL_SUPABASE_SECRET_SYNC_ENABLED to support Supabase app connection and secrets sync
Adds INFISICAL_CHECKLY_APP_CONNECTION_ENABLED and INFISICAL_CHECKLY_SECRET_SYNC_ENABLED to support Checkly app connection and secrets sync
Enables AWS IRSA authentication for dynamic secrets via the new aws_irsa auth method
+4 moreshow less
Adds native FIPS mode via the FIPS_ENABLED environment variable
Updates CLI export to accept a concrete file path with the --output-file <path> argument instead of stdout-only output
Adds server admin environment overrides for configuring the GitHub app connection (including migration from UI)
Adds Bitbucket data source for secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. and audit log CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. events for secret approvals
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.137.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.137.0-postgres
Adds Bitbucket as a new data source for the secret-scanning feature with App Connection support
Infisical v0.136.0 adds BitBucket to secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. coverage
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.136.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.136.0-postgres
$ git clone --branch infisical/v0.135.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.135.0-postgres
└──▷ USE IT
Retrieve a raw token string for direct use in scripts without JSON parsing.
shell
infisical auth get-token --plain
Adds TLS cert identity auth for client certificate-based authentication
Adds Zabbix to supported secret sync providers
Adds Environment Overrides feature in super-admin settings
Adds plain text output support to infisical auth get-token CLI command via --plain flag
Adds type column and default sort to the project roles table in the UI
+6 moreshow less
Adds revamp of approval sequence table display and access request modal for improved UX
Adds standardization of org access control UI across the platform
Adds blocking of folder deletion if secrets within are protected by an active policy
Adds re-invite workflow to automatically resend expired user invites every 1 week for up to a month
Adds color/layout styling adjustments to the secret approval request page
Adds ability to allow users with create permission to add identities with no access
TruffleHog finds, verifies, and analyzes leaked credentials across Git, chat, wikis, cloud storage, and more
TruffleHog v3.90.2 adds Anypoint API OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. detection, Slack continuous scan improvements, and expanded Vector config options.
└──▷ GET THIS VERSION
$ git clone --branch v3.90.2 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.90.2
New Anypoint API OAuth2 detector identifies leaked MuleSoft Anypoint Platform OAuth2 credentials.
Adds Slack continuous protobuf messages support for real-time Slack scanning.
TruffleHog v3.90.1 adds Salesforce Refresh Token detection and KeySet pagination for large GitLab project scans.
└──▷ GET THIS VERSION
$ git clone --branch v3.90.1 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.90.1
New Salesforce Refresh Token detector identifies exposed Salesforce refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. during scans.
KeySet pagination for GitLab Projects V2 enumeration enables reliable scanning of large GitLab instances without missing projects.
TruffleHog v3.90.0 adds Docker daemon scanning, 4 new secret detectors, and I/O performance optimizations.
└──▷ GET THIS VERSION
$ git clone --branch v3.90.0 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.90.0
Adds Docker daemon as a scan source, enabling secret detection directly from locally running containers.
New LangSmith API Key detector for catching exposed LangChain/LangSmith credentials.
New Hasura detector for identifying leaked Hasura admin secrets.
New Salesforce OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. detector for detecting Salesforce OAuth credentials.
New Bitbucket App detector for identifying Bitbucket app credentials.
+9 moreshow less
Adds v2 CircleCI detector with updated token pattern coverage.
Updates Asana detector to recognize the new personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. format.
Adds Bannerbear Detector V2 with improved detection coverage.
Adds Shannon Entropy check to the GitLab v1 detector to reduce false positives.
Enables and enhances the Artifactory detector.
Optimizes chunk size handling for improved I/O and memory efficiency during scans.
Simplified GitLab enumeration for faster repository scanning.
Surfaces errors when the GitHub source cannot fetch a repo or gist, improving scan visibility.
SPIKE v0.4.2 adds Helm chart deployment, cross-cluster secret federation, SPIKE Lite mode, and YAML-driven policy files.
└──▷ GET THIS VERSION
$ git clone --branch v0.4.2 https://github.com/spiffe/spike.git
# already have the repo? check out this version:$ git checkout v0.4.2
└──▷ TRY IT
Define a SPIKE access policy as a YAML file and apply it — useful for storing policies in version control and applying them in CI/CD.
$ spike policy apply -f policy.yaml
Adds spike policy apply -f to the spike policy command, enabling policies to be defined as yaml files and applied from disk.
Introduces SPIKE Lite, a new operational mode that runs without a backing store.
Supports deployment via SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. Helm Charts (helm-charts-hardened), verified and tested.
Enables federation of secrets across clusters when deployed via Helm.
Adds env-based config to suppress the SPIKE startup banner.
+1 moreshow less
Adds env-based config to show a warning when memory locking is unavailable on the system.
gitleaks v8.28.0 adds composite (multi-part) rules with proximity matching, Anthropic and Artifactory secret detections, and allowlist optimizations.
└──▷ GET THIS VERSION
$ git clone --branch v8.28.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:$ git checkout v8.28.0
└──▷ USE IT
Require a username-like token to appear within 2 lines of a password pattern — reducing false positives in config files.
toml
# In your gitleaks.toml
[[rules]]
id = "my-service-password"
description = "My service password"
regex = '''password\s*=\s*["']?([\w!@#$%^&*]+)["']?'''
[[rules.required]]
id = "my-service-username"
withinLines = 2
[[rules]]
id = "my-service-username"
description = "My service username"
regex = '''username\s*=\s*["']?([\w]+)["']?'''
Adds composite rules ([[rules.required]]) that let a primary rule report a finding only when one or more auxiliary rules also match, with optional withinLines and withinColumns proximity constraints.
Supports fragment-level, line-bounded, column-bounded, and combined line+column proximity matching for composite rules.
Adds built-in detection for Anthropic API keys.
Adds built-in detection for Artifactory reference tokens and API keys.
Promotes allowlist stopword optimizations for faster scanning.
+1 moreshow less
Defers newline calculation in fragments until a rule match occurs, significantly reducing scan time on large repositories.
New Internal Monitoring analytics dashboards and multi-hook GitLab integration support
Adds new Internal Monitoring analytics dashboards tracking Protect, Detect, Remediate, and Prevent dimensions via Count of sources, Most detected secrets, Top teams by incident count, Top sources by incident count, Median time to remediate, Total count of incidents avoided by GGShield, and GGShield scans over time charts and tables
Supports simultaneous configuration of multiple GitLab integrations using both system hooks and group hooks
Introduces Jira DC leaker emails feature for targeted notifications
Improves JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. detection logic to only catch signed JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. across all detector types
Expands secret detection coverage with v2.143 adding 7 new detectors including GitLab Incoming Mail, Coze PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it., Tavus, Heroku Platform, SSH with port, Tableau Cloud PAT, and Notion v2
Syft v1.29.0 adds support for cataloging Python uv.lock files.
└──▷ GET THIS VERSION
$ git clone --branch v1.29.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.29.0
Catalogs Python uv.lock files, enabling SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation for projects managed with the uv package manager.
1 detail in Everything
1 more release in this issue
· 2025-07-02 → 2025-07-21
Adds RepoSwitcher component to Socket Dashboard for global repository filtering
Adds RepoSwitcher drop-down to the Dashboard next to the OrgSwitcher, acting as a global repository filter for PR Stories, Repositories, Dependencies, Alerts, Scans, PRs, and Analytics pages.
Adds dependencies and scans columns to the Repositories page in the dashboard UI.
Applies the global repository filter to the Alerts and Scans tables and removes unnecessary columns for a cleaner view.
Socket adds Rust/Cargo ecosystem support with crate search, security scores, and experimental SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation.
Adds socket.dev crate search for all users covering the Rust and Cargo ecosystem
Provides security scores, maintainer info, and dependency insights for Rust packages
Enables experimental SBOM generation for enterprise Rust projects with full workspace support
Precomputed reachability analysis now flags unreachable CVEs with no setup.
Adds automatic precomputed reachability analysis that flags up to 80% of vulnerabilities as irrelevant using only manifest files like package-lock.json and requirements.txt
Introduces a new CVE Reachability section in alert modals and a filter by reachability to prioritize actionable findings
Sets unreachable CVEs to default to the monitor action instead of active remediation
Socket MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. now available as a Claude Desktop Extension enabling in-chat dependency scanning
Socket adds beta support for scanning Scala and Kotlin JVMJVMThe Java Virtual Machine, a runtime maintained by Oracle (and implemented by others) that executes Java bytecode on any OS, giving cyber tools a portable, garbage-collected environment with a large ecosystem of libraries. dependencies.
Socket adds UI popover to view the last 7 EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scores with higher precision
Adds a new UI popover that displays the last 7 EPSS scores for dependencies
Increases precision for fractional digits in the EPSS score history renderings
EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. score and percentile now visible in the AlertModal for vulnerability prioritization.
Adds EPSS score and percentile display to the AlertModal UI component
Socket Dashboard alert modal now displays CISA Known Exploited VulnerabilitiesCISA Known Exploited VulnerabilitiesA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing CVEs confirmed to have been actively exploited in the wild, which cyber tools use as a high-signal prioritization feed for patching and scanning. (KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.) data.
Socket adds comprehensive SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation for Rust/Cargo projects via Cargo.toml and Cargo.lock files
Socket updates Dashboard Scan Pages with simplified headers and a redesigned Insights panel for easier access.
Redesigned SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. Report Page UI with simplified headers showing only repository, PR, and timestamp.
Removed redundant information such as duplicate Manifests labels and UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.-heavy scan IDs from scan pages.
Updated Insights panel layout and control buttons to improve accessibility within the Dashboard.
Adds SIGNED_URL_SALT environment variable to enable secure, time-limited signed URL access for private SBOM components
Enables automatic inclusion of document and product links as external references in generated SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.
Adds inline editing functionality with form validation for existing documents
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The SIGNED_URL_SALT environment variable is now required for production; omitting it will prevent signed URL functionality
2 more releases in this issue
· 2025-07-04 → 2025-07-18
/api/v1/releases API to create versioned releases (e.g., v1.0.0, beta) with automatic latest updates
Support for marking releases as alpha, beta, or RC via the new release status field
/api/v1/releases/{id}/download endpoint generates consolidated SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. containing only artifacts from a specific release
products.<CPE> and products.<PURL> fields added to product configuration for discoverability
sbomify v0.15 adds a documents hub for specs/reports and configurable S3 buckets via AWS_DOCUMENTS_* env vars
└──▷ GET THIS VERSION
$ git clone --branch v0.15 https://github.com/sbomify/sbomify.git
# already have the repo? check out this version:$ git checkout v0.15
AWS_DOCUMENTS_* environment variables added to configure separate S3 buckets for documents, distinct from SBOM storage
Documents hub capability: upload, version, and share specs, manuals, and compliance reports alongside SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.
Apiiro maps an application's architecture and risk graph and runs AI-SAST, SCA, secrets, API and threat-modeling checks on AI- and human-written code.
Enhanced inventory dashboard adds overview tiles for repositories, APIs, and OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. packages with trend analysis and anomaly-highlighting treemap.
Adds Inventory at a Glance overview tiles for Repositories, APIs, OSS Packages, Technologies with growth trends.
Adds an interactive treemap to the Inventory Dashboard that breaks down technologies by type (e.g., GenAI, Logging) and highlights anomalies.
Enables tracking of trends in sensitive APIs, inactive contributors, and data exposure within the Inventory Dashboard.
3 details in Everything
4 more releases in this issue
· 2025-07-08 → 2025-07-14
Apiiro adds Custom SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. Risk Policies in Explorer to filter findings, assign risk levels, and flag toxic combos
Adds ability to create and manage custom SAST risk policies directly in the Apiiro Explorer UI.
Introduces filtering capabilities to exclude non-security findings (bugs, performance issues) from SAST results.
Enables assignment of risk levels based on finding likelihood or OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 classification.
Adds detection logic to highlight toxic combos where SAST findings are in applicative code, API-related, and internet-exposed.
Apiiro now monitors minimum code reviewers and GitHub's Require Approval of the Most Recent Reviewable Push branch protection setting via Apiiro Explorer.
Adds monitoring for minimum required code reviewers per branch to generate risk alerts when policies are violated
Adds detection of the GitHub Require Approval of the Most Recent Reviewable Push rule status in Apiiro Explorer
GA: enhanced vulnerability detection & insights for unmanaged packages in Apiiro's SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself.
Adds support for scanning unmanaged package artifacts (.jar, .dll, .war, .ear) via Apiiro's SCA.
Adds the packageOrigin property to the Explorer view for locating bundled packages across your organization.
Expands supported dependency formats to include deps.json and pnpm in the support matrix.
Sonatype Nexus Repository 3.82.0 adds a new Capabilities API for programmatic management and improves quarantine message clarity.
Introduces the Capabilities API allowing administrators to programmatically view, create, update, and delete Capabilities via automation
Improves quarantine message behavior in CLI output for npm and NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. formats when a component is blocked by Repository Firewall
npq v3.9.0 adds OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. fallback, --plain output, direct package scanning, and provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. warning updates
└──▷ GET THIS VERSION
$ git clone --branch v3.9.0 https://github.com/lirantal/npq.git
# already have the repo? check out this version:$ git checkout v3.9.0
└──▷ TRY IT
Run npq in a CI pipeline or headless environment where colorful spinners are unsupported or noisy.
$ npq install --plain
Add osv database as vulnerabilities fallback for enhanced detection coverage.
Support --plain output flag to disable colorful UI rendering.
Scan direct packages of project with new scanning depth capability.
Show category id in the output for better issue context.
Downgrade provenance checks to warnings to reduce noise.
cosign v2.5.3 adds a new signing-config create command, multi-service trusted-root, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. 1.1+ tree support, and validity period controls.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.3 https://github.com/sigstore/cosign.git
# already have the repo? check out this version:$ git checkout v2.5.3
└──▷ TRY IT
Create a new signing config from the CLI to bootstrap a Sigstore deployment.
$ cosign signing-config create
Build a trusted root that covers multiple transparency/TSA services in one shot.
sbom-tool v4.1.0 adds an aggregate verb to consolidate multiple SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 2.2 SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. into a single output, with validation and telemetry support.
└──▷ GET THIS VERSION
$ git clone --branch v4.1.0 https://github.com/microsoft/sbom-tool.git
# already have the repo? check out this version:$ git checkout v4.1.0
Adds an aggregate verb (formerly consolidate) that merges multiple SPDX 2.2 SBOMs into a single aggregated SBOM, including package fields, relationships, and root dependencies.
Adds a config file for the aggregate verb, with environment-variable expansion supported in input config files.
Adds a telemetry file path option to the aggregate verb.
Runs the validation workflow as part of the aggregate action, passing only validated SBOMs to consolidation.
Adds an SPDXFormatDetector for automatic SPDX version detection; SPDX 3SPDX 3An open standard from the Linux Foundation for expressing software bill-of-materials data, letting cyber tools exchange dependency, license, and vulnerability metadata in a machine-readable, interoperable format..0 SBOMs are skipped during aggregation.
+3 moreshow less
Adds an SBOM content diff checker between SPDX 2.2 and SPDX 3.0 outputs.
Ensures SBOM creation time is represented in Gregorian calendar format.
react-native-lockdown bumps to SES 1.14.0 for hardened JavaScript in React Native apps.
└──▷ GET THIS VERSION
$ git clone --branch react-native-lockdown-v0.1.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout react-native-lockdown-v0.1.0
Upgrades bundled SES (Hardened JavaScript) runtime to v1.14.0, bringing its latest compartment isolation and intrinsic hardening to React Native.
LavaMoat webpack plugin v1.1.0 shields the webpack runtime from scuttling and ships proper TypeScript types.
└──▷ GET THIS VERSION
$ git clone --branch webpack-v1.1.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout webpack-v1.1.0
Defends the webpack runtime from scuttling, preventing untrusted code from corrupting webpack's own globals at runtime.
Exposes proper TypeScript types for the LavaMoat webpack plugin, enabling typed configuration in TS projects.
Frida 17.2.7 enhances its package manager with better npm compatibility, including new role and omits options for the install() function to control dependency types and exclusions.
Adds role option to package-manager's install() method for equivalent of npm's --save-* switches
Adds omits option to package-manager's install() method for equivalent of npm's --omit=x switch
HyperDbg v0.14 adds .start/.attach/.detach in VMI mode, new timing functions, and EPTEPTExtended Page Tables: an Intel CPU feature that lets a hypervisor give each VM its own second-level address translation in hardware, removing the need for software shadow page tables and cutting VM-exit overhead. support for MMIO >512 GB
└──▷ GET THIS VERSION
$ git clone --branch v0.14 https://github.com/HyperDbg/HyperDbg.git
# already have the repo? check out this version:$ git checkout v0.14
Adds the .start command to HyperDbg's VMI mode for user debugger sessions
Adds the .attach and .detach commands to the debugger mode for managing target processes
Adds microsleep(microseconds) function to the script engine for precise timing control
Adds rdtsc() and rdtscp() functions to the script engine for hardware cycle counting
Adds a new mechanism and functions to retrieve the system-call number from the running system
Adds WARP analysis engine for faster binary analysis workflows
Adds Pseudo Objective-C view for analyzing dynamic dispatch in macOS/iOS binaries
Adds customizable control flow graph rendering options in the UI
Adds support for x86-64 x32 ABI architecture plugin
Adds MIPSMIPSA RISC processor architecture originally developed at Stanford and commercialized by MIPS Technologies, widely used in embedded and network devices; cyber tools target it to analyze or exploit routers, cameras, and similar hardware. R5900 architecture plugin support
+53 moreshow less
Adds PPC-VLE architecture plugin support
Adds Native EFI Resolver workflow for firmware analysis
Adds sidebar hiding toggle in UI settings for expanded workspace
Adds ability to name segments via segment properties dialog
Adds constant-folding for double-precision multiplication in HLIL
Adds string wrapping and clamping options in analysis preferences
Adds Ternary Operator disassembly preference for cleaner output
Adds Guided Analysis Mode to streamline reverse engineering steps
Adds IL Rewriting capability for custom intermediate representation transformations
Adds Analyze Selected context menu item in the project browser
Adds length column to strings view for sorting by string size
Adds exact file size display option in project hierarchy panel
Adds Clear Recently Opened context menu option in the recents list
Adds support for wide UTF-16 strings in big endian format
Adds variable placement information display in variables view
Adds enhanced memory map segment creation usability features
Adds string sorting by length and reference count options
Adds debugger support for registers and variables wider than 64 bits
Adds ability to load Linux/macOS coredumps in the debugger
Adds forked process support in LLDB debugger adapter
Adds Override IP action in debugger context menu
Adds toggle breakpoint button in debugger control widget
Adds support for running extra commands during LLDB launch
Adds CheckBoxField for form inputs in Python API
Adds hierarchical settings inheritance for resource settings API
Adds line formatter API to Rust bindings
Adds per-function metadata storage capability via API
Adds plugin command registration for project browser via API
Adds SSA form support for LLIL in Rust API
Adds Rust language representation support for custom languages
Adds SectionBuilder construction from Section in Rust API
Adds CoreRegister name to Debug implementation in Rust
Adds documentation comments for undo actions in Rust API
Adds FileAccessor with read/write functionality in Rust API
Adds FlowGraphEdge type and node edge accessors in Rust API
Adds Function::variable_type method in Rust API
Adds get_files_by_path_in_project() and get_path_in_project() methods to Python API
Adds get_system_cache_directory() function to Python API
Adds GetPathInProject() to core C++ API for project path resolution
Adds GetSystemCacheDirectory() function to C++ API
Adds interaction handlers to flow graph API in Rust
Adds full interaction APIs implementation for Rust API
Adds LLIL_SEPARATE_PARAM_LIST_SSA support in Rust API
Adds LLIL_UNDEF mapping support in Rust API
Adds LowLevelILInstruction::basic_block method in Rust API
Adds pretty printing for LLIL sub-expressions in Rust
Adds support for LLIL_REG_PHI, LLIL_MEM_PHI, and LLIL_FLAG_PHI expressions in Rust
Adds DWARF symbol support for PE executables produced by mingw
Adds parsing support for __init_offsets in MachoView binaries
Adds Objective-C constant sections support including arrays, dictionaries, and integers
Adds explicit references from Objective-C selectors to method implementations
Adds support for TEATEATiny Encryption Algorithm, a symmetric block cipher designed by Wheeler and Needham in 1994, valued for its minimal code footprint and simplicity, making it attractive for embedded or constrained environments. (Tiny Encryption Algorithm) transformation
Adds support for additional transformations: SUB, ADD, MUL, and ROL
New Auto-Resolve capability adds bulk VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. status updates for unreachable findings via a dedicated UI button.
malwaredb-rs v0.1.1 moves client config to XDGXDGA set of specifications maintained by freedesktop.org that standardise where Linux applications store config, data, and cache files, letting tools respect user-defined paths instead of hardcoding locations. path and publishes Python modules via CI
└──▷ GET THIS VERSION
$ git clone --branch v0.1.1 https://github.com/malwaredb/malwaredb-rs.git
# already have the repo? check out this version:$ git checkout v0.1.1
~/.config/malwaredb_client/mdb_config.toml is the new default location for the client configuration file.
Python modules are now submitted to PyPI from CI.
2 details in Everything
1 more release in this issue
· 2025-07-01 → 2025-07-30
Timesketch 20250708 adds batch tag editing, DFIQ event linking, a search guide card, and new tsctl admin commands.
└──▷ GET THIS VERSION
$ git clone --branch 20250708 https://github.com/google/timesketch.git
# already have the repo? check out this version:$ git checkout 20250708
└──▷ TRY IT
Find orphaned objects in the database that may be consuming resources or causing inconsistencies.
$ tsctl check-orphaned-objects
Use the SearchGuideCard to orient a new analyst on a sketch — navigate to the Explore view and interact with the guide surfaced at the top of an empty search.
📍In the Timesketch UI, open a sketch and go to the Explore view; the SearchGuideCard appears when no search has been run yet, offering suggested queries and starting points.
Adds batch editing of tags across multiple events in the UI, enabling faster bulk triage.
Links timeline events directly to DFIQ conclusions, connecting artifacts to structured investigative findings.
Introduces a unified SearchGuideCard to help analysts start exploring a sketch with contextual query guidance.
Adds a bloom prefix to tags emitted by the bloom analyzer for clearer tag provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build..
Introduces read-only access grant to a sketch via tsctl.
+3 moreshow less
Introduces tsctl check-orphaned-objects command to identify orphaned database objects.
Updates Admin CLI tsctl to reflect revised User and Group command structure.
Enables the Vue 3 UI as a supported frontend option.
Cloud Forensics Utils adds image format support for GCS exports
└──▷ GET THIS VERSION
$ git clone --branch 20250721 https://github.com/google/cloud-forensics-utils.git
# already have the repo? check out this version:$ git checkout 20250721
Enables exporting disk images in supported formats when transferring to Google Cloud Storage
Adds JA4JA4A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies. fingerprint analyzer (FoxIO), API key auth for URLHaus, and new Gatewatcher analyzer features.
└──▷ GET THIS VERSION
$ git clone --branch 3.5.19 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.5.19
Adds JA4 FoxIO analyzer for JA4 fingerprint analysis.
Adds API key requirement/support to the URLHaus analyzer.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The URLHaus analyzer now requires an API key — existing configurations without one will fail.
New Automated Threat Hunter for Account Takeover Protection using continuous login history analysis
Adds automated ATO case creation and confidence updates when historical login matches emerging IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself..
Provides enriched threat context for account takeover investigations to accelerate response.
2 details in Everything
4 more releases in this issue
· 2025-07-01 → 2025-07-14
Adds user-group subsetting for URL Rewriting in Abnormal AI M365 deployments
└──▷ HOW TO FIND IT
Roll out URL rewriting to a pilot group (e.g., IT or Security team) before tenant-wide activation.
📍Navigate to the URL Rewriting settings in the Abnormal AI console, select Custom configuration, check 'Enable for a subset of users', and add the target Microsoft Entra ID group.
'Enable for a subset of users' option added to the URL Rewriting settings UI, allowing selective deployment via Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. groups for M365 tenants.
Sophos Email Security 2025.26 adds Email Monitoring System and DMARC Manager for authentication control
Adds Email Monitoring System (EMS), a new monitor-only journal-based solution for Microsoft 365 and Google Workspace that provides deep visibility into email traffic without disrupting delivery.
Adds DMARC Manager, a new capability for comprehensive management of DMARC, SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders., and DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit. records (including SPF flattening), BIMI, MTA-STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets., TLS-RPT, and automated DMARC alerts.
Palo Alto Cortex Analytics adds 9 new detections across Medium/ Low severity BIOCs and Alerts.
Adds the Suspicious dNSHostName attribute change to DC name BIOC to detect directory service manipulation attempts against domain controllers.
Adds five new low-severity Analytics BIOCs: A commonly abused process connected to a rare cloud resource, A commonly abused process connected to a rare external cloud resource, Rare binary connected to a rare cloud resource, Rare binary connected to a rare external host, and Unusual Process Spawned by Nginx in Ingress-Nginx pod.
Adds two new low-severity Analytics Alerts for Microsoft 365 storage services exfiltration activity and Multiple user accounts failed login due to account lockouts.
Adds two informational Analytics BIOCs detecting AppleScript interpreter dynamic library loaded into a process and Uncommon sensitive filesystem registry hive access.
Adds five informational Analytics Alerts covering IP Rotation Pattern in SSO Spray, Possible Impossible Travel Pattern - SSO, Possible Privilege Escalation using Delegated MSA account, SCCM log files enumeration, and Single account excessively locked out.
PAN-OS 11.1 adds GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. tunnel support over cellular interfaces for dynamic IP connectivity
Adds GRE tunnel support over the PAN-OS cellular interface to connect remote IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. devices via mobile headends.
Enables GRE tunnel configuration with dynamic IP addressing for IPv4 endpoints on cellular networks.
Cortex XSIAM 3.2 adds API Security scanning, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant./VNET ingestion, new XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. IP functions, and more
Adds Create Distributions API support for Kubernetes installations to automate agent deployment
Introduces the Identity Security Access Table Data API for retrieving detailed access information with filters
Adds new public APIs for managing Cases and Issues, including creating and updating issues externally
Introduces Unified Asset Inventory APIs with powerful filtering capabilities for on-premises and cloud assets
Adds APIs to get, create, delete (including in bulk) API keys for granular key management
+23 moreshow less
Adds new Application Security public APIs for programmatic management of data sources, rules, policies, and scans
Enhances API Security with automatic identification and extraction of API specifications from AWS and Azure API gateways
Adds F5 BIG-IP LTM as a new integration option for API security visibility
Integrates DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores.'s unified cross-platform data sensitivity scanning engine into API endpoint traffic analysis
Supports IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. in Attack Surface Management to discover and protect IPv6 services
Enables full 65k port dynamic protocol detection for improved service discovery across all IPv4 ports
Adds new Attack Surface Rules to identify internet-facing applications leaking credential information
Adds Digital Risk Protection rules for leaked credential and brand risk domain discovery in ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them.
Enables OCI support for visibility and governance over Oracle Cloud Infrastructure environments
Adds VNET flow log support for Azure Network Watcher
Allows exporting filter JSON directly from the UI to simplify public API integration calls
Introduces new XQL IP functions for validating IPv4/IPv6 addresses and checking if they are private IPs
Adds Automation Exclusion Center for centralized policies excluding assets from automated remediation
Streamlines cloud automation by integrating Terraform configuration into the AWS/GCP/Azure onboarding process
Adds new Network Scanner Broker VM applet for internal network security asset and vulnerability assessment
Adds Unified Identity Inventory with dedicated sections for investigating cloud, enterprise, and code domains
Enhances Graph Search (Beta) to track assets with internet exposure and their exposure paths
Adds EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. Windows C2 Analytics detection suite for C2 and exfiltration traffic visibility
Adds EDR Linux Shell Analytics detection suite for abnormal Linux shell executions
Adds EDR MacOS Shell Analytics detection suite for unusual spawned macOS shells
Improves NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. Lateral Movement Analytics with richer application logging and protocol-based context
Supports header-based authentication in Generic Webhook Integrations for external data ingestion
28 details in Everything
└──▷ BREAKING ON UPGRADE
!Broker VM Pathfinder applet is deprecated and can no longer be activated in new tenants or existing tenants that have never implemented it before; if previously implemented, it remains available until January 25, 2026.
!Broker VM agent installer and content caching minimum requirements changed: processor must be at least 8-core and disk requirement increased to 1024 GB (previously 512 GB).
Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 4.2 adds Advanced Email Security, Linux kernel module scanning, macOS network inspection, new XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. IP functions, and several public APIs.
Introduces Advanced Email Security with an AI-driven analytics engine for real-time email attack detection and automated remediation.
Adds Kernel module examination in Linux to detect and prevent attacks by scanning Linux kernel modules at load time.
Enhances driver threat prevention for Windows to detect and block privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. attempts via user-to-kernel interactions.
Adds Network Packet Inspection for macOS to detect and prevent malicious network activity from macOS endpoints.
Allows setting automatic upgrade schedules for each endpoint profile to control agent upgrades.
+23 moreshow less
Adds Extended Scope-Based Access Control (SBAC) to specify which groups of assets users can access and actions they can perform.
Adds Export filter JSON from the UI to ease writing API calls by exporting proprietary JSON filter objects directly from the interface.
Supports German healthcare data control with strict data privacy and service localization controls in the Cortex XDR cloud region for Germany.
Adds Cases and Issues public APIs for listing/updating cases, accessing related issues/assets/artifacts, and listing/creating/updating issues.
Updates Create Distributions API to support Kubernetes installations for agent deployment automation.
Introduces Identity Security Access Table Data API (CIEM Access Table Data API) to retrieve detailed access information using filters.
Adds Unified Asset Inventory APIs with powerful filtering capabilities for on-premises and cloud asset data.
Adds public API endpoints for managing API keys (get, create, delete in bulk).
Enhances Cortex API security with endpoint classification, automatic API spec extraction from AWS/Azure gateways, F5 BIG-IP LTM integration, and DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. unified data sensitivity scanning.
Introduces Automation Exclusion Center to configure centralized automation exclusion policies for assets.
Adds new analytics suites: EDR Windows C2 Analytics, EDR Linux Shell Analytics, and EDR MacOS Shell Analytics.
Improves NDR Lateral Movement Analytics and EDR macOS AppleScript Analytics with richer logging and expanded coverage.
Allows viewing the full list of detections behind analytics indicators of compromiseindicators of compromiseAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. (BIOCs) in the console.
Adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. support for visibility, compliance, and governance over Oracle Cloud Infrastructure assets.
Adds VNET flow log support for Azure Network Watcher.
Adds new XQL IP functions to verify valid IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. addresses and identify known private IPs.
Adds ITDR Issues and Insights Navigation for reviewing ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions.-related issues with filtering and sorting.
Introduces Unified Identity Inventory with dedicated sections for cloud, enterprise, and code domains.
Enables cloud-based host policies based on cloud attributes like cluster name, region, and provider (requires agent 8.9+).
Adds detection of malicious VBScript files being written to disk (requires agent 8.9+).
Enhances Broker VM error visibility by logging applet status changes in the collection_auditing dataset.
Enforces licenses for Broker VM applets to ensure only purchased capabilities are available.
Deprecates the Broker VM Pathfinder applet (removal of activation for new tenants, existing support until 2026-01-25).
PAN-OS 12.1 adds Zero Touch Provisioning (ZTP) over cellular interfaces for remote deployments.
Enables ZTP to use cellular interfaces for automatic deployment and configuration of NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. devices in locations with limited or no traditional wired connectivity.
Supports multiple ZTP connectivity scenarios including cellular-only, ethernet-only, and hybrid connections.
Cortex Xpanse Expander 2.10 adds dynamic protocol detection for all 65k ports, new post-compromise detections, and AR attribution tags.
Adds dynamic port protocol detection across all 65k IPv4 ports to improve service discovery
Introduces Integrated Attack Surface Testing view in Threat Response Center for confirmed exploitability insights
Adds new post-compromise detections for Ransomware, Cryptojacking, and Webshells
Replaces Asset Tags and IPR Tags with automatic Attribution Reason (AR) tags
Enables new attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. rules to identify internet-facing applications leaking credential information
PAN-OS 11.1 adds Dedicated Tunnels for Panorama Connectivity via IPSec over DIA interfaces to eliminate SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. overlay dependency.
Adds Dedicated Tunnel to Panorama feature to establish persistent IPSec tunnels from branch devices to Panorama through designated termination devices using direct internet access (DIA) interfaces.
Cortex Cloud Runtime Security 1.2 adds API security, CI/CD asset inventory, new APIs, and KSPMKSPMKubernetes Security Posture Management: a category of tooling that continuously audits Kubernetes clusters against configuration best practices and compliance policies to surface misconfigurations before attackers exploit them. support
Adds Kubernetes admission controller support to actively block deployments with malware or sensitive secrets.
Introduces Virtual Machine Image Scanning to detect vulnerabilities in x86-64 and ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. VM disk images.
Expands Integrity monitoring via XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. agent to Linux, Windows, and Kubernetes environments for file/directory change detection.
Adds granular policy scoping using cluster-level scope and cloud metadata (name, region, provider).
Enables Container registry scanning via broker VM for self-hosted registries without external exposure.
+39 moreshow less
Introduces Enhanced container image modeling to distinguish core, build, registry, and runtime images.
Expands KSPM coverage to managed OpenShift and self-managed Kubernetes (non-OpenShift) environments with built-in CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmarks.
Adds Agentless Scanning for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. and ARM64 Container Images and VM Instances.
Introducing Cloud Attack Surface Management (ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them.) to discover unmanaged assets across AWS, Azure, and GCP.
Expands Amazon SageMaker support in AI Security for asset inventory and supply chain protection.
Adds datasets inventory for training and inference datasets.
Adds MIP label integration for data classification prioritization.
Supports CosmosDB and GCP Bigtable data classification.
Adds Microsoft 365 support (SharePoint, OneDrive) for sensitive data visibility.
Introduces Custom Data Patterns based on regex, context words, and proximity in Data Classification.
Allows enabling or disabling specific data profiles in Data Classification.
Adds new Application Security APIs to programmatically automate scan management, policies, operational risk assessment, and third-party ingestion.
Adds Cases and Issues public APIs for listing/updating cases and creating/updating issues.
Extends Create Distributions API to support Kubernetes installations.
Introduces Identity Security Access Table Data API for advanced integration with detailed access information.
Provides Unified Asset Inventory APIs with powerful filtering capabilities.
Adds Compliance report and assessment APIs for listing, downloading, and deleting reports.
Provides APIs for managing API keys (get, create, delete, bulk delete).
Integrates Cortex API security with F5 BIG-IP LTM integration option.
Enhances Cortex API security to classify endpoints/sub-types and extract specs from AWS/Azure API gateways.
Adds Streamlined cloud automation configuration via Terraform for AWS, GCP, and Azure onboarding.
Introduces Automation Exclusion Center to define assets excluded from automated remediation.
Supports OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. as a new cloud platform in External Data Ingestion.
Adds VNET flow log support for Azure Network Watcher.
Adds Out-of-the-box compliance assessment profiles that kick off on module onboarding.
Enables Direct Docker image scanning with CWP CLI without intermediate archive files.
Supports File integrity monitoring add-on for Windows, Linux, and Kubernetes.
Enables Cloud-based host policies based on cloud attributes (cluster name, region, provider) in Cortex XDR agent 8.9.
Adds Linux packages in use detection (GO packages) with Cortex XDR agent 8.9.
Expands Graph Search (Beta) to investigate real-time runtime events and internet-exposed assets.
Adds New XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. IP functions for IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. verification and private IP checks in Cortex Query Language.
Introduces VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. Organizations, Collaborators, and CI/CD instances as distinct assets in the Unified Asset Inventory (UAI).
Expands CI/CD rules coverage to GitLab and Bitbucket with CIS GitHub, CIS GitLab, and CI/CD OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 benchmarks.
Adds SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. Package Operational Risk insights for dependency maintenance status.
Supports CI tools integration for code scanning in CI/CD pipelines (Terraform Cloud/Enterprise Run Tasks included).
Introduces new ASPMASPMApplication security posture management, combining findings about applications from multiple tools and relating them to business context. It helps teams decide which fixes matter most. Command Center for centralized application security risk visibility.
Adds Application asset inventory side card with lifecycle risk overview.
Supports Relationship table view for Cortex Cloud Identity Security assets.
Introduces Review Unused Permissions feature for IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy analysis.
44 details in Everything
└──▷ BREAKING ON UPGRADE
!The Broker VM Pathfinder applet is deprecated and can no longer be activated in new tenants; it will remain available until January 25, 2026.
!When using the Broker VM for the agent installer and content caching, you must use a minimum of an 8-core processor and increase the disk requirement to 1024 GB, instead of the previous 512 GB minimum requirement.
PAN-OS 11.2 adds encrypted DNS (DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring./DoTDoTDNS over TLS: an IETF standard (RFC 7858) that wraps DNS queries in a TLS session on port 853, preventing eavesdropping and tampering that plain UDP DNS allows.) support for the DNS Proxy and Management Interface.
Enables encrypted DNS via DNS Proxy, supporting DNS-over-HTTP (DoH) and DNS-over-TLSDNS-over-TLSA protocol that wraps DNS queries inside a TLS connection on port 853, preventing eavesdroppers from reading or tampering with hostname lookups. Cyber tools use it to keep reconnaissance and C2 traffic from leaking in plaintext. (DoT)
PAN-OS 11.2 adds HTTP/2 protocol support for the NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. management plane via new CLI configuration.
Enables manual HTTP/2 activation through the CLI with automatic disabling of HTTP/1.1 and no fallback capability
Prisma Cloud July 2025 adds Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. auth, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant.IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. tag ingestion, new CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline./AESCSF benchmarks, and expanded Azure flow log coverage.
Support for Entra ID Authentication allows Microsoft Entra ID as an authentication method for Azure flow log ingestion.
azure-app-container-apps-managed-environment API integration ingests Azure Container Apps managed environments.
azure-fluid-relay-server API integration ingests Azure Fluid Relay server data.
azure-network-watcher-flowlogs API integration ingests Azure Network Watcher flow logs.
azure-signalrservice-web-pub-sub-diagnostic-settings API integration ingests Azure Web PubSub diagnostic settings.
+6 moreshow less
Updated azure-app-container-apps API now appends authConfigs details to existing container app data.
oci-iam-tag-default API integration ingests OCI IAM tag defaults.
Australian Energy Sector Cyber Security Framework (AESCSF) V2 - Lite Framework is available on the Compliance > Standards page for self-assessment.
Support for CIS Microsoft Azure Foundations Benchmark v4.0.0 (Level 1 and Level 2) as a built-in compliance standard.
Support for CIS Amazon Web Services Foundations Benchmark v5.0.0 (Level 1 and Level 2) as a built-in compliance standard.
Support for CIS Google Cloud Platform Benchmark v4.0.0 (Level 1 and Level 2) as a built-in compliance standard.
11 details in Everything
└──▷ BREAKING ON UPGRADE
!Policy 'Azure Microsoft Defender for Cloud automatic provisioning of log Analytics agent for Azure VMs is set to Off' is deleted, resolving all associated alerts.
Cortex Cloud Posture Management 1.2 adds Cloud ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them., OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant./M365/SageMaker support, generic SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. ingestion, SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. GA, AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. CLI, new APIs, and more.
Adds Cloud Attack Surface Management module to scan for unmanaged assets and external services across AWS, Azure, and GCP.
Adds OCI support for visibility, compliance, and governance over Oracle Cloud Infrastructure environments.
Adds Microsoft 365 support to gain visibility into SharePoint and OneDrive sensitive data and detect misconfigurations.
Adds Amazon SageMaker support for AI asset inventory, risk insights, and supply chain protection.
Adds Trusted IP support to define trusted public networks and suppress internet exposure alerts for approved sources.
+33 moreshow less
Adds Expanded network visibility and detection to view network configurations and detect outbound/east-west exposure for AWS EC2s.
Adds Generic SARIF Ingestion for SAST to centralize AppSec visibility from third-party sources outputting SARIF.
Adds Software Composition Analysis (SCA) GA providing vulnerability detection, license compliance, SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation, and package operational risk.
Adds Application Security (AppSec) CLI as part of Cortex CLI for local scanning and CI steps.
Adds Cortex Cloud IDE plugin integration with VSCode and JetBrains for in-code IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup., SCA, secrets, and license scanning.
Adds Identify inactive AI models detection to detect stale AI models.
Adds Enhanced custom rule support to create custom detections across identity, data, and AI rules.
Adds MIP label integration to use Microsoft Information Protection labels for prioritizing remediation.
Adds Extended Scope-Based Access Control (SBAC) to specify which groups of assets users can access and what actions they can perform.
Adds Extended Role-Based Access ControlRole-Based Access ControlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.) with new roles in AI Security, Data Security, and Identity Security.
Adds Datasets inventory under AI Security to discover, investigate, and trace training and inference datasets.
Adds Data Classification - Custom Data Profiles feature to define and manage sensitive data precisely for files and tables.
Adds Data Classification - Custom Data Patterns to create custom sensitive data definitions based on regex, context words, and proximity.
Adds Data Classification - Enable/Disable Data Profiles to turn off custom and out-of-the-box profiles.
Adds CosmosDB data classification, Azure SQL Managed Instance data classification, AWS Redshift data classification, and GCP Bigtable data classification under Data Security.
Adds Tables in object inventory to see all tables in structured and semi-structured data assets.
Adds Relationship table view for Identity Security assets to show connections like group membership and role assumption.
Adds Review Unused Permissions feature to analyze audit logs and identify excessive permissions.
Adds Supply Chain tools inventory and control over VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. and CI/CD tools.
Adds VCS Organizations, Collaborators, and CI/CD instances as distinct assets in the Unified Asset Inventory (UAI).
Adds CI/CD risk-based policy management to create policies based on CI/CD risks.
Adds Software Composition Analysis (SCA) Package Operational Risk insights for open source dependencies.
Adds New Application Security APIs and ASPM public APIs for programmatic automation of scan management, policies, and operational risk assessment.
Adds New XQL IP functions to verify valid IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. addresses and check if they are known private IPs.
Adds Graph Search enhancements (Beta) to investigate real-time activity and track assets with internet exposure.
Adds Cases and Issues public APIs for managing cases, issues, assets, and artifacts.
Adds Identity Security Access Table Data API for retrieving detailed access information using filters.
Adds Unified Asset Inventory APIs for comprehensive API access to asset information with powerful filtering.
Adds Compliance report and assessment APIs for listing, downloading, deleting reports, and retrieving assessments by ID.
Adds APIs for managing API keys endpoints to get, create, delete, and bulk delete API keys.
Adds Out-of-the-box compliance assessment profiles that kick off automatically upon module onboarding.
Adds Virtual Machine Image Scanning to detect vulnerabilities and misconfigurations in VM disk images.
Adds Container Registry Scanning via Broker VM to secure self-hosted container registries without external exposure.
Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 3.15 adds Linux kernel module examination, macOS network packet inspection, XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. IP functions, and unified identity inventory.
Kernel module examination detects attacks by scanning Linux kernel modules at load time.
Create Distributions API now supports Kubernetes installations via the API endpoint.
Unified Identity Inventory provides dedicated sections for investigating cloud, enterprise, and code identities.
AP6 access points now support RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. VLAN assignment for user separation without multiple SSIDs.
Adds RADIUS VLAN assignment support for AP6 access points to separate users dynamically based on authentication.
Adds STPSTPSpanning Tree Protocol, an IEEE standard (802.1D) that prevents Layer 2 network loops by electing a root bridge and blocking redundant switch paths, keeping Ethernet networks stable under failure conditions. configuration (RSTP/MSTP) and MST instance creation for Sophos Switch at site, stack, and device levels
Adds Spanning Tree Protocol settings for Sophos Switch at the site, stack, and individual switch levels.
Enables Rapid Spanning Tree Protocol (RSTP) and Multiple Spanning Tree Protocol (MSTP) via Sophos Central Global STP configuration.
Allows creation of MST instances and configuration of RSTP, Common and Internal Spanning Tree (CIST), and MST settings for individual ports.
Aviatrix CoPilot 4.23.0 adds saved views for Native Peering and Cloud Assets, plus new TGW columns and WebGroup navigation
Adds the ability to save custom views and filters in *Networking > Connectivity > Native Peering* to manage large-scale peering deployments.
Adds a *Manage View* page to *Cloud Resources > Cloud Assets* that supports saving custom views, persisting column filter settings, and pinning the first column during horizontal scrolling.
Adds TGW ID, Account, and Cloud columns to the *Networking > Connectivity > AWS TGW* page for deeper context on Transit GatewayTransit GatewayAn AWS-managed network hub that connects VPCs and on-premises networks through a single gateway, replacing complex peering meshes and giving cyber tools a central point to route or inspect cross-network traffic. connections.
Enables navigation from WebGroups in *Security > Distributed Cloud Firewall > Policies* rules to their details pages, and allows links in *Groups > WebGroups* to return to the *Policies* page.
Snort3 3.9.2.0 adds CIP inspector fallback, multi-instance file cache sharing, and separate TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. sequence tracking.
└──▷ GET THIS VERSION
$ git clone --branch 3.9.2.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.9.2.0
└──▷ USE IT
Update your http_inspect configuration to use the renamed parameter so partial body inspection depth continues to work after upgrade.
Snort 3.9.1.0 adds binding-block-on-do-not-decrypt, buffered std_connector output, file-redirect for connectors, and partial_depth HTTP inspection config.
└──▷ GET THIS VERSION
$ git clone --branch 3.9.1.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.9.1.0
└──▷ USE IT
Limit HTTP body inspection to a fixed depth to reduce CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. cost on large uploads while still catching header-layer threats.
lua
http_inspect = { partial_depth = 8192 }
Adds facility to block binding based on a do_not_decrypt flow flag and a new can_decrypt inspector method, enabling policy enforcement on encrypted flows that cannot be decrypted.
Adds buffered output to std_connector, improving throughput for high-volume event streams.
Adds redirect option to connectors to print output directly to a file instead of stdout.
Adds partial_depth configuration option to http_inspect for controlling inspection depth on partial HTTP content.
Adds context logging event for notice level in the extractor module.
+5 moreshow less
Adds a 1-reader-1-writer ring buffer helper for internal pipeline efficiency.
AppID now differentiates between request and response DNS hostnames for more precise application identification.
AppID now synchronizes flow service with protocol-based detection.
Adds affinity setting for the connector flusher thread, enabling CPU pinning for performance tuning.
Profiler output now includes a note for total percentage in profiler_dump results.
CrowdSec v1.6.10 adds allowlist IP checking, SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. support for S3, and GET/HEAD for HTTP datasource
└──▷ GET THIS VERSION
$ git clone --branch v1.6.10 https://github.com/crowdsecurity/crowdsec.git
# already have the repo? check out this version:$ git checkout v1.6.10
Adds cscli allowlists check command to check whether an IP or range belongs to an allowlist.
Supports SNS notification format in the S3 datasource, enabling log ingestion triggered by SNS events.
Supports GET and HEAD requests in the HTTP datasource so log providers can confirm the datasource is reachable.
Wireshark 4.4.8 updates protocol dissection for ASTERIX, DNP3DNP3A serial and TCP/IP communication protocol used in industrial control systems, especially power grids and water utilities, to let control software poll and command field devices like sensors and switches., DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic., IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications., and more.
Updated protocol support for ASTERIX
Updated protocol support for DLT
Updated protocol support for DNP 3.0
Updated protocol support for DOF
Updated protocol support for DTLS
+12 moreshow less
Updated protocol support for ETSI CAT
Updated protocol support for Gryphon
Updated protocol support for IPsec
Updated protocol support for ISObus VT
Updated protocol support for KRB5
Updated protocol support for MBIM
Updated protocol support for RTCP
Updated protocol support for SLL
Updated protocol support for STCSIG
Updated protocol support for TETRA
Updated protocol support for UDS
Updated protocol support for URL Encoded Form Data
New Log::max_log_record_size redefinable constant lets operators cap the size of individual log records to prevent memory overflow from crafted packets.
New log_record_too_large weird is raised whenever a log entry exceeds the configured size limit, enabling detection and alerting.
New log-writer-discarded-writes metric tracks how often log entries are dropped due to exceeding the size limit.
Malcolm v25.07.0 adds Arkime WISE tagging, ANSI C12.22 ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. protocol support, multi-instance Suricata PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. processing, and IANA service enrichment for Zeek.
└──▷ GET THIS VERSION
$ git clone --branch v25.07.0 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v25.07.0
└──▷ USE IT
Enable the Arkime WISE GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. so analysts can view and edit WISE tagging configuration from the web interface.
Enable IANA service enrichment in Zeek's known_services.log to map port numbers to human-readable service names.
ini
ZEEK_DISABLE_IANA_LOOKUP=false
Adds ARKIME_EXPOSE_WISE_GUI and ARKIME_ALLOW_WISE_GUI_CONFIG to arkime.env to control exposure of the Arkime WISE GUI viewer/editor for tag-based enrichment.
Adds ARKIME_WISE_CONFIG_PIN_CODE to arkime-secret.env for authenticating changes to the WISE configuration via the WISE GUI.
Adds ARKIME_WISE_SERVICE_URL to arkime-secret.env for specifying the connection endpoint to the WISE service.
Adds SURICATA_AUTO_ANALYZE_PCAP_PROCESSES to suricata-offline.env and changes the meaning and default of SURICATA_AUTO_ANALYZE_PCAP_THREADS to enable multiple concurrent Suricata instances in PCAP processing mode via UNIX socket.
Adds ZEEK_DISABLE_IANA_LOOKUP to zeek.env (and control_vars.conf for Hedgehog Linux) to control IANA service name and description enrichment in Zeek's known_services.log.
+11 moreshow less
Adds ANSI C12.22 ICS protocol analyzer variables to zeek.env (and control_vars.conf for Hedgehog Linux) to control the new ICSNPP C12.22 parser and log output, with a corresponding new dashboard.
Adds ARKIME_WISE_PLUGIN and ARKIME_WISE_URL to Hedgehog Linux control_vars.conf as part of WISE integration.
Handles comma- or semicolon-separated directories for PCAP_PROCESSED_DIRECTORY to support multiple live PCAP processing sources (e.g., Malcolm-Helm deployments).
Handles new OPCUA Binary summary logs from the ICSNPP OPCUA Binary parser.
Changes LS_JAVA_OPTS default heap size in logstash.env from 2500m to 3g for improved Logstash performance.
Removes VIEWER from arkime-live.env and removes VIEWER and WISE from arkime-offline.env as these are now handled internally.
Exposes Arkime WISE tagging features to users for enriching session data with external data sources.
Incorporates new ANSI C12.22 ICS protocol parser with a corresponding dashboard for utility AMI traffic analysis.
Adds IANA service name and description enrichment to Zeek's known_services.log.
Supports multiple Suricata instances in PCAP processing mode via UNIX socket.
Improves file pruning speed.
16 details in Everything
└──▷ BREAKING ON UPGRADE
!VIEWER is removed from arkime-live.env — any deployment that sets this variable manually will need to remove it.
!VIEWER and WISE are removed from arkime-offline.env — any deployment that sets these variables manually will need to remove them.
!The meaning and default of SURICATA_AUTO_ANALYZE_PCAP_THREADS in suricata-offline.env has changed as part of multi-instance Suricata support — review and update existing configurations accordingly.
!The default LS_JAVA_OPTS heap size in logstash.env changes from 2500m to 3g — deployments with constrained memory should review this new default.
cilium-cli v0.18.6 adds node annotation cleanup on uninstall and partial BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. peer output on errors
└──▷ GET THIS VERSION
$ git clone --branch v0.18.6 https://github.com/cilium/cilium-cli.git
# already have the repo? check out this version:$ git checkout v0.18.6
Adds automatic removal of annotations from Kubernetes nodes during cilium uninstall when clean-cilium-state: true is set.
Prints partial output when cilium bgp peers encounters errors, rather than silently failing.
2 details in Everything
1 more release in this issue
· 2025-07-02 → 2025-07-30
cilium-cli v0.18.5 adds clustermesh policy inspection, tolerations flag for connectivity tests, and improved EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. name detection.
└──▷ GET THIS VERSION
$ git clone --branch v0.18.5 https://github.com/cilium/cilium-cli.git
# already have the repo? check out this version:$ git checkout v0.18.5
└──▷ TRY IT
Inspect the default local cluster policy in a ClusterMesh setup to audit which cluster is treated as local by default.
Grype v0.97.0 adds RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. Extended Update Support (EUS) matching and distro channel tracking.
└──▷ GET THIS VERSION
$ git clone --branch v0.97.0 https://github.com/anchore/grype.git
# already have the repo? check out this version:$ git checkout v0.97.0
Adds vulnerability matching support for RHEL Extended Update Support (EUS) streams.
Adds channel information to OS/distro detection for more precise distribution identification.
2 details in Everything
2 more releases in this issue
· 2025-07-02 → 2025-07-30
Grype v0.96.0 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scores and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. indicators to CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. vulnerability ratings output.
└──▷ GET THIS VERSION
$ git clone --branch v0.96.0 https://github.com/anchore/grype.git
# already have the repo? check out this version:$ git checkout v0.96.0
Adds mcpserver subcommand to expose Kubescape capabilities via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. protocol
└──▷ GET THIS VERSION
$ git clone --branch v3.0.35 https://github.com/kubescape/kubescape.git
# already have the repo? check out this version:$ git checkout v3.0.35
Adds mcpserver subcommand to start an Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for tool integration
Inspektor Gadget v0.42.0 adds Rust WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. bindings, removes built-in gadgets, and expands trace_tcp, image, and deploy capabilities.
└──▷ GET THIS VERSION
$ git clone --branch v0.42.0 https://github.com/inspektor-gadget/inspektor-gadget.git
# already have the repo? check out this version:$ git checkout v0.42.0
└──▷ TRY IT
Import a gadget image and get machine-parseable JSON output for scripting or CI pipelines.
$ ig image import <path> --output json
Adds Rust WASM bindings, enabling gadget authors to write gadgets in Rust targeting the WASM API.
Adds accept-only parameter to trace_tcp to filter captured events to accepted connections only.
Adds tty field to process/exec event data.
Allows gadgets to specify default values for parameters in their metadata.
Adds support for a config file in the deploy command.
+9 moreshow less
Supports extra environment variables for the DaemonSet via Helm charts.
Handles gadget signatures during image export and image import operations.
Adds JSON output mode to the image import command.
Adds a default gadget namespace to Helm charts.
Introduces PreCreateContainer events in the container hook lifecycle.
Sets visibility controls on formatted/derived columns.
Provides human-readable format for bytes and duration fields in bpfstats and top_process.
Uses CO-RE in socketenricher, making it resilient to kernel struct layout changes.
Caches gadget OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. signatures via ORASORASA CNCF project implementing the OCI Registry as Storage specification, letting tools push and pull arbitrary artifacts—not just container images—to and from any OCI-compliant registry. to speed up repeated pulls.
14 details in Everything
└──▷ BREAKING ON UPGRADE
!All built-in gadgets have been removed treewide; gadgets must now be referenced as OCI images.
!Deprecated environment variables in gadgettracermanager have been removed; configs must be migrated to the supported config file.
!Support for torcx has been removed; environments relying on torcx for container runtime integration will no longer work.
Docker Compose v2.39.0 adds time-filtered events, FreeBSD support, model config inspection, and build provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build./SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. attributes.
└──▷ GET THIS VERSION
$ git clone --branch v2.39.0 https://github.com/docker/compose.git
# already have the repo? check out this version:$ git checkout v2.39.0
└──▷ TRY IT
Filter container events to a specific time window — useful for post-incident review of what happened during a deployment window.
Docker Compose v2.38.2 adds --networks flag to the config command for filtered network output.
└──▷ GET THIS VERSION
$ git clone --branch v2.38.2 https://github.com/docker/compose.git
# already have the repo? check out this version:$ git checkout v2.38.2
└──▷ TRY IT
Inspect only the resolved network definitions in a Compose project — useful for auditing network topology without the noise of services, volumes, and other keys.
Kata Containers 3.19 adds runtime-rs blockfile rootfs, memory/vCPU hotplug for Cloud Hypervisor, vfio coldplug, and GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. annotations
└──▷ GET THIS VERSION
$ git clone --branch 3.19.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:$ git checkout 3.19.0
Adds blockfile based rootfs support in runtime-rs
Adds VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space. support with coldplug for Cloud Hypervisor in runtime-rs
Adds GPU annotations for remote hypervisor in runtime-rs
Adds initdata annotation support for remote hypervisor in runtime-rs
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The default block device driver is changed from virtio-scsi to virtio-blk-* in runtime-rs
Export a built image to multiple destinations simultaneously (e.g., a local OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. directory and a tarball) in one build invocation.
Adds --timestamp flag to buildah add for setting file timestamps when adding content.
Adds --source-date-epoch and --rewrite-timestamp flags to buildah commit and buildah build for reproducible image builds.
Allows --output to be specified multiple times in buildah build, enabling simultaneous export to multiple destinations.
Adds --unsetannotation flag to buildah build and buildah config for removing specific OCI/Docker image annotations.
Adds --inherit-annotations flag to buildah build for propagating annotations from base images.
+7 moreshow less
Supports ADD/COPY--link instruction in Dockerfiles, enabling efficient layer composition without cache invalidation.
Supports zstd compression when committing images with buildah commit.
Accepts SOURCE_DATE_EPOCHSOURCE_DATE_EPOCHA Unix timestamp set as an environment variable to make build tools substitute a fixed date for the current time, enabling reproducible builds whose output is byte-for-byte identical across machines and runs. as a build-arg in Dockerfile builds for reproducibility.
Adds label_users support, enabling user label mapping in container builds.
Supports host-gateway as a valid value in --add-host / --extra-hosts format.
Sets the OCI org.opencontainers.image.created annotation on OCI images at commit/build time.
Cache selection now prefers the most recent layer when conflicts arise during image builds.
Gatekeeper v3.20.0 adds disk-based violation export, a new Connection CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it., and promotes VAP generation to beta-on-by-default.
└──▷ GET THIS VERSION
$ git clone --branch v3.20.0 https://github.com/open-policy-agent/gatekeeper.git
# already have the repo? check out this version:$ git checkout v3.20.0
New disk export driver lets Gatekeeper write audit violations directly to disk as an export backend.
New Connection CRD replaces ConfigMap for configuring connections to export backends.
VAP/VAPB generation graduates to beta and is now enabled by default for ConstraintTemplates/Constraints using the K8sNativeValidation engine with CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. code.
Adds dryrun enforcement action mapping to audit in ValidatingAdmissionPolicyBinding (VAPB).
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The Connection CRD replaces ConfigMap for establishing connections with export backends; existing ConfigMap-based export backend configurations will need to be migrated to Connection resources.
Trivy is a comprehensive security scanner that finds vulnerabilities, misconfigurations, secrets, and SBOM in containers, Kubernetes, code repositories, and clouds
Trivy v0.65.0 adds HTTP tracing, AlmaLinux 10 support, Git repo metadata in reports, and SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface.CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. vectors.
└──▷ GET THIS VERSION
$ git clone --branch 0.65.0 https://github.com/aquasecurity/trivy.git
# already have the repo? check out this version:$ git checkout 0.65.0
image section gains Docker context resolution to handle image references via Docker context
license scanner observes pkg_type option to filter by package type
Git repository metadata is now included in Trivy scan reports
SARIF report output now includes CVSS vectors for findings
CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence.SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation supports SHA-512 hashes
+2 moreshow less
misconf rules added for GCP private IP access attribute in subnetworks and GCS bucket logging/versioning
AlmaLinux 10 is supported as a new platform for vulnerability scanning
Prowler 5.9.0 adds SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties., mutelist support, a Resource View, remote Git IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scanning, and 8 new cloud security checks.
└──▷ GET THIS VERSION
$ git clone --branch 5.9.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 5.9.0
└──▷ TRY IT
Scan IaC files in a remote private Git repo from a CI/CD pipeline without cloning it locally first.
Fetch the latest scan results for all resources to build an up-to-date asset inventory.
$ curl -X GET https://<prowler-api>/resources/latest \
-H 'Authorization: Bearer <token>'
Adds Mutelist support: mute findings via the UI or API, with mute reasons visible in finding details and listing views, and instant toggle of muted-finding visibility across all views.
Introduces SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.-based Single Sign-On via a new Sign in with SSO login option, supporting Okta and any SAML-compatible identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
New Resource View provides a unified, browsable inventory of all cloud assets with tags, metadata, provider info, and directly linked findings sorted by FAIL count.
IaC provider now supports scanning remote Git repositories (public and private) via --scan-repository-url, enabling direct CI/CD pipeline integration.
Adds 8 new security checks: entra_intune_enrollment_sign_in_frequency_every_time for M365, and 7 Azure checks covering SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. encryption, SMB protocol version, VM backup, SSH authentication enforcement, approved VM images, VM scaleset load balancer association, and Defender attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. notifications.
+8 moreshow less
New API endpoints GET /resources/metadata, GET /resources/metadata/latest, and GET /resources/latest expose resource metadata and latest scan results.
New /processors API endpoint enables post-processing of findings; currently supports the Mutelist processor for muting findings programmatically.
Enforces stronger password requirements for new sign-ups: minimum 12 characters with uppercase, lowercase, numbers, and special characters, with a real-time strength indicator.
Adds a navigation link in the Scans view to access the Compliance Overview directly.
Adds a Status column to the findings table in the Compliance Detail view.
Adds route access restriction based on user permissions in the UI.
Adds test_connection method to the GitHub provider.
POST /schedules/daily now returns 409 CONFLICT if a daily schedule already exists.
13 details in Everything
2 more releases in this issue
· 2025-07-03 → 2025-07-17
Prowler 5.8.0 adds AI-powered Lighthouse assistant, IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scanning via Checkov, M365 app-only auth, 21 new checks, and NIS 2 / CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. 4.0 / CIS 1.11 / ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001 compliance frameworks.
└──▷ GET THIS VERSION
$ git clone --branch 5.8.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 5.8.0
└──▷ TRY IT
Scan local IaC files (Terraform, CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call., Kubernetes YAML, etc.) for misconfigurations before deploying — shift-left security in CI/CD or local workflows.
$ prowler iac
Configure Prowler Lighthouse with your preferred LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. and API key to enable natural-language security posture Q&A in the UI.
📍In the console, go to the Lighthouse tab › Lighthouse Configuration Panel, select your LLM (e.g., GPT-4o Mini), enter your API Key, and optionally add business-specific context, then save.
Introduces Prowler Lighthouse, an AI-powered cloud security assistant that answers natural-language questions about compliance status, prioritizes failed checks, and suggests remediations — configurable with your own LLM (e.g., GPT-4o Mini) and API key.
Adds IaC scanning powered by Checkov via prowler iac, supporting Terraform, CloudFormation, ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware., Kubernetes YAML, and more to catch misconfigurations pre-deployment.
Supports Microsoft 365 app-only (service principal) authentication via OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. client-credentials, enabling fully unattended scans against Exchange Online, SharePoint, Teams, etc.
Adds GCP Service Account Key JSON authentication, allowing GCP onboarding by pasting a key without CLI setup.
Adds 21 new security checks: 1 for AWS, 11 for Azure, 3 for Microsoft 365, and 6 for GitHub.
+11 moreshow less
Adds baseline NIS 2 (EU 2022/2555) compliance support for AWS, Azure, and GCP.
Adds three new compliance frameworks: CIS 4.0 for GCP, CIS 1.11 for Kubernetes, and ISO 27001 for Microsoft 365.
Adds detailed compliance views for all supported frameworks (ENS-RD2022, CIS, ISO, NIST, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior., KISA, AWS Well-Architected, etc.) with interactive pie charts, top-failed-sections breakdown, failure heatmaps, and per-category drilldowns.
Adds a Resource name column to the findings table for faster identification of affected resources during triage.
Adds GET /compliance-overviews API endpoints to retrieve compliance metadata and per-requirement status metrics.
Adds Lighthouse configuration API support for setting LLM provider, API key, and business context.
Supports HTTPS_PROXY and K8S_SKIP_TLS_VERIFY environment variables for Kubernetes provider.
Adds new Azure checks: storage_geo_redundant_enabled and storage_cross_tenant_replication_disabled.
Adds new M365 checks: entra_users_mfa_capable, admincenter_organization_customer_lockbox_enabled, and admincenter_external_calendar_sharing_disabled.
Adds new GitHub check: repository_has_codeowners_file.
Revamped User Profile page showing Organization ID, join date, email, active roles, and organization membership with a one-click Organization ID copy action.
16 details in Everything
└──▷ BREAKING ON UPGRADE
!Compliance detailed views are only available for new scans from v5.8.0 onwards; all compliance overviews from previous scans are not available in the new detailed view.
ScubaGear v1.6.0 adds policy annotations, app-permission reporting, DNS log tables, OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic. v1.1–1.3 support, and a new device-code-auth block policy.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.0 https://github.com/cisagov/ScubaGear.git
# already have the repo? check out this version:$ git checkout v1.6.0
Adds capability to annotate results for individual policies; annotations appear in the HTML report's details column.
Adds reporting for application and delegated permissions assigned to application/service principal objects.
Adds DNS log tables to the Exchange Online HTML report with overhauled DNS error handling.
Supports dynamic Graph permissions generation for ScubaGear connections, reducing the Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs. dependency footprint.
Includes results for omitted policies in the ScubaGear results JSON output.
+6 moreshow less
Extends OPA support to versions v1.1.0 through v1.3.0.
Improves Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. performance by switching to direct Graph APIGraph APIMicrosoft's unified REST API for accessing data across Microsoft 365 services — mail, calendar, users, files — letting cyber tools query or monitor cloud environments through a single authenticated endpoint. calls, decreasing total Microsoft Graph dependencies.
Adds new SHOULD policy MS.AAD.3.9v1 to block device code authentication.
Updates MS.EXO.1.1v2 to allow automatic forwarding for specific, agency-approved domains on an allow list.
Updates MS.AAD.3.3v2 so login context checks apply only when Microsoft Authenticator is enabled.
Removes MS.AAD.5.4v1 (Microsoft deprecated group-owner app consent), MS.DEFENDER.6.2v1, and MS.EXO.17.2v1 (superseded by updated auditing coverage) from the baseline.
11 details in Everything
└──▷ BREAKING ON UPGRADE
!MS.AAD.5.4v1 is removed from the baseline; any automation or reporting referencing this policy will no longer find it.
!MS.DEFENDER.6.2v1 and MS.EXO.17.2v1 are removed from the baseline; workflows depending on these policy checks will no longer produce results.
!MS.SHAREPOINT.1.4v1 is removed from the baseline due to setting deprecation; references to this policy in reports or scripts will no longer be valid.
!Get-TenantDetailsFromGraph commandlet is removed due to Azure AD Graph API deprecation; any scripts calling this commandlet will break.
Cloud Custodian 0.9.46 adds 10 new AWS Comprehend job resources, client-vpn-endpoint, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. endpoint service config, KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. schedule-deletion, and more.
└──▷ GET THIS VERSION
$ git clone --branch 0.9.46.0 https://github.com/cloud-custodian/cloud-custodian.git
# already have the repo? check out this version:$ git checkout 0.9.46.0
└──▷ USE IT
Write a policy that targets KMS keys for scheduled deletion — using the new schedule-deletion action.
Detect Comprehend PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. detection jobs that are not encrypting output with a compliant KMS key, useful for data-classification governance.
New aws.client-vpn-endpoint resource enables policies over Client VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. endpoints.
New aws.vpc-endpoint-service-configuration resource enables policies over VPC endpoint service configurations.
New set-security-token-service-preferences action on aws.account for managing STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets. regional endpoint settings.
New schedule-deletion action on aws.kms-key for scheduling KMS key deletion via policy.
New pipeline-config filter on aws.opensearch-ingestion for inspecting pipeline configuration.
+7 moreshow less
New delete action on aws.quicksight-user for removing QuickSight users via policy.
Adds 9 new AWS Comprehend job resources: comprehend-document-classification-job, comprehend-dominant-language-detection-job, comprehend-entities-detection-job, comprehend-events-detection-job, comprehend-key-phrases-detection-job, comprehend-pii-entities-detection-job, comprehend-sentiment-detection-job, comprehend-targeted-sentiment-detection-job, and comprehend-topics-detection-job.
New kms-key filter on aws.comprehend-document-classifier, aws.comprehend-entity-recognizer, and aws.comprehend-flywheel for encryption compliance checks.
New file-services filter on azure.storage for inspecting Azure Storage file service settings.
New config-compliance and json-diff filters on aws.iam-oidc-provider; json-diff filter also added to aws.identity-pool and aws.memorydb-subnet-group.
Cross-account filter now supports additional condition keys for finer-grained policy matching.
New policy-statement filter supports more partial match scenarios.
eksctl v0.211.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server support, custom Bottlerocket AMIs for MNG, and migrates EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives.CSICSIAn ambiguous acronym spanning Container Storage Interface, Crime Scene Investigation, and other expansions — without more context about which domain this tool operates in, a reliable definition cannot be given. to managed policy.
└──▷ GET THIS VERSION
$ git clone --branch v0.211.0 https://github.com/weaveworks/eksctl.git
# already have the repo? check out this version:$ git checkout v0.211.0
Adds MCP server implementation for eksctl, enabling model context protocol integrations.
Supports custom Bottlerocket AMIs for Managed Node Groups (MNG).
Migrates EBS CSI driver to the AmazonEBSCSIDriverPolicy managed policy, simplifying IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. management.
Pacu v1.6.1 adds EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. token extraction, directory services enum, Elastic Beanstalk enum, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. support, and new shell UX commands.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.1 https://github.com/RhinoSecurityLabs/pacu.git
# already have the repo? check out this version:$ git checkout v1.6.1
└──▷ TRY IT
Review your session's command history to audit or repeat previous enumeration steps.
$ history
Adds use as an alias for the run/exec commands for quicker module invocation.
Adds -h flag to run/exec to display per-module help inline.
New history command to review previously executed Pacu commands in a session.
New debug command to view the Pacu error log without leaving the shell.
New command to delete stored AWS keys from a Pacu session.
+7 moreshow less
Adds MFA support to assume_role, enabling role assumption with MFA-protected principals.
New eks__enum_pod_tokens module to extract service account tokens from running pods in EKS clusters.
New ds__enum (directory services enumeration) module for AWS Directory Service reconnaissance.
New elasticbeanstalk__enum module to enumerate Elastic Beanstalk environments and configurations.
Updates iam__bruteforce_permissions to check all AWS services, expanding permission coverage.
Updates secrets_enum to list all found secrets after enumeration.
Updates iam__enum_permissions module with expanded permission enumeration capabilities.
Tetragon is an eBPF-based security observability and runtime enforcement tool for Kubernetes and cloud-native environments.
Tetragon v1.5.0 adds Windows process monitoring, raw tracepoints, uprobe actions, pod annotations/node labels in events, and a CapabilitiesGained policy operator.
└──▷ GET THIS VERSION
$ git clone --branch v1.5.0 https://github.com/cilium/tetragon.git
# already have the repo? check out this version:$ git checkout v1.5.0
└──▷ USE IT
Alert on any process gaining new Linux capabilities — useful for detecting privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. at runtime.
Adds Windows support for process create and exit events, enabling Tetragon to monitor process lifecycle on Windows hosts.
Adds raw tracepoint support in tracing policies for lower-overhead kernel event collection.
Enables actions (e.g., signal, override) on uprobes in tracing policies.
Allows uprobes to be defined with offset and ref_ctr_offset for precise attach-point control.
Adds pod annotations to Tetragon events, enriching process events with Kubernetes metadata.
+12 moreshow less
Adds Kubernetes node labels to Tetragon events for richer event context.
Adds .process.pod.container.privileged field to PodInfo in events, surfacing container privilege status.
Adds CapabilitiesGained operator in tracing policy selectors to match on Linux capability escalations.
Adds repo key support in containerSelector within policy filters for image-repository-based policy scoping.
Supports IPv4-mapped IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. address form in tracing policy network selectors.
Adds --enable-ancestors flag to consolidate ancestor-tracking configuration across all event types.
Allows tracing policies to ignore kprobes for kernel symbols that cannot be found, improving policy resilience.
Adds path offload support for BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. programs.
Adds support for followChildren of older processes in matchBinaries selectors.
Excludes exit events from rate limiting to ensure process exit is always captured.
Adds tetragon.nameOverride and tetragonOperator.nameOverride Helm values for chart name customization.
Adds pprof CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. profile collection to the bugtool command.
17 details in Everything
└──▷ BREAKING ON UPGRADE
!The log level string level=warning is now emitted as level=warn after the migration from logrus to log/slog; custom scripts or tools parsing Tetragon logs may need updating.
!The default metrics scrape interval for tetragon.prometheus.serviceMonitor.scrapeInterval and tetragonOperator.prometheus.serviceMonitor.scrapeInterval is changed from 10s to 60s.
!The OciHookSetup Helm section is removed (was deprecated in v1.2); any Helm values under that section will no longer be recognized.
Replaces the notpm command with keep-dev-tpm, which retains TPMTPMA dedicated hardware chip, standardized by the Trusted Computing Group, that stores cryptographic keys and measurements in tamper-resistant silicon, giving cyber tools a root of trust that software alone cannot fake.-related devices (/dev/tpm*, /dev/tpmrm*, /dev/tcm*, /dev/tcmrm*) and the tss group when used.
Adds new sandbox profile for Ansel photo editing application.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The notpm command is removed and replaced by keep-dev-tpm; profiles using notpm must be updated to use keep-dev-tpm instead.
ThreatStream AirGap 5.6 adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v15-v17 support, CSV feed integration, and multi-queue import configuration.
Adds support for MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. versions 15.1, 16.1, 17.0, and 17.1
Adds support for the multi-queue feature allowing configuration of import workers
OpenCTI 6.7.3 adds AUTH0_LOGOUT_URI env var and audit log transports plus .pif download block
└──▷ GET THIS VERSION
$ git clone --branch 6.7.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.7.3
Adds the AUTH0_LOGOUT_URI environment variable to configure the remote logout URL for Auth0 SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.
Enables pushing all audit logs to the console or file via new transport settings
Blocks direct downloads of files with the .pif extension
Enhanced support for AWS S3 EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. notification events added to Storage Protection
Adds Cyber Attack Insights Cards to AI Feeds, Ask AI for Malware Insights, team onboarding page, and role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists..
Unlocks Cyber Attack Insights Cards in AI Feeds providing attack summary, timeline, and links to threat actors, malware, IoCs, TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., and CVEs
Enables Ask AI within Malware Insights Cards to generate summaries, reports, and answer targeted questions about specific malware
Introduces a dynamic Getting Started page for automatic team onboarding in enterprise accounts
Adds role-based access management with Admin, Editor, and Viewer roles to control workspace permissions
4 details in Everything
1 more release in this issue
· 2025-07-09 → 2025-07-23
Feedly introduces Cyber Attack Dashboard for filtering and tracking attacks, plus AI Search with cited threat intelligence answers.
New Cyber Attack Dashboard provides real-time updates on evolving attacks with filterable views by industry, country, threat actor, malware family, or attack type
New Cyber Attack Insights Cards drill down into individual attacks with timelines, IoCs, TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., CVE links, and article references
New Search - AI Mode allows asking natural language questions for structured, cited answers from curated sources and threat graph data
MISP v2.4.214 adds highPerformance and indexLogs DB script options, NDJSONNDJSONA text format where each line is a self-contained JSON object, making it easy to stream, append, and parse large datasets record-by-record without loading the whole file into memory. error logs, and a SQL slow log endpoint.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.214 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.4.214
└──▷ USE IT
Apply high-performance database indexes to events and attributes to speed up queries on large instances.
shell
cake Admin runDBScript highPerformance
View slow SQL queries from the Diagnostic controller to identify performance bottlenecks.
$ GET /diagnostic/slowSql
Adds cake Admin runDBScript with highPerformance and indexLogs options to apply performance-enhancing database indexes
Generates error logs in NDJSON format for easier parsing and integration with modern logging systems
Adds a new SQL slow log endpoint for benchmarking, allowing filtering by controller/action and pagination
3 details in Everything
1 more release in this issue
· 2025-07-16 → 2025-07-19
MISP v2.5.16 adds a performance toolkit with new DB index scripts, NDJSONNDJSONA text format where each line is a self-contained JSON object, making it easy to stream, append, and parse large datasets record-by-record without loading the whole file into memory. error logs, and a SQL slow-query benchmarking endpoint.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.16 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.16
└──▷ TRY IT
Apply high-performance database indexes on a large MISP instance to speed up event/attribute queries and correlations.
$ cake Admin runDBScript highPerformance
Add indexes to the log table so audit log searches return results quickly on busy instances.
$ cake Admin runDBScript indexLogs
New cake Admin runDBScript highPerformance command re-indexes events, attributes, objects, and default correlations for faster queries on large instances.
New cake Admin runDBScript indexLogs command adds indexes to the log table for rapid log searching and auditing.
New SQL Slow Log endpoint enables benchmarking by identifying slow SQL queries, filterable by controller/action with pagination and configurable slow-query threshold.
New purge function clears old SQL benchmark logs to keep logging data manageable.
Error logs can now be generated in NDJSON format for easier parsing and integration with modern logging pipelines.
+3 moreshow less
Error log entries now include the user that caused the exception and the exact codebase location where it occurred.
New default OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. feed from phish.co.za (Phishing.Database) added for phishing indicator coverage.
Updated misp-galaxy, misp-object, and warning-lists components to their latest versions.
Watcher v2.4 adds reliability scoring via confident column in sources.csv, BERTBERTA transformer encoder trained to understand text using context on both sides of a word. Its representations are useful for search, classification and other language-understanding tasks.-based NER for entity detection, and a refactored 30-day trending algorithm.
└──▷ GET THIS VERSION
$ git clone --branch v2.4 https://github.com/thalesgroup-cert/Watcher.git
# already have the repo? check out this version:$ git checkout v2.4
Adds a confident field to sources.csv (values: 1 = 100%, 2 = 50%, 3 = 20%) to weight source reliability.
Switches entity extraction engine from previous implementation to BERT-base-NER for improved detection in news titles.
Changes the trending calculation window to only consider headlines from the last 30 days, preventing old surges from dominating trends.
Adds a Reliability % column to the Watcher UI table to display the averaged confidence score of sources for each trending word.
Reduces the minimum occurrence threshold for trend detection from 7 to 5 (configurable in settings.py).
+1 moreshow less
The update procedure requires manual deletion of Source, BannedWord, and TrendyWord database tables before running migrations to prevent conflicts with new fields.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!sources.csv now requires a confident column; missing this field will result in incorrect reliability scoring or processing errors.
Zero Trust Secure Access for Windows adds connector IP info to Private Access UI and network switching fallback.
Adds connector IP address details to the Private Access connection information page in the ZTSAZTSAZero Trust Security Architecture: a network access model where no user or device is trusted by default, requiring continuous verification before granting access, letting cyber tools enforce least-privilege policies across any environment. UI.
Enables automatic fallback to direct connection when the TrendAI Vision One Endpoint Security agent proxy is unreachable during network switches.
Trend Vision One adds compliance scanning for CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Azure Kubernetes Service (AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations.) Benchmark v1.7.0
Sanitize attachments action now supports PDF files alongside Office docs
Enhances the Sanitize attachments action in Content Filtering policy to remove active content from PDF files, expanding support beyond Microsoft Word, Excel, and PowerPoint.
PDF attachments are now processed by the Sanitize attachments action for active content removal.
Adds %HEADER_SENDER% token to Cloud Email Gateway notifications and message stamps for header-based sender identification
Adds the %HEADER_SENDER% token to Cloud Email Gateway notification templates, retrieving the sender address from the message header instead of the envelope.
Adds support for %HEADER_SENDER% in message body stamps within Cloud Email Gateway Protection.
New automatic reversal of false positive quarantines in OneDrive using URL pattern intelligence.
Cloud Email and Collaboration Protection automatically identifies false positive URLs in OneDrive files detected by Web Reputation Services and reverses the quarantine action.
Trend Vision One Template Scanner now supports Azure for IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. risk detection.
Adds Azure cloud provider support to the Cloud Risk Management Template Scanner alongside existing AWS support.
TrendVision One Endpoint agent for Linux adds self-protection disable via token, RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 10 support, and unified policy assignment.
Add support for disabling self-protection using the authorization token
Supports TPL
Endpoint Sensor supports Red Hat Enterprise Linux 10
Server & Workload Protection supports Red Hat Enterprise Linux 10, including support for SELinuxSELinuxA mandatory access control system built into the Linux kernel, maintained by the NSA and Red Hat, that enforces fine-grained policies restricting what processes can access, even if they run as root., Secure Boot and FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. mode
Enhance collection of hardware information including CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware., manufacturer brand and model, serial number, disk information, and network adapter information
Adds CrowdStrike Falcon log support to custom detection models with new sample filters.
Supports CrowdStrike Falcon logs in custom detection models
Adds BITS Admin File Transfer, Double Extension File, Execution of Python Script prevented by CrowdStrike, Local Account Discovery, Malicious File Found and Quarantined by CrowdStrike, NS Lookup Remote Payload, Process Prevented by CrowdStrike, Process Terminated and File Quarantined by CrowdStrike, Registry Operation Blocked, Scheduled Task Prevented by CrowdStrike detection filters to tm-v1-detection-models GitHub repository
Trend Vision One adds SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. group sync via object ID or email and real-time/Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. manual sync triggers
Adds support for adding Microsoft Entra ID groups to SAML configurations using either group object IDs or email addresses, enabling SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for groups without email addresses.
Enables real-time and regular sync of group data from Microsoft Entra ID to keep SAML groups updated, with a manual sync trigger option in the Administration > User Accounts console.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Groups added before June 30, 2025 require explicit access grants to their tenants to maintain SSO access and stay current.
Trend Vision One Compliance Management adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. 8.1, HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against., NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0 support and custom framework builder.
Adds support for new compliance frameworks: CIS Critical Security Controls Version 8.1, HIPAA 45 CFR, and NIST CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0
Enhances the custom compliance framework builder to allow creation of new controls and tailoring of existing frameworks
Enables creation of Compliance Management cases for asset remediation based on compliance analysis fail rates
Adds CSV and PDF report exports for organization's pass rate in custom frameworks, including AI-generated recommendations
Introduces configuration exclusions to disable specific configurations from compliance analysis
Trend Vision One adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. 8.1, HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. 45 CFR, NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0 frameworks; custom framework builder and compliance cases now available.
steps - Add CIS Critical Security Controls Version 8.1, HIPAA 45 CFR, and NIST CSF 2.0 to the supported compliance frameworks
steps - Use the enhanced custom compliance framework builder to tailor existing frameworks, create new frameworks, and define new controls
steps - Create Compliance Management cases for assets to remediate analysis fail rates
steps - Generate CSV and PDF reports of organization pass rates for custom frameworks including AI-generated recommendations
steps - Configure configuration exclusions to disable specific configurations from compliance analysis
Centralized audit logging for Portal activity available via SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Dashboard
Adds Audit Log access in the Portal top menu bar (hamburger icon) and SIEM Dashboard Starter Queries.
Enables automatic, free central logging of all Portal events to Huntress SIEM for compliance reporting.
2 details in Everything
2 more releases in this issue
· 2025-07-01 → 2025-07-18
UI updates to Huntress Portal make requesting SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. Support easier via Incident Triage Feed and deep links.
Adds a SOC Support button on the Incident Triaging Feed page for quicker requests during urgent situations
Displays a banner in the Portal when a callback request has been initiated
Includes a deep link in the text version of Incident Reports so support requests can be made from a PSA or integrated ticketing system
July 21, 20252 releases · 2025-07-19 → 2025-07-21Stable
Sophos Central July 2025 adds AI Search, AI Case Summary, DMARC Manager, integration health alerts, and Switch Stacking
AI Search is now available for all Sophos XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. and Sophos MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. customers with endpoint telemetry and detection data query support
Sophos AI Case Summary and AI Command Line analysis are generally available to accelerate investigations
DMARC Manager add-on provides comprehensive management and reporting of DMARC, SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders., DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit. records, including SPF flattening, BIMI, MTA-STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets., and TLS-RPT
Integration health alerts generate notifications when third-party data ingestion integrations are unhealthy or offline for MDR and XDR customers
Central Switch Stacking provides a management overlay to simplify managing Sophos switches in a wired stack
5 details in Everything
1 more release in this issue
· 2025-07-19 → 2025-07-21
Sophos Central 2025.29 adds DMARC Manager, integration health alerts, Switch Stacking, and GA for AI Case Summary and AI Search.
Adds Sophos DMARC Manager add-on for comprehensive management and reporting of DMARC, SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders., and DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit. records, including SPF flattening, BIMI, MTA-STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets., and TLS-RPT.
Generates alerts in Sophos Central and sends email notifications to admins when a data ingestion integration is unhealthy or offline, covering all third-party integrations for MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. and XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. customers.
Adds Central Switch Stacking to reduce management complexity when running Sophos switches wired together as a switch stack.
Promotes AI Case Summary and AI Command Line Analysis to general availability for faster investigations and clearer insights.
Makes AI Search — natural-language querying of security data — generally available to all Sophos XDR and MDR customers, now including endpoint telemetry alongside detection data.
Exabeam New-Scale July 2025 adds Anomali & Qualys cloud collectors, custom analytics rules, and context record deletion API.
Adds Anomali Cloud Collector to facilitate threat intelligence data collection from an Anomali source that supports the STIX/TAXIISTIX/TAXIISTIX is an OASIS-maintained JSON schema for expressing threat intelligence objects; TAXII is the companion HTTP protocol for exchanging them, giving cyber tools a vendor-neutral way to share indicators and threat data. framework
Adds support for authentication via Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. Account for Azure EventHub Cloud Collector
Adds Dropbox Cloud Collector Early Access to facilitate ingestion of team activity logs from Dropbox
Adds Qualys Cloud Collector Early Access to facilitate ingestion of Activity Logs, and Vulnerabilities including VM host detection events from Qualys sources
Adds Slack Cloud Collector Early Access to facilitate ingestion of events from the Audit Logs API endpoints
+4 moreshow less
Enables export of log sources via the Log Source service for monitoring active and inactive log sources
Allows selection of unique log source identifiers when creating a log source policy in the Log Source service
Extends notification capabilities with Global Email Notifications to send email notifications to a specific user or a shared distribution list
Adds Custom Analytics Rules capability allowing creation of analytics rules in JSON format and import into Threat Detection Management
Delta Sharing now supports including tables/schemas secured by ABACABACAttribute-based access control, where rules evaluate facts about the user, resource and request. Access can depend on conditions such as department, data sensitivity or device status. policies in shares (Beta).
Adds ability for providers to include tables and schemas protected by attribute-based access controlattribute-based access controlAttribute-based access control, where rules evaluate facts about the user, resource and request. Access can depend on conditions such as department, data sensitivity or device status. (ABAC) in a Delta share.
Expanded region availability for ai_parse_document function
ai_parse_document is now available in us-west-2, us-east-1, us-east-2, ap-northeast-1, ap-northeast-2, ap-south-1, ap-southeast-1, ap-southeast-2, ca-central-1, eu-central-1, eu-west-1, eu-west-2, sa-east-1.
Adds Catalog Explorer's Ask a question prompt to generate SQL from natural language using an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.
Enables asking natural language questions about sample data in Catalog Explorer, with the Assistant generating SQL based on metadata and usage patterns
Adds query validation capability before execution against underlying tables
Google Gemma 3 12B added to Mosaic AI Model Serving with API and AI Functions support.
Adds Google Gemma 3 12B as a Databricks-hosted foundation model on Mosaic AI Model Serving
Enables Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves. pay-per-token for Gemma 3 12B
Enables Foundation Model APIs provisioned throughput for Gemma 3 12B
Supports AI Functions (real time and batch inference) with Gemma 3 12B
Databricks connector for Power BI now supports the ADBCADBCArrow Database Connectivity, an Apache standard API for querying databases that returns results directly as Apache Arrow columnar buffers, eliminating per-row copying overhead and making bulk data transfer fast for analytics pipelines. driver alongside ODBCODBCA standard API, maintained by Microsoft, for connecting applications to relational databases regardless of vendor. Cyber tools use it to query databases without writing engine-specific code. (Public Preview)
Run job and For each parent tasks now have a separate concurrency limit
Run job and For each parent tasks now use a separate limit for the number of simultaneously running child processes, independent of the overall task limit.
Parent tasks no longer count against the overall concurrent task limit.
Git folders in Databricks now allows users to configure and manage multiple Git credentials through the workspace UI, supporting one or multiple Git providers.
Google SecOps introduces Feature Dashboards with SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. data, reports, drilldowns, and markdown widgets.
└──▷ HOW TO FIND IT
Access new Feature Dashboards to enhance threat hunting and investigation workflows.
📍Navigate to the Dashboards section in the Google SecOps console to explore SOAR data, downloadable reports, custom drilldowns, and markdown widgets.
Adds Feature Dashboards for enhanced visualizations and threat hunting
Enables access to SOAR data within dashboards
Adds Downloadable reports capability
Supports Custom drilldowns in dashboards
Includes Markdown widgets for dashboard composition
RunReveal adds Google Gemini and AWS Bedrock AI providers, chat sharing, and Slack, Opal, Wiz, S3 sources
Adds Gemini API Key configuration in workspace Settings under AI Model Providers to enable Google Gemini support (uses Gemini 2.5 Pro).
Adds AWS Bedrock integration using IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Role Authentication with external ID for enhanced security, defaulting to Claude 3.5 Sonnet.
Enables switching between configured LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. providers directly in the native AI chat interface.
Adds Share Chat > Share to Workspace action to share AI conversation links with other RunReveal users.
Adds Slack source integration for ingesting audit logs (requires Pro plan and Enterprise Grid subscription).
+3 moreshow less
Adds Opal source integration for log ingestion and analysis.
Adds Wiz Threats source via webhook, writing alerts to the wiz_threat_webhook_logs table(s).
Adds S3 Access Logs source for monitoring bucket activity, writing data to the s3_access_logs table(s).
Tenzir is a data pipeline engine for security teams that collects, transforms, enriches, and routes telemetry.
Adds an Other node provisioning tab, custom OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. request params, and improved JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. audience mismatch errors.
Add a new Other tab to the node provisioning screen to display the Tenzir Token directly
Add support for the EXTRA_OIDC_REQUEST_PARAMS environment variable to set custom query parameters for OIDC sign-in requests
Improve error messages for JWT audience mismatch by displaying expected and provided audiences
3 details in Everything
6 more releases in this issue
· 2025-07-01 → 2025-07-30
tenzir v5.10.0 adds OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. enum derivation/trimming, IP classification functions, form-encoded HTTP bodies, and experimental subprocess isolation.
ocsf::derive operator automatically assigns enum strings from integer counterparts in OCSF events
ocsf::trim operator intelligently removes non-essential fields from OCSF events to reduce size
IP address classification functions: is_private(), is_global(), is_multicast(), is_link_local(), is_loopback(), and ip_category()
http and from_http operators support encode="form" for URL-encoded request bodies and sinks in parsing pipelines
String padding functions: pad_start() and pad_end() for consistent output formatting
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The payload parameter in http and from_http is deprecated in favor of body for HTTP request bodies.
!The Amazon Security Lake integration operator to_asl is renamed to to_amazon_security_lake; the old name is deprecated.
Tenzir Platform v1.15.0 adds external JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. authentication via header and multi-issuer support
Adds PRIVATE_JWT_FROM_HEADER environment variable to the Tenzir UI service for login via externally-supplied JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage.
Supports multiple OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. issuers by setting TENZIR_PLATFORM_OIDC_TRUSTED_AUDIENCES in .env
Tenzir v5.9.0 adds uuid() function to TQL with support for versions 1, 4, 6, 7, and nil.
Adds uuid() function in TQL for generating UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. (versions 1, 4, 6, 7, nil)
Supports version argument to select specific UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. format (e.g., version="v7")
Tenzir v5.7.0 adds secret type, tenzir.platform-extra-headers, OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. extension support, and Kafka SASLSASLA framework for plugging authentication mechanisms into network protocols, standardized by the IETF, so a tool can support password, Kerberos, or certificate login without rewriting auth logic per protocol. auto-config
Introduces the secret type to hide sensitive values and supports it in operator arguments like URLs and tokens
Adds tenzir.platform-extra-headers config key and TENZIR_PLATFORM_EXTRA_HEADERS__<HEADER> env vars to inject custom HTTP headers for platform connections
Extends ocsf::apply operator with OCSF extension support via metadata.extensions validation
Adds preserve_variants option to ocsf::apply to keep free-form objects as records instead of JSON-encoded strings
Automatically sets sasl.mechanism=OAUTHBEARER in load_kafka and save_kafka operators when using the aws_iam option
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The secret function now returns a secret type instead of a plaintext string; use tenzir.legacy-secret-model to restore old behavior
!TQL1 pipelines in the compaction plugin are deprecated and emit a warning on startup
Adds Kibana rule export filtering, check-version-lock dev CLI subcommand, and over 60 new detection rules.
└──▷ GET THIS VERSION
$ git clone --branch dev-v1.3.0 https://github.com/elastic/detection-rules.git
# already have the repo? check out this version:$ git checkout dev-v1.3.0
Attack Range v4.0 adds GCP support, SnapAttack CapAttack integration, version-tagged Docker containers, and automated Splunk Apps updates via CI/CD.
└──▷ GET THIS VERSION
$ git clone --branch v4.0.0 https://github.com/splunk/attack_range.git
# already have the repo? check out this version:$ git checkout v4.0.0
Adds SnapAttack CapAttack integration via a PowerShell capture agent that bundles attacks with system logs, keystrokes, PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic., and video for comprehensive attack analysis.
Extends cloud platform support to include GCP alongside existing AWS and Azure deployments.
Introduces version-tagged Docker containers on DockerHub for stable, reproducible testing environments.
Implements automated updates for all integrated Splunk Apps through a CI/CD pipeline so detection engineers always work with current versions.
Enhances MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. Caldera adversary emulation platform deployment and configuration, including port 8888 access for improved interface reliability.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Local deployment support (VirtualBox/Vagrant) has been discontinued; existing local Attack Range setups will no longer be supported — Ludus is recommended as a replacement.
Beelzebub v3.4.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. honeypot support to detect prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. attacks against LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. agents.
└──▷ GET THIS VERSION
$ git clone --branch v3.4.0 https://github.com/mariocandela/beelzebub.git
# already have the repo? check out this version:$ git checkout v3.4.0
New MCP honeypot service: deploy decoy Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools to lure and capture prompt injection attempts targeting LLM agents.
Enables real-time collection of attack prompts for use in guardrail fine-tuning workflows.
43 new Sigma detection rules added covering KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. coercion, Katz Stealer, CVE-2025-33053, MeshAgent RAT, SAP NetViewer webshells, and more.
└──▷ GET THIS VERSION
$ git clone --branch r2025-07-08 https://github.com/SigmaHQ/sigma.git
# already have the repo? check out this version:$ git checkout r2025-07-08
Adds detection for Kerberos coercion via DNS SPN spoofing across multiple rule variants (process, DNS query, network)
Adds detection for Katz Stealer malware via DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. load, DNS queries, and suspicious User-Agent signatures
Adds three-rule coverage for exploitation of RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. vulnerability CVE-2025-33053 (process, image load, process access)
Adds detection for SharpSuccessor and HollowReaper hack tools, and Doppelanger LSASS dumper execution
Adds detection for MeshAgent remote access tool usage and suspicious behavior on both Windows and macOS
+16 moreshow less
Adds detection for potential Java webshell upload and command execution in SAP NetViewer Server
Adds detection for Notepad++ CVE-2025-49144 exploitation attempts
Adds detection for FileFix browser file upload abuse via TypedPaths registry evidence and suspicious child processes
Adds detection for obfuscated and remote-sourced PowerShell MSI installs via WindowsInstaller COM
Adds detection for MSSQL destructive queries
Adds detection for proxy execution via vshadow.exe with -exec flag
Adds detection for trusted path bypass via Windows directory spoofing
Adds detection for suspicious Deno file writes from remote sources and curl/wget download-and-execute patterns
Adds detection for suspicious file access to browser credential storage and registry export of third-party credentials
Adds Linux detections for disabling ASLR via personality syscall, clearing kernel ring buffer via syslog syscall, special file creation via mknod, system info discovery via sysinfo, potential abuse of Linux Magic System Request Key, and AS-REP roastingAS-REP roastingAn attack against Kerberos accounts that do not require pre-authentication. An attacker obtains an encrypted authentication response and tries to crack the account's password offline. via Kerberos TGT requests
Adds detection for Impacket file indicators on disk
Adds detection for RegAsm.EXE execution without command-line flags or files
Expands BadSuccessor exploit and Invoke-PowerDPAPI coverage across PowerShell detection rules (PoshModule, ScriptBlock, FileCreation, ProcessCreation)
Expands Windows Defender registry tampering detection with DisableCloudProtection and DisableSecurityCenter values
Expands MSHTA suspicious file extension detection with additional extensions
Expands Commands to Clear or Remove the Syslog rule to detect journald vacuuming
Splunk Security Content v5.10.0 adds 5 new analytic stories and 45 new detections covering CitrixBleed 2, SharePoint RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., ESXi post-compromise, Cisco Duo, and Quasar RAT.
└──▷ GET THIS VERSION
$ git clone --branch v5.10.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v5.10.0
New analytic story: Citrix NetScaler ADC and Gateway CVE-2025-5777 (CitrixBleed 2) — detects HTTP requests to the vulnerable /nf/auth/startwebview.do endpoint to identify scanning and exploitation of Citrix ADC/Gateway appliances.
New analytic story: Microsoft SharePoint Vulnerabilities — covers CVE-2025-53770 exploitation via ToolPane.aspx, GET requests to the spinstall0.aspx webshell, and webshell file creation events for both initial and post-exploitation detection.
New analytic story: ESXi Post Compromise — 24 new detections spanning VM bulk termination, reverse shells, SSH brute force, system clock manipulation, audit log wiping, unauthorized privilege elevation, and malicious VIB installations.
New analytic story: Cisco Duo Suspicious Activity — 14 new detections covering unusual admin logins by browser/OS/country, bypass code generation, and risky policy configurations such as skipping 2FA, allowing tampered devices, or permitting outdated Java/Flash.
New analytic story: Quasar RAT — maps 20+ existing detections to Quasar techniques and adds three new detections targeting FileZilla XML config access, IntelliForms registry entries, and Mozilla NSS library loading for stealthy credential harvesting.
+4 moreshow less
New detection: Cisco Secure Firewall — Citrix NetScaler Memory Overread Attempt, enabling network-layer visibility into CitrixBleed 2 exploitation attempts.
New detections for Windows SharePoint: ToolPane Endpoint Exploitation Attempt, Spinstall0 GET Request, and Spinstall0 Webshell File Creation provide layered coverage of CVE-2025-53770 attack chains.
New ESXi detections include: Malicious VIB Forced Install, VIB Acceptance Level Tampering, ESXi Shell Access Enabled, Lockdown Mode Disabled, Firewall Disabled, and Loghost/Syslog Config Tampering for hardening and intrusion detection.
New credential-theft detections: Windows Unusual FileZilla XML Config Access, Windows Unusual Intelliform Storage Registry Access, and Windows Unusual Process Load Mozilla NSS-Mozglue Module target post-exploitation credential harvesting patterns.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!Several detections previously deprecated in ESCU v5.8.0 have been removed in v5.10.0; users must transition to recommended replacement detections before upgrading.
1 more release in this issue
· 2025-07-09 → 2025-07-23
Splunk Security Content v5.9.0 adds 19 new detections across Cisco NVM, Disk Wiper, and Linux Auditd, plus 9 CrowdStrike SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. playbooks.
└──▷ GET THIS VERSION
$ git clone --branch v5.9.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v5.9.0
New analytic story: Disk Wiper — detections targeting destructive malware that performs recursive file deletion and raw access to disk volumes and the primary boot record.
New detection: CrowdStrike Falcon Stream Alerts — ingests CrowdStrike Falcon streaming telemetry for endpoint detection.
New detections: Linux Auditd Daemon Abort, Shutdown, and Start — monitor auditd lifecycle events on Linux endpoints.
New detection: Windows File Download Via PowerShell — identifies file download activity initiated through PowerShell.
New lookup: suspicious_ports_list — supports detections flagging outbound connections to suspicious ports.
+3 moreshow less
New lookup: typo_squatted_python_packages — backs detection of typosquatted Python package installations via Cisco NVM telemetry.
New CrowdStrike EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. Playbook Pack for Splunk SOAR — 9 playbooks enabling automated investigation and response via CrowdStrike Falcon OAuth API, covering device isolation, network restore, process termination, file collection/eviction/restore, executable denylisting, endpoint analysis, and device info retrieval.
New macro: cisco_network_visibility_module_flowdata — enables Cisco NVM-based analytics across the new detections.
Shuffle 2.1.0-nightly re-adds /api/v1/orgs and adds Kubernetes/Helm security contexts, configurable app ports, and service labels.
└──▷ GET THIS VERSION
$ git clone --branch 2.1.0-nightly-02072025 https://github.com/Shuffle/Shuffle.git
# already have the repo? check out this version:$ git checkout 2.1.0-nightly-02072025
└──▷ USE IT
Harden Kubernetes worker and app pods by applying a non-root security context in your Helm values.
New SentinelOne AI SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Destination, Drop Dimensions function for metrics, and Stored Credentials for Oracle improve Cribl Stream's integration and processing capabilities.
Adds SentinelOne AI SIEM destination for direct ingestion into SentinelOne's cloud-native SIEM via a HECHECAn HTTP API endpoint provided by Splunk that lets applications stream JSON-formatted events directly into a Splunk index without a forwarder agent, reducing pipeline complexity for log-shipping tools.-compatible endpoint.
Introduces the new Drop Dimensions function to remove dimensions from outgoing metrics data, reducing high cardinality and storage costs.
Adds Stored Credentials authentication method for Oracle Database connections to allow referencing separate secrets for username/password and connection string.
NodeZero July 2025 adds Threat Actor mapping GA, Rapid Response tests for CitrixBleed 2 and others, MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. GA, Jira integration, and Meta Flag.
Adds Threat Actor tab in Weakness Details to link pentest results to known adversary groups
Adds Pentest Summary Sankey Chart visualization for threat actor mapping
Adds Weakness Filtering to narrow views to specific adversaries
Highlights known threat actor CVE usage in attack chains via Attack Graph Integration
GA release of the MCP Server with Bring Your Own LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. support
+6 moreshow less
Rapid Response tests for CitrixBleed 2 (CVE-2025-5777), PAN-OS GlobalProtect XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., Wing FTP, FortiWeb SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., CrushFTP, Infoblox NetMRI, and Flowise
Critical exploits for Microsoft SharePoint Toolshell, Cisco ISE, FortiWeb, and SonicWall SMA XSS
Rolls-up asset counts in Templates and Assets pages for parent accounts
Enables SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.-only subclient access by allowing subclients to disable basic authentication
Adds Meta Flag for Loot & BloodHound enabling self-service subclient management
Enables direct Jira integration in the Vulnerability Management Hub via new tickets
11 details in Everything
└──▷ BREAKING ON UPGRADE
!Not Vulnerable label in Rapid Response results renamed to Not Exploitable
!N-Day Test Results now titled Rapid Response Test Results
Rapid7 adds Local CVA for private registries, new Surface Command connectors, and AI MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. workflows in July 2025
Adds HTTPS_PROXY, SSL_CERT_FILE, and SSL_CERT_DIR environment variables to Cloud Security (InsightCloudSec) bot configurations for custom network and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. settings
Integrates Attack Surface Management (Surface Command) with Cisco ISE, CyberArk PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded., Nucleus Security, PingOne, and Deep Instinct connectors
Adds dynamic third-party alert prioritization mapping in SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. (InsightIDR) to clarify triage ownership between customer teams and the Rapid7 SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared.
Introduces AI-assisted agentic workflows in MDR service for automated alert triage and enrichment
Adds new Insights, Query Filters, and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Azure 3.0/4.0 compliance packs to Cloud Security (InsightCloudSec)
+3 moreshow less
Expands InsightVM/Nexpose tag management permissions with Manage Site Tags, Manage Asset Tags, and Manage Group Tags
Adds Network Sensor native detection for DNP3DNP3A serial and TCP/IP communication protocol used in industrial control systems, especially power grids and water utilities, to let control software poll and command field devices like sensors and switches. protocol and enhanced VLAN/VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments. inspection
Migrates legacy UBA detection rules (e.g., HONEY USER AUTHENTICATION) to the SIEM Detection Library
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Bots interacting with OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Compartment resources must update their configuration to reference the new Organization Services level organization service ID, as older service IDs will trigger alerts.
!The option to Switch to Legacy UI has been removed in Cloud Security (InsightCloudSec).
New Settings page, asset deduplication, VPR scores in Inventory, findings context on assets, public Inventory APIs, and new OT/Cloud exposure signals.
Adds a dedicated Settings page for managing Tenable One-specific configurations, accessible via the button at the top of any Tenable Exposure Management page
Enables automatic merging of duplicate assets from the same source into an asset cluster through the new Settings page capability
Allows creating an Exposure Signal query directly from a global search on the Assets page
Adds VPR (Beta) scores to both the Weaknesses and Findings pages within Inventory
Displays active findings with severity breakdown and drill-down capability on each asset in Inventory
+5 moreshow less
Shows merging criteria (hostname, IP, MAC, etc.) and reasons for merges when viewing third-party asset details
Introduces public Inventory APIs for Export Findings, Export Assets, and Search Assets
Adds new built-in Exposure Signals for OT and Cloud exposure including OT Assets with Discontinued Support, Critical OT System Status Changed, and several cloud-based signals
Adds Treemap and Matrix chart types to dashboards with limits of 20 widgets per dashboard
Exposes a Home Page Total Active Findings widget showing breakdown by type and severity
10 details in Everything
5 more releases in this issue
· 2025-07-01 → 2025-07-30
Tenable One Identity Exposure 3.77.12 adds SMTP OAuthSMTP OAuthAn authentication method for SMTP email submission that replaces passwords with OAuth 2.0 tokens, letting cyber tools send mail on a user's behalf without storing credentials. alerting support
Tenable One ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. adds Explore Dashboard with new asset inventory view and export capabilities.
Adds the Explore page for discovering and managing externally exposed assets with sections for security risk categories, saved queries, grouping, source management, and export.
Adds Exposure Center allowlist exclusions and optional SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. file-sharing mode for IoA event log collection
SMB File Sharing provides an optional file-sharing mode in the Indicator of Attack (IoA) module for collecting Windows event log files via a dedicated SMB share.
DefectDojo 2.48.3 adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. vendor score support in Trivy, CVSS v3 in Dependency Check, and a faster findings API.
└──▷ GET THIS VERSION
$ git clone --branch 2.48.3 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.48.3
Trivy parser now uses CVSS scores from other vendors where applicable.
Dependency Check parser supports CVSS v3 scoring.
Product API optimizes the list of finding IDs for faster retrieval.
DefectDojo 2.48.2 adds Sysdig 2025 format support, KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. data on findings listing, and GSD vulnerability ID support.
└──▷ GET THIS VERSION
$ git clone --branch 2.48.2 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.48.2
Supports Sysdig 2025 report formats in the Sysdig parser.
Makes KEV (Known Exploited VulnerabilitiesKnown Exploited VulnerabilitiesCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.) data visible on the findings listing page.
Adds GSD vulnerability ID support via new settings in settings.dist.py / local_settings.py.
DefectDojo 2.48.0 adds new parsers, vulnerability ID sources, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. from Grype, ASVS 5.0 benchmarks, and expanded API filtering.
└──▷ GET THIS VERSION
$ git clone --branch 2.48.0 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.48.0
└──▷ TRY IT
Filter the user list to find accounts that have never logged in since a specific date, useful for access reviews.
$ curl -X GET 'https://<defectdojo>/api/v2/users/?last_login__lte=2024-01-01T00:00:00Z' \
-H 'Authorization: Token <token>'
Import an Anchore Grype scan to automatically capture EPSS scores alongside vulnerability findings.
New ReversingLabs SpectraAssure rl-json parser for importing SpectraAssure scan results.
New Cycognito parser for importing Cycognito scan findings.
Adds EPSS (Exploit Prediction Scoring SystemExploit Prediction Scoring SystemExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching.) data import from Anchore Grype scans.
Adds support for JVNDB vulnerability IDs on findings.
Adds support for Lenovo vulnerability IDs on findings.
+16 moreshow less
Adds support for Tailscale vulnerability IDs on findings.
Adds support for EUVDEUVDThe European Vulnerability Database, operated by ENISA, is the EU's official registry of disclosed software vulnerabilities, giving cyber tools a regional authoritative source for CVE-equivalent advisories. (European Union Vulnerability Database) vulnerability IDs on findings.
Adds support for Go vulnerability IDs on findings.
Adds KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.-related data fields to the finding model.
New ASVS 5.0 benchmark support in the UI.
API: Enables filtering users by last_login and date_joined fields.
Finding Groups now respect minimum severity and active/verified rules when pushing to JIRA.
JIRA integration respects simple/full risk acceptance on webhook processing.
JIRA descriptions are now truncated automatically if the maximum length is exceeded.
SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. login now respects the next redirect parameter for post-login navigation.
Improved CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v3 validation enforced at the API level.
Trivy parser now maps the status field from scan results.
Checkov report parsing enhanced with additional field support.
Optimized queryset annotations and prefetches to cut database time for test, finding, and product views.
Finding groups now filter by product when applicable.
Metrics filters improve handling when nothing matches the applied filters.
21 details in Everything
└──▷ BREAKING ON UPGRADE
!The actual_time and estimated_time fields have been removed from the database model (migration required).
!Burp Enterprise has been renamed to Burp DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. — any configurations or references to the old name will need to be updated.
DefectDojo Pro 2.49.3 adds Azure DevOps/GitHub/GitLab integrations and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. enforcement for API auth
Adds Integrations subsystem to DefectDojo Pro with Jira-style connectors for Azure DevOps, GitHub, and GitLab boards
Enforces MFA requirement for the /api-token-auth endpoint when MFA is enabled in the system
Adds Unique ID from Tool column to the Findings list and Finding view in the Pro UI
Adds Test Status field to the Test View in the Pro UI
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Basic Auth Login has been removed from the swagger form; only cookieAuth and tokenAuth are accepted
Adds bulk dataset recompute action with notifications, extends DW snapshot timeout, improves List view UX
Adds a bulk recompute action for system administrators to select datasets and trigger compute operations, receiving notifications and logs upon completion.
Increases the default timeout for Data Warehouse snapshot uploads from 30 seconds to 60 minutes.
Improves basic input editing in List views and reports by allowing titles to be edited.
OSV-Scanner v2.1.0 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. location field, --show-all-vulns flag, and experimental summary output format.
└──▷ GET THIS VERSION
$ git clone --branch v2.1.0 https://github.com/google/osv-scanner.git
# already have the repo? check out this version:$ git checkout v2.1.0
Adds the CycloneDX location field to the output source string for SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. scanning results
Adds a new summary output format option to the reporter that can be enabled as an experimental feature
Adds the --show-all-vulns flag to display all vulnerabilities instead of hiding unimportant ones by default
Enables transitive dependency extraction for Python requirements.txt files, unlocking full graph analysis from flat lists
Adds support for parsing gems.locked files used by Bundler as a recognized lockfile type
+1 moreshow less
Adds support for CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. report format ingestion
Tenable Nessus 10.9.2 adds FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. support and China-specific connector URL for Tenable One Vulnerability Management.
Tenable Nessus, Tenable Agents, Tenable One Web App Scanning scanners, and Tenable Network Monitors in mainland China can connect to Tenable One via sensor.cloud.tenablecloud.cn
Edgescan adds license upgrades from asset details, EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. mandatory task indicators, and enhanced vulnerability filtering/export.
Adds the ability to upgrade licenses directly from the asset details page
Adds visual indicators on EASM tasks to identify mandatory items
Adds the asset name column to the users table for visibility into user-asset access
Adds filtering and export support for the last detected date field on vulnerabilities
Adds autocomplete support for oversight tags filters in the UI
+3 moreshow less
Adds improved error messaging when superusers attempt to delete other superusers
Adds multi-select filtering for vulnerability severity levels
Adds a permission replication feature for copying permissions between users
Fleet 4.71.0 adds IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.-based labels, Apple MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. user channel, SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. Department ingestion, and Windows app last-opened time.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.71.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.71.0
└──▷ USE IT
Inject an end user's IdP department into a macOS configuration profile so the profile can be dynamically customized per user.
yaml
In a mobileconfig profile payload, reference the variable:
<key>Department</key>
<string>$FLEET_VAR_HOST_END_USER_IDP_DEPARTMENT</string>
Then deploy the profile via Fleet MDM; Fleet substitutes the value ingested from SCIM.
Retrieve the most recently archived disk encryption key for a host when the current key has been rotated or is unavailable.
Adds support for IdP-based Host Vitals labels that update automatically, enabling dynamic host grouping based on identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. attributes.
Adds support for the Apple MDM user channel: mobileconfig profiles with a PayloadScope of User are now delivered via the user channel when a host has an active user channel connection.
Adds ingestion of the user Department field via SCIM and exposes it as the FLEET_VAR_HOST_END_USER_IDP_DEPARTMENT variable in configuration profiles.
Adds last opened time for Windows applications in software inventory.
Updates GET /hosts/:id/encryption_key to return the most recently archived encryption key when the current key is unavailable.
+12 moreshow less
Adds verification of user-scoped profiles on macOS.
Adds functionality for verifying installation of VPP apps, switching VPP apps to show as installed only after MDM confirms installation.
Increases Fleet-maintained app check frequency from once per day to once per hour.
Adds automatic refetch of host vitals and software inventory after a successful software install or uninstall.
Adds ability to configure EULA shown during setup experience via GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control..
Adds the team_name property to the /api/v1/fleet/hosts/identifier/:id endpoint response.
Records installer URL when a Fleet-maintained app is added via the web UI or REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
Separates the host details software list into two sections: Inventory (installed software) and Library (software available for installation).
Updates Windows Custom OS Settings (Win32/Desktop Bridge ADMX policies) to be marked verified after the host acknowledges the MDM install command.
Moves SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. and Host status webhook settings from Settings > Organization to Settings > Integrations.
Updates CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmarks for Windows 10 to version 3.
Adds api_only user property to backend activity details and a new avatar for API-only users in the activity feed.
Adds Delete Role UI action in Automox console for deleting custom RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. roles
Adds a Delete Role option in the Roles table's Actions menu for deleting custom roles via a guided confirmation modal
Automatically removes all role assignments when a custom role is deleted
2 details in Everything
2 more releases in this issue
· 2025-07-15 → 2025-07-25
Automox adds a redesigned Device Details page and a public-facing API to expose expanded inventoried data for CMDBCMDBA Configuration Management Database: a repository that stores records of IT assets and the relationships between them, giving cyber tools a single authoritative source for infrastructure context. and automation.
Redesigns the Device Details UI page with comprehensive inventory data (Linux: 261, Darwin: 287, Windows: 322 attributes)
Adds experimentalFeatures.fonts key in winget settings config to enable the experimental winget font list command for discovering installed font families.
Supports exporting Windows Settings, WinGet package configurations, and DSC v3 package settings from the current device as part of the new configuration export feature.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Dropped support for running on 32-bit ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. architectures.
Commvault Cloud is a backup, recovery, and cyber-resilience platform for hybrid, multi-cloud, and SaaS workloads.
Commvault Cloud July 2025 adds Azure Express Config Wizard, DocDB cross-region copy, DynDB incremental backups, Proxmox migration, and a Cyber Resilience Dashboard.
Adds Express Configuration Wizard for automated onboarding of Azure SQL Server databases with OAuth and CVBackupRole
Enables cross-region copy for Amazon DocumentDB manual snapshots
Adds support for protecting Azure Elastic SAN on VMs
Introduces Auxiliary Copy Performance Reports in Command Center for replication metrics
Launches Cyber Resilience Dashboard with resilience index, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. monitoring, and alert notifications
+10 moreshow less
Supports incremental threat scans on VMs by scanning only modified items since last successful scan
Adds backup and recovery support for Amazon DynamoDB Local Secondary Indexes (LSI)
Enables scheduled incremental backups for Amazon DynamoDB using Streams
Allows Linux access nodes to scan, mount, and recover Windows Dynamic Disks via libldm and ldmtool
Supports User Managed Service Accounts for Google Cloud VMs to avoid private key sharing
Enables VMware vSphere to Proxmox VE conversion for VM migration and recovery
Adds encryption key safeguarding for DB2 encrypted databases to enable transparent restores
Enhances MongoDB single-node replica set support with primary quiesce event notifications
Provides streamlined protection for DB2 in HADR clusters with Virtual IP configurations
Preserves AD nTSecurityDescriptor attribute including ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. and delete-protection flags in backups
Veeam Kasten is a Kubernetes-native platform for backing up, restoring, and migrating containerized applications and their persistent data.
Kasten K10 8.0.5 adds ValidateAction API, RestorePoint Validation, MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. preservation, and a 60-day trial license.
└──▷ TRY IT
Validate exported volume data for a backup using the new ValidateAction K10 API resource.
Adds ValidateAction to the K10 API, enabling users to validate volume data exported as part of a backup.
Adds support for the k10.kasten.io/minimumExportDiskSize annotation in StorageClass to influence temporary PVC sizing during exports, with supported units: Ki, Mi, Gi, Ti, Pi, Ei, k, M, G, T, P, E.
Adds RestorePoint Validation with support for Full Data Scan, Metadata Only mode, and Fast Fail to ensure backup integrity.
Adds MAC address preservation for virtual machines during restoration to maintain network stability across VM lifecycle.
Adds explicit grace period availability indicators in the UI.
+1 moreshow less
Extends trial license evaluation period from 30 days to 60 days.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Enterprise license grace period is reduced from 50 days to 30 days.
!Trial licenses no longer receive a grace period.
2 more releases in this issue
· 2025-07-01 → 2025-07-25
Adds datastore.cacheSizeLimitMB Helm parameter to control emptyDir volume size limits for temporary Pods during data mover operations; accepts null (dynamic default), 0 (no limit), or 3000 or greater (explicit MiB cap).
Adds UI support for Import policies to restore to an alternate namespace.
Adds UI support for Import policies to optionally enable overwriting existing resources during restore.
Kasten K10 8.0.3 adds granular volume restore for OpenShift Virtualization VMs and Veeam Data Cloud Vault location profiles.
└──▷ HOW TO FIND IT
Configure a Veeam Data Cloud Vault location profile via the Kasten UI — note you must use a literal hostname (not an IP address) to complete the process.
📍In the Kasten K10 UI, navigate to Settings › Location Profiles › New Profile, select Veeam Data Cloud (VDC) Vault as the profile type, and complete the configuration. Access the UI via a hostname such as http://localhost:8080/k10/#/ — not an IP address like http://127.0.0.1:8080/k10/#/.
Restore a single volume from an existing OpenShift Virtualization VM backup without restoring the entire VM — available for OpenShift Virtualization 4.18 and later.
📍In the Kasten K10 UI, navigate to Applications › select your OpenShift Virtualization namespace › Restore Points › select a restore point › Restore, then choose individual volumes from the restore form to restore only the desired volumes of the existing virtual machine.
Adds support for restoring individual volumes of existing virtual machines in OpenShift Virtualization 4.18 and later.
Druva Threat Hunting now auto-quarantines impacted EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. and EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. snapshots
Druva launches FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one.-compliant GovCloud for enterprise workloads
Adds FedRAMP-compliant GovCloud availability for Files Server, NAS, VMware, Oracle DTC, MS SQL, and CloudCache under Enterprise and Enterprise Plus licenses
Druva GovCloud adds FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. moderate compliance for Enterprise workloads
Adds a FedRAMP-compliant Druva GovCloud environment for Files Server, NAS, VMware, Oracle DTC, MS SQL, and CloudCache with Enterprise or Enterprise Plus licenses
Kopia is an open-source backup tool for Windows, macOS, and Linux with incremental snapshots, client-side end-to-end encryption, compression, and deduplication, with both a CLI and a GUI.
Kopia v0.21.1 adds Azure Federated Identity support for storage authentication.
└──▷ GET THIS VERSION
$ git clone --branch v0.21.1 https://github.com/kopia/kopia.git
# already have the repo? check out this version:$ git checkout v0.21.1
1 more release in this issue
· 2025-07-20 → 2025-07-22
Adds continuous and retroactive API scans for Atlassian Jira with DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest./threat protection support
Adds the ability to configure Ongoing Policy Scans directly from the Policies > API Data Protection page in the Netskope UI to proactively monitor Atlassian Jira data.
Adds the Retroactive Scans page under Policies > API Data Protection for one-time scanning of historical Atlassian Jira data.
Enables DLP and Threat Protection policies for Atlassian Jira within Next Generation API Data Protection.
3 details in Everything
5 more releases in this issue
· 2025-07-03 → 2025-07-21
Publisher R128 adds Source IP, Port, PoP name, and relocates CN attribute to Network Events.
New kernel versions for OVAOVAAn Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. (5.15.0-138-generic), VHDX (6.8.0-1027-azure), AMI (6.5.0-1024-aws), and VHD (6.8.0-1027-azure)
Enhanced Network Event Attributes now include Publisher Source Port, Publisher Source IP, and Publisher PoP Name in event data
Network Events CN attribute relocated from the Session section to the Destination section
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Network Events CN attribute location changed: it is no longer in the Session section but now appears in the Destination section
AC-128 adds GitLab CLI upload detection, new domains for ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure./Chime/HeyGen/Mailchimp/Timestream/GT/Rediffmail, and enhanced Forms/Asana/Cisco event handling.
Gitlab enhancement now supports git push activity detection via the Gitlab CLI Upload feature
New domain dkr.ecr.us-west-2.amazonaws.com added for Amazon Elastic Container Registry application detection
New domain ice.z2.ue2.m.chime.aws added for Amazon Chime application detection
New domain heygen.ai added for HeyGen application detection
New domain mailchi.mp added for MailChimp application detection
+6 moreshow less
New domains added for Amazon Timestream application activity detection
New domains translate.google.ai, translate.google.tn, and translate.google.tw added for Google Translate application detection
New domain f4mail.rediff.com added for Rediffmail application detection
Microsoft Forms enhancement now supports detecting file uploads through the Quick Import feature
Asana enhancement adds upload support to detect importing a CSV as a task into a Project
Enhanced event generation in backend for Cisco Spark Message and MeetInvite User activity, with moderator addition included in Edit activity
Netskope CE v5.1.2 adds new integrations for Infoblox SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. Insights/TIDE, StealthMole, ManageEngine, and log streaming via AWS/Azure S3.
Adds the Infoblox SOC Insights plugin (CRE workflow) to fetch devices from Infoblox SOC Insights for real-time security policy enforcement at Netskope
Adds the Infoblox TIDE plugin (CTE workflow) to support fetching and sharing of indicators (Host, IPv4, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only., URL, Hash MD5/SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data.) with retraction support
Adds the StealthMole plugin (CRE workflow) to fetch compromised user accounts based on searched domains for UCI-based real-time security policy enforcement
Adds the CLS plugin for Netskope Log Streaming via AWS S3 to extract Alerts, Events, and WebTx logs from AWS SQS queue enabled S3 Buckets
Adds the CLS support for NLS via Azure Blob to extract Alerts, Events, and WebTx logs from Azure Storage Account queues
+1 moreshow less
Adds the ManageEngine ServiceDesk Plus plugin (CTO workflow) to create tasks in Service Desk Plus projects with status sync support
6 details in Everything
└──▷ BREAKING ON UPGRADE
!CE v4.2 and v5.0.0 reached EOL; CE v5.0.1 will reach EOL in January 2026
Netskope 128 adds DNSaaS, Destinations API, RBI Push Mode, RBACv3 global labels, and new DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest./CCI analytics fields.
Adds DNS-as-a-Service (DNSaaS) Phase 1 allowing routing of DNS queries through Netskope-managed IPs for security policy application.
Adds /api/v2/profiles/destinations API endpoint with GET, PATCH, and PUT verbs to programmatically manage Destination Profiles.
Introduces Service Objects API at /api/v2/profiles/serviceobjects to create policies based on destination ports in SWGSWGA Secure Web Gateway is a network proxy that inspects outbound web traffic, enforcing policy by blocking malicious sites, filtering content, and decrypting TLS — giving cyber tools a choke point for all user HTTP/S sessions./CFW.
Enables RBI Push Mode Communication for faster content updates in Remote Browser Isolation.
Adds Object level control for RBACv3 (Global Labels) allowing fine-grained authorization for Destination Profiles, Real-time Policies, and Private Apps.
+15 moreshow less
Adds new Advanced Analytics fields for Microsoft Purview: Encryption Status, Sensitivity Label Vendor, Sensitivity Label Instance, Sensitivity Label, Sensitivity Label ID, Previous Sensitivity Label, and Previous Sensitivity Label ID.
Adds Remove Recipients action to Email Outbound DLP policies to strip restricted recipients before delivery.
Enables Extension Management Policies in Enterprise Browser for defining default actions, allow lists, and force-installs.
Adds netskope://crashes debug page in Enterprise Browser for listing local crashes and locating minidumps.
Introduces Time Zone Support picker in Next Generation API Data Protection retroactive scans for configuring date filters and running hours.
Requires customer-owned Azure app registration for Microsoft Teams integration with Next Generation API Data Protection.
Launches SpeedTest portal to replace notscope.com for troubleshooting.
Enables alert suppression for block policies in Real-time Protection and mute settings for per-user notification templates.
Replaces URL Lists functionality with Destination Profiles supporting case sensitivity and mixed IP/domain entries.
Adds Outer Packet Capture toggle button in iOS Netskope Client UI for capturing tunneled and LWIP bypassed traffic.
Enables Remote log collection for Android Netskope Client via Settings > Secure Cloud Platform > Devices.
Adds multi-group/OU and OS match support in Traffic Steering webUI options (Controlled GA).
Enables Rest APIv2 for Device Status Page operations including fetching OTPs.
Enables Email Invitation Secure Enrollment with Secure Configuration option on iOS Netskope Client.
Adds troubleshooting errors for GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. tunnels to explain why a tunnel is down in the UI/APIs.
Adds imPAC LABS integration for centralized risk visibility in Varonis Next-Gen DAMDAMDatabase Activity Monitoring — a category of tooling that intercepts and logs database queries and transactions in real time, letting cyber tools detect unauthorized access or anomalous behavior without modifying the database itself..
1 more release in this issue
· 2025-07-22 → 2025-07-28
Varonis CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. adds detection for 600+ cloud misconfigs and integrations with Wiz and Azure Policy.
Adds detection for more than 600 cloud misconfigurations
Adds integration with Wiz to ingest risks
Adds integration with Azure Policy to ingest risks
Acsense adds cross-tenant object cloning and full tenant rollback to Time Machine for Okta change management.
Adds general availability of change management allowing seamless cloning of any Okta object and its related entities from one tenant to another for structured, version-controlled changes across Dev, Test, UAT, and Prod environments
Enhances the Time Machine functionality with Full Tenant Rollback, allowing customers to roll back or fast-forward any Okta tenant (including primary protected tenants and standby post-failover tenants) to a specific point in time
Improves RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. mechanism to support the new change management and rollback functionality
1Password for Windows 8.11.2 adds WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host.op-ssh-sign-wsl.exe and non UTF-8 signing support.
Adds op-ssh-sign-wsl.exe for WSL integration with MSIX
op-ssh-sign can now also sign non UTF-8 payloads
2 details in Everything
5 more releases in this issue9 more releases in this issue · 2025-07-08 → 2025-07-22
Adds op-ssh-sign-wsl.exe for WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host. integration with MSIX and supports non UTF-8 payloads in op-ssh-sign
└──▷ TRY IT
Use the new WSL-specific executable to integrate SSH signing in a Windows environment using WSL and MSIX packages.
Adds video, text_video, and url_action_video templates for sending video in Viber messages via Telesign Messaging
video template supports sending a Viber message with video and fallback to SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels., MMSMMSMultimedia Messaging Service, a mobile carrier protocol that extends SMS to carry images, audio, and video between handsets; cyber tools use it to analyze or simulate rich-media mobile message delivery., or WhatsApp
text_video template supports sending a Viber message with video and text
url_action_video template supports sending a Viber message with video, text, and a button
3 details in Everything
1 more release in this issue
· 2025-07-08 → 2025-07-18
Telesign SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. for Dynamics 365 v1.8 drops Marketing module dependency; now operates in Sales and Customer Service apps
Drops all dependencies on the Dynamics 365 Marketing module (Customer Journey, Subscription Lists, Real-Time Marketing), allowing deployment without that license
Restricts operational scope exclusively to Dynamics 365 Sales and Customer Service apps
2 details in Everything
└──▷ BREAKING ON UPGRADE
!All legacy marketing-based configurations and capabilities are permanently overwritten upon upgrade
!No backward compatibility with older Marketing-based journeys or automation (Customer Journeys, subscription list opt-ins/opt-outs, or marketing triggers)
Passbolt 5.3.2 adds clipboard flushing timer and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. configuration locking for enhanced security.
Enables encrypted metadata support for users with imported keys that have expiry dates and automates metadata key distribution when administrators leave
1 detail in Everything
1 more release in this issue
· 2025-07-09 → 2025-07-17
Passbolt 5.3 introduces custom fields for resources via encrypted metadata and enables OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user./ADFS SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. by default.
Adds custom fields to resources as key-value pairs attached via encrypted metadata
Self-serve event log streaming setup, member-initiated email updates, and country code allowlists for SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels./WhatsApp.
└──▷ TRY IT
Enable self-serve email updates by calling the new endpoint during member onboarding flow.
$ CALL Start a self-serve email update endpoint
// Requires: active member, stytch.[self|member].update.info.email RBAC permission
// Member must click magic link within 5 minutes
Configure country code allowlists via Terraform to restrict SMS/WhatsApp outbound traffic.
hcl
# In Terraform provider config
data "stytch_workspace" "current" {}
resource "stytch_country_code_allowlist" "sms_wa" {
workspace_id = data.stytch_workspace.current.id
codes = ["US", "GB"] # Only allow these countries
}
Navigate the dashboard to set up event log streaming destinations.
📍In the Stytch Dashboard, go to Activity → Stream Settings and select Datadog or Grafana Loki as a destination.
Adds Activity → Stream Settings in the dashboard to self-serve configure event log streaming to Datadog or Grafana Loki without support contact.
Adds a Start a self-serve email update endpoint allowing members to change their own email via magic link with 5-minute reservation.
Adds per-project country code allowlists for SMS and WhatsApp traffic to block toll fraud, configurable via Dashboard, Terraform, or Programmatic Workspace Actions.
3 details in Everything
5 more releases in this issue
· 2025-07-10 → 2025-07-25
Stytch adds self-serve event log streaming via dashboard/API, member email update flow, and country code allowlists for SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels./WhatsApp.
Adds manual setup of event log streaming in the Activity → Stream Settings dashboard view to send logs to Datadog or Grafana Loki without support assistance.
Adds the ability for members to update their own email addresses via a self-serve flow using email magic links, controlled by the stytch.[self|member].update.info.emailRBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. permission.
Adds per-project country code allowlists for SMS and WhatsApp traffic to restrict outbound messages to specific countries, configurable via dashboard, Terraform, or Programmatic Workspace Actions.
Stytch adds Trusted Auth Tokens via /sessions/attest, full text customization in Auth SDKs, and fingerprinting improvements.
Adds Trusted Auth Tokens capability to exchange any trusted JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. into a Stytch session
Adds the /sessions/attest endpoint for attesting external JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage.
Adds strings prop support for full text customization in B2B and Consumer Auth SDKs (JS, Android, iOS)
Uses node_modules/@stytch/vanilla-js/messages/b2b/en.po and node_modules/@stytch/vanilla-js/messages/en.po as default text catalogs for overriding strings
Stytch 2025.07.18 introduces Trusted Auth Tokens to extend sessions from third-party JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. and allows comprehensive text customization in JS/Android/iOS Auth SDKs.
Launch of official Stytch MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. for programmatic agent configuration
Adds the Stytch MCP Server at mcp.stytch.dev to allow AI agents and developers to configure Stytch projects programmatically
Official Stytch MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. launch enables programmatic project configuration via AI agents
Launches the official Stytch Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) Server for programmatic automation of Stych projects, redirect URLs, and email templates.
Enables AI agents to configure Stytch assets programmatically using OAuth-based agent authorization, replacing dashboard clicks.
Ory Kratos adds external_id support for identities, API queries, and JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. sub claims
Adds external_id field to identities and API assignment/query capabilities.
Enables external_id as the sub claim in JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. via the subject_source setting.
Workflow Automation adds email notification subject lines, incident label bulk actions, and other email recipients in mappings.
Adds a Subject Line field when adding, editing, or cloning an email notification template
Adds Add and Remove options for label actions on the Incidents page
Adds Other Email Recipients property to the Email Source DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Type in Incident Group Mappings and Workflow Mappings
3 details in Everything
26 more releases in this issue
· 2025-07-02 → 2025-07-31
Adds RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 container support with automated micro-dnf patching for ZPA infrastructure components.
ZIA adds SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. tenant label management, GitHub App Excessive Data Permissions finding, and DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. file access correlation.
Adds label management for SaaS application tenants in 3rd-Party App Governance and Advanced SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications.
Introduces the Excessive Data Permissions detection finding for GitHub apps
ZIA adds content location match criteria for DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., customizable confirmation templates, ATP URL comments, and new log fields.
Adds dlpContentLocationsScopes attribute to the WebDlpRule model in /webDlpRules API endpoints
Adds content location match criteria (File Metadata, File Content, File Name, HTTP Body) for Web DLP rules
Allows adding comments to malicious URLs in Advanced Threat Protection Blocked Malicious URLs lists
Enables multiple customizable User Confirmation templates for policy-level notifications
Adds matchCount enhancement to EDM Match Count based on unique token sets
+4 moreshow less
Adds PDF download of Zscaler ThreatLabz updates from Cybersecurity Insights page
Adds Allowed File Type Rule filter and column in Web Insights Logs
Adds %s{ft_rulename} field to NSS Feed Output Format for web logs
Adds Bandwidth by Data Center filter in Web Insights
ZPA adds provisioning key hiding in Admin Portal and new API endpoints for API keys, IP ranges, and more.
Adds ability to hide provisioning keys in the ZPA Admin Portal so they don't appear in the UI and can't be copied or downloaded
Adds new API endpoint GET /mgmtconfig/v1/admin/customers/{customerId}/apiKeys/{id} to retrieve specific API keys
Adds new API endpoint POST /mgmtconfig/v1/admin/customers/{customerId}/apiKeys to create API keys
Adds new API endpoint PUT /mgmtconfig/v1/admin/customers/{customerId}/apiKeys/{id} to update existing API keys
Adds new API endpoint DELETE /mgmtconfig/v1/admin/customers/{customerId}/apiKeys/{id} to delete API keys
+8 moreshow less
Adds new API endpoint GET /mgmtconfig/v1/admin/customers/{customerId}/v2/ssoLoginOptions to retrieve SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login options
Adds new API endpoint POST /mgmtconfig/v1/admin/customers/{customerId}/v2/ssoLoginOptions to create or update SSO login options
Adds new API endpoints GET, POST, PUT for /mgmtconfig/v1/admin/customers/{customerId}/configOverrides to manage config overrides
Adds new API endpoints GET, PUT, DELETE for /mgmtconfig/v1/admin/customers/{customerId}/privateCloudController/{privateCloudControllerId} and related restart endpoint
Adds new API endpoints GET, POST, PUT, DELETE for /mgmtconfig/v1/admin/customers/{customerId}/privateCloudControllerGroup/... to manage controller groups
Adds new API endpoints GET, POST, PUT, DELETE for /mgmtconfig/v1/admin/customers/{customerId}/userPortal/... to manage user portals
Adds new API endpoints GET, POST, PUT, DELETE for /mgmtconfig/v1/admin/customers/{customerId}/userPortalLink/... and bulk creation via v2
Adds new API endpoints GET, POST, PUT, DELETE for /mgmtconfig/v1/admin/customers/{customerId}/v2/ipRanges/... to manage IP ranges
Zscaler Client Connector Portal 4.4.2 adds Z-Tunnel 2.0 app profile options and OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. refresh for Authentication Service devices
Adds Z-Tunnel 2.0 as an option in App Profiles for Android and Android on ChromeOS devices
Adds Refresh Status option in the Compliance Status section of the Device Details window
Updates OTP support to include devices belonging to Authentication Service users
Updates the Upload File feature in VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Gateway Bypass to accept TXT file formats alongside CSV
ZIA adds ATP URL comments, customizable DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. confirmation templates, NSS feed location filter and policy download to JSON
Adds Add Custom Message button in Administration > Notification Templates > User Confirmation for creating multiple user confirmation templates
Adds %s{ft_rulename} field to NSS Feed Output Format for Web logs
Adds ZIP and PDF export options on the Print All Policies page for downloading configured policies
Adds locationGroups filter to NSS and Cloud NSS feeds for Web, Firewall, DNS, and MCAS logs
Updates /nssFeeds API endpoints to include new locationGroups attribute in the ZmanageNssFeed model
+1 moreshow less
Adds Allowed File Type Rule filter and column to Web Insights Logs
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Existing Firewall/Forwarding rules using the Department field without Advanced Firewall entitlement become non-editable; only deletion is allowed.
ZPA adds ML Recommendation management and extensive Cloud Service API endpoints for programmatic control of APIs, controllers, portals, and IP ranges.
Adds GET /mgmtconfig/v1/admin/customers/{customerId}/v2/ssoLoginOptions, POST .../v2/ssoLoginOptions, PUT .../privateCloudController/{id}/restart, and other endpoints for programmatic access to ZPA features.
Enables management of ignored ML Recommendations in Microsegmentation resource groups, allowing review and acceptance of previously ignored suggestions.
Adds an ML Recommendations Dashboard Widget to the Overview Dashboard showing enablement status and recommendation counts for Microsegmentation.
Adds Usage Insights dashboard to view actionable insights into organization's usage patterns between users and applications.
Adds Application Segments Usage reports (view/download) in ZPA Admin Portal for customers with Segmentation add-on, providing visibility into actively used segments and user group access.
ZIA adds four new ML-based DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries and extends Australian Passport PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. format support
Adds new predefined DLP dictionaries for ID Card, Medical Imaging, Satellite Data, and Schematic Data using ML-based detection
Extends Australian Passport number support in EDM and DLP predefined dictionaries to the AAn(6) format with optional delimiters
Zscaler Client Connector Portal 4.4.2 adds Z-Tunnel 2.0 support and OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. refresh.
Adds Z-Tunnel 2.0 as an app profile option for Android and Android on ChromeOS devices
Updates the Device Details window to automatically refresh one-time passwords (OTPs) every 60 minutes and adds a manual Refresh Status button in the Compliance Status section
Extends the Upload File feature in VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Gateway Bypass App Profiles to accept TXT file formats alongside existing CSV support
Adds OTP support for devices belonging to Authentication Service users in the Portal
ZIA adds Location Groups filter for NSS feeds, ATP URL comments, and policy export formats
Adds locationGroups attribute to /nssFeeds API endpoints via the ZmanageNssFeed model.
Adds a Location Groups filter option when configuring NSS and Cloud NSS feeds for Web, Firewall, and DNS logs, as well as MCAS NSS feeds.
Enables adding comments to malicious URLs in the Advanced Threat Protection (ATP) Blocked Malicious URLs list.
Adds JSON export capability for policies via the Administration > Print All Policies page (ZIP format with individual JSON files per policy type).
Adds Allowed File Type Rule filter and column to Web Insights Logs.
+1 moreshow less
Adds %s{ft_rulename} field to NSS/Cloud NSS feed output formats for web logs.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The Department field in Firewall and Forwarding rules is now restricted by Advanced Firewall entitlement; existing rules using this field without the license become non-editable and can only be deleted.
ZPA adds AI-powered recommendation UI features and increases PRA console limit to 9,000
Adds Recommended Users column to AI-Powered Recommendations page for Application Segments
Adds Groups or Attributes tab in Recommended Configuration drawer showing SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. groups and attributes
Adds copy list of recommended users feature in the Recommended Configuration drawer
Adds download missing users option from warning message in Recommended Configuration drawer
Enables email search within the Groups or Attributes tab for recommended/observed users
+3 moreshow less
Allows creation of access policy rules at the Policies step when adding an application segment from AI recommendations
Increases maximum total privileged consoles per Privileged Remote Access (PRA) Portal to 9,000
Adds VMware and Nutanix images for App Connector deployment
Authentication Service now enforces MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for admins via external IdPs with configurable grace periods and override options.
Adds Enforce Zscaler Admin MFA option on the Add Primary or Secondary Identity Provider page to require second-factor authentication for admins
Provides a 7-day grace period for admins authenticating through external IdPs to temporarily skip MFA before enforcement begins
Zscaler DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Azure AI Foundry predicates, Snowflake support, on-demand scanning, custom compliance frameworks, Data Inventory, and new data posture policies
Adds Has Model, Model Name, Model Format, and Model Version investigation predicates for Azure AI Foundry sensitive data correlation
Adds Australian Signals Directorate Essential Eight, Transportation Security Administration Security Directive Pipeline 2021-02, Healthcare and Public Health Sector's Cybersecurity Performance Goals, and Digital Operational Resilience Act to the Compliance dashboard framework list
Enables cloning existing compliance frameworks or creating new ones from scratch for custom compliance requirements
Adds Data Inventory page providing a comprehensive overview of sensitive files and tables across clouds, accounts, and data stores
Adds On-Demand scan option to manually trigger scans for all resource types including virtual machines and databases
+8 moreshow less
Supports Cloud resource tags as an exclusion factor in data scanning settings
Enables configuration of specific start time windows for scanning unmanaged databases
Adds HashiCorp Vault support for hosting keys used in database scanning
Adds Snowflake database support for sensitive data scanning and security assessments
Adds Data Posture Policies for AWS, Azure, GCP, and On-Premises targets covering risks like misconfigured IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles and disabled encryption
Adds Resource Timeline tab displaying configuration and management change events for resources across time periods
Adds AI & ML tab for Virtual Machines listing installed AI packages and models
Provides detailed view of unmanaged and custom AI models and services installed on virtual machines across AWS, Azure, and GCP
Risk360 now supports the ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 27001:2022 framework for ISMS analysis.
DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Snowflake support, unmanaged database scan windows, custom compliance frameworks, and an AI & ML VM tab.
Support for Australian Signals Directorate Essential Eight, Transportation Security Administration Security Directive Pipeline 2021-02, Healthcare and Public Health Sector's Cybersecurity Performance Goals, and Digital Operational Resilience Act compliance frameworks.
Ability to configure custom compliance frameworks by cloning existing ones or creating new ones from scratch.
On-Demand scanning for virtual machines, databases, NoSQL databases, and unmanaged databases.
Scan Start Time Configuration for unmanaged databases to define specific time windows for scanning.
Cloud resource tags as an exclusion factor in data scanning settings.
+3 moreshow less
Hash of scanned files for malware scanning displayed on the Sensitive tab of the Resource Inventory.
AI & ML Tab for Virtual Machines listing installed AI & Machine Learning packages and models.
Unmanaged AI Service Discovery dashboard view for custom AI models and services across AWS, Azure, and GCP.
ZIA July 2025 adds NSS Location Groups filter, DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. redaction profiles, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for Index Tool, and new EDM data types.
Adds locationGroups attribute to the /nssFeeds API model and Location Groups filter in NSS/Cloud NSS feeds for Web, Firewall, DNS, and MCAS logs
Enables DLP redaction profiles (asterisk * or hash #) for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Data at Rest Scanning policies on file sharing apps
Allows removing applied redaction characters via the Assets with Incidents page in Analytics > SaaS Security Report > Assets
Adds support for Australian Passport number format (AAn(6)) in predefined DLP and EDM dictionaries
Adds National Document ID (Uruguay), National Identification Number (Chile), and National Identification Number (Peru) to available EDM data types
+2 moreshow less
Enables Single Sign-On (SSO) configuration for the ZIA Index Tool
Adds Trusted Users and Trusted Domains support in SaaS Data at Rest Scanning DLP policies
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The Department field in Firewall and Forwarding rules is now restricted to customers with Advanced Firewall entitlement; existing rules using this field without the entitlement are non-editable and can only be deleted
ZIA adds custom Browser EUN template support to File Type Control policy rules
Adds Browser Notification Template field in the Add File Type Control Rule window (Policy > File Type Control > Add File Type Control Rule) to configure custom end-user notifications when rule access is set to block or caution.
Updates cloud application categories with newly added cloud applications, allowing download of the new list.
Version v1.23.5 introduces ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. support for outbound_allow_list and allows custom SocketProtect implementations for Android VpnService.
└──▷ GET THIS VERSION
$ git clone --branch v1.23.5 https://github.com/shadowsocks/shadowsocks-rust.git
# already have the repo? check out this version:$ git checkout v1.23.5
ACL supports outbound_allow_list to control outbound connections
Adds support for configuring multiple identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. on the Twingate Network
Allows configuring multiple identity providers and sign-in options for the Twingate Network.
Enables mixing social logins and supported IdPs to handle complex environments like migrations or acquisitions.
SPIRE v1.12.4 adds a Kubernetes ConfigMap bundle publisher, a new streaming bundle RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets., and file-based trust bundle support for the OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Discovery Provider.
└──▷ GET THIS VERSION
$ git clone --branch v1.12.4 https://github.com/spiffe/spire.git
# already have the repo? check out this version:$ git checkout v1.12.4
New k8s_configmap BundlePublisher plugin lets SPIRE Server publish trust bundles directly to a Kubernetes ConfigMap.
New UpstreamAuthority.SubscribeToLocalBundle RPC enables streaming updates of the local trust bundle to upstream authority plugins.
OIDC Discovery Provider can now read the trust bundle from a file, removing the dependency on a live SPIRE Server endpoint.
Integration tests now run on ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead., broadening validated platform coverage.
Improved entry lookup performance in the SPIRE Server.
New Aembit CLI for CI/CD injection, AWS Secrets Manager/IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. providers, Jenkins support, and Agent Controller TLS port hardening
Releases the Aembit CLI, a command-line interface that allows you to inject credentials into your CI/CD pipelines.
Introduces the AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. Role Credential Provider Integration, used with the Secrets Manager Credential Provider to retrieve AWS Secrets Manager secrets.
Introduces the AWS Secrets Manager Credential Provider for direct secret retrieval from AWS Secrets Manager.
Adds support for Jenkins Pipelines as a compatible CI/CD target for Aembit-managed credentials.
Enables wildcard hostname support for Server Workloads in Agent Controller.
+1 moreshow less
Agent Controller automatically closes insecure HTTP ports when TLS is enabled and opens port 443 (5443 on VMs) plus secure Prometheus port 9091.
6 details in Everything
1 more release in this issue
· 2025-07-22 → 2025-07-29
New Discovery filtering in UI and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. ID Token Trust Provider for workload auth
Adds advanced filtering options to the Discovered tab for Client and Server Workloads in the UI
Introduces the OIDC ID Token Trust Provider to validate incoming tokens against issuer, audience, and subject claims for workload authentication
Teleport v17.7.0 adds canary update support for Managed Updates v2 via autoupdate_config
└──▷ GET THIS VERSION
$ git clone --branch v17.7.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.7.0
Adds canary_count configuration key to autoupdate_config specs to enable canary updates for agent groups in Teleport Managed Updates v2
Extends audit log events for SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. SVID issuances to include the name/label selector used by the client
2 details in Everything
12 more releases in this issue
· 2025-07-01 → 2025-07-30
Teleport v18.1.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server/DB access, VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. SSH, bound keypair joining, Sailpoint SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave., and canary Managed Updates.
└──▷ GET THIS VERSION
$ git clone --branch v18.1.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v18.1.0
└──▷ USE IT
Enable canary updates for a Managed Updates group so only 5 agents update first before the rest of the group proceeds.
Adds canary_count field to autoupdate_config schedules, enabling canary updates in Managed Updates v2 — Teleport updates a configurable number of agents first (max 5, randomly selected) and confirms health before rolling out to the rest of a group.
Adds --listen flag to tsh proxy db for setting a custom local listener address.
Adds tctl top support for the local Unix socket debug endpoint.
Adds TeleportRoleV8 support to the Teleport Kubernetes Operator.
Adds multi-account support to Teleport discovery bootstrap.
+13 moreshow less
Audit log events for SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. SVID issuances now include the name/label selector used by the client.
Client tools managed updates now support multi-cluster environments and track each version in the configuration file.
The teleport-distroless container image now disables client tools updates by default; re-enable by unsetting the TELEPORT_TOOLS_VERSION environment variable.
Defines a new access-plugin preset role.
Adds native MCP server access with connection proxying and audit logging support for stdio-based MCP servers.
Adds MCP integration for database access, allowing MCP clients such as Claude Desktop to execute queries in Teleport-protected databases.
Adds VNet native SSH support, enabling any SSH client to connect to Teleport SSH servers with zero configuration and first-class per-session MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone..
Adds identifier-first login flow: the initial login screen shows only a username prompt, then presents applicable SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. connectors after username submission.
Adds bound keypair join method for Machine ID as a more secure alternative to token joining, with automatic self-recovery from expired client certificates.
Adds Sailpoint SCIM provider integration, allowing administrators to synchronize Sailpoint entitlement groups with Teleport access lists.
Improves access requests web UI to make a clearer distinction between just-in-time and long-term access request flows.
Adds enrolment for a generic SCIM integration (Enterprise).
tbot client now discards expired identities during renewal to allow automatic recovery without restarting the process.
Teleport v17.6.0 adds native VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. SSH support and updates tctl/tsh capabilities
└──▷ GET THIS VERSION
$ git clone --branch v17.6.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.6.0
Adds native SSH protocol support to VNet, allowing standard SSH clients to connect with zero configuration and full support for features like per-session MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone..
Enables tctl top to read metrics from the local unix socket debug endpoint.
Extends tsh App Access commands to support Azure CLI (az) version 2.73.0 and newer.
Allows client tools managed updates to operate in multi-cluster environments by tracking versions per cluster in the configuration file.
Teleport v17.5.5 adds sortable bot instances in UI and VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. DNS over IPv4
└──▷ GET THIS VERSION
$ git clone --branch v17.5.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.5.5
└──▷ HOW TO FIND IT
View bots sorted by most recent activity to identify stale or unresponsive bot instances.
📍In the Teleport web UI, navigate to Bot Instances and click the Latest Heartbeat column header to sort.
Adds sorting of Bot instances by latest heartbeat time in the Teleport web UI
Adds tctl autoupdate agents report command, CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. access requests, and auto-reviews for resource requests.
└──▷ GET THIS VERSION
$ git clone --branch v18.0.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v18.0.1
Added support for CRD in access requests.
Enabled automatic reviews of resource requests.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!tbot no longer supports providing a proxy server address via --auth-server or auth_server, use --proxy-server or proxy_server instead.
Teleport v17.5.6 adds glob-style matching to Spacelift join rules and improves PKINITPKINITA Kerberos extension that lets a client authenticate using a public-key certificate instead of a password, enabling smart-card and certificate-based login to Active Directory and other Kerberos realms. compatibility.
└──▷ GET THIS VERSION
$ git clone --branch v17.5.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.5.6
Teleport v18 adds Identity Activity Center, automatic access request reviews, multi-session MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. device trust, DB health checks, and Kubernetes CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. support in role v8
└──▷ GET THIS VERSION
$ git clone --branch v18.0.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v18.0.0
└──▷ USE IT
Execute queries across multiple selected databases with a single MFA challenge using the new multi-session command
shell
tsh db exec --db-server '*' 'SELECT * FROM users'
Update Windows desktop discovery configuration to support multiple discovery configs with custom RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. ports and intervals
Configure role version 8 to grant access to Kubernetes CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. with the new api_group field
Enable PKCEPKCEProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier. in OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. connector configuration to prevent authorization code interception attacks
config
oidc:
pkce_mode: enabled
Adds Identity Activity Center to expose hidden identity risk by correlating user activity from AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions., GitHub Audit Log API, Okta Audit API, and Teleport Audit Log
Adds automatic access request reviews via Access Monitoring Rules to auto-approve or deny requests without separate plugins
Adds tsh db exec command for multi-session MFA reuse across multiple database connections
Adds RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. controls using app_labels for SAML applications and enforces device trust on SAML IdPSAML IdPA SAML Identity Provider is a service that authenticates users and issues signed XML assertions to relying applications, letting a single login session span many services without re-entering credentials. sessions
Adds automatic db_server health checks that report status in the UI and prioritize healthy services for routing
+9 moreshow less
Adds support for Kubernetes Custom Resource DefinitionsCustom Resource DefinitionsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. (CRDs) in role version 8, including the new api_group field in kubernetes_resources
Adds pkce_mode: enabled option to OIDC connector configurations for Proof Key for Code ExchangeProof Key for Code ExchangeProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier. support
Changes Windows desktop discovery configuration from discovery to discovery_configs to allow multiple separate discovery configurations with custom RDP ports and intervals
Removes manual TLS cipher suite configuration, specifically dropping support for tls-rsa-with-aes-128-cbc-sha, tls-rsa-with-aes-256-cbc-sha, tls-rsa-with-aes-128-cbc-sha256, tls-rsa-with-aes-128-gcm-sha256, tls-rsa-with-aes-256-gcm-sha384, tls-ecdhe-ecdsa-with-aes-128-cbc-sha256, and tls-ecdhe-rsa-with-aes-128-cbc-sha256
Changes Terraform provider role defaults to leave unset booleans empty instead of defaulting to false, allowing Teleport to pick UI/operator defaults
Removes custom service endpoint support for tsh aws and tsh proxy aws, requiring use as HTTPS_PROXY servers instead
Blocks TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. as a second factor for per-session MFA in tsh (TOTP remains valid for initial login)
Requires Linux kernel version 3.2 or later for Teleport operations
Removes legacy ALPN connection upgrade mode, including the TELEPORT_TLS_ROUTING_CONN_UPGRADE_MODE environment variable
14 details in Everything
└──▷ BREAKING ON UPGRADE
!Manual TLS cipher suite configuration is no longer supported; configurations listing tls-rsa-with-aes-128-cbc-sha, tls-rsa-with-aes-256-cbc-sha, tls-rsa-with-aes-128-cbc-sha256, tls-rsa-with-aes-128-gcm-sha256, tls-rsa-with-aes-256-gcm-sha384, tls-ecdhe-ecdsa-with-aes-128-cbc-sha256, or tls-ecdhe-rsa-with-aes-128-cbc-sha256 will fail or be ignored
!Terraform provider role defaults change from explicit false to null for unset booleans, which may alter default behavior for options like cert_format, create_host_user, desktop_clipboard, desktop_directory_sharing, and ssh_file_copy
!tsh aws and tsh proxy aws commands no longer support custom service endpoints; users must use HTTPS_PROXY environment variable instead
!tsh rejects TOTP as a second factor for per-session MFA, restricting it to initial login only
!Linux systems with kernel version lower than 3.2 are no longer supported
!Legacy ALPN upgrade mode and the TELEPORT_TLS_ROUTING_CONN_UPGRADE_MODE environment variable are removed
Teleport v16.5.13 adds workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. label templating and tbotO_CLOEXEC enforcement
└──▷ GET THIS VERSION
$ git clone --branch v16.5.13 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v16.5.13
└──▷ USE IT
Check if teleport-update has the latest version and script CI/CD pipelines to exit 0 immediately if no update is needed.
shell
teleport-update status --is-up-to-date && echo 'Up to date'
workload_identity_labels Role resource field now supports trait role templating.
tbot client now ensures the O_CLOEXEC flag is used when opening files on Linux hosts.
Added the --is-up-to-date flag to teleport-update status to change the return code based on the update status.
Adds tsh db exec multi-database command, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for desktop access, and Oracle SCAN support.
└──▷ GET THIS VERSION
$ git clone --branch v17.5.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.5.3
└──▷ USE IT
Check if the teleport-update daemon is current, returning 0 if it is and non-zero otherwise for CI/CD gating.
shell
teleport-update status --is-up-to-date && echo 'Up to date' || echo 'Update needed'
Execute a command across multiple target databases with a single MFA prompt.
teleport-update status --is-up-to-date flag added to control the return code based on update status
tbot CLI now uses --proxy-server or proxy_server instead of the removed --auth-server / auth_server flags for proxy configuration
Added support for executing commands across multiple target databases via tsh db exec with per-session MFA batching
Added SSO MFA support for desktop access
Database protocols using KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. (SQL Server, Oracle) can now fetch user SID for Full Enforcement mapping
+3 moreshow less
Added support for Oracle SCAN (Single Client Access Name)
Added support for AWS KMSAWS KMSAWS Key Management Service, Amazon's hosted service for creating and controlling cryptographic keys, giving cyber tools a durable, audited place to encrypt data without managing raw key material themselves. multi-region keys with key replication
Machine and Workload Identity: tbot will keep retrying if the auth server is unavailable on startup, instead of exiting immediately
8 details in Everything
└──▷ BREAKING ON UPGRADE
!tbot no longer supports providing a proxy server address via --auth-server or auth_server, use --proxy-server or proxy_server instead.
Track timely training completions with SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments.-enabled campaigns
Adds the ability to define an SLA in days when creating a training campaign to track and enforce on-time completion
Introduces new completion statuses: Due, Overdue, Completed, and Completed Late for monitoring employee training progress
Adds new set of automated compliance tests that run automatically when integrations are connected, surfacing findings in the Tests → Automated Tests module.
Adds automated test coverage for connected AWS, Azure, DigitalOcean, Vercel, Azure DevOps, GitLab, Bitbucket, OneLogin, and Auth0 integrations.
New Billing section with invoice history, overdue alerts, and auto-deactivation logic added to Settings.
Adds a Settings → Billing section for viewing outstanding invoices and payment history
Introduces configurable overdue alerts: banner at 1 day past due, pop-ups at 45+ days, recurring pop-ups at 55+ days, with export restrictions at 1 day and auto-deactivation at 60+ days
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Accounts already 60+ days overdue will be auto-deactivated once the feature is rolled out
Vendor Portal now supports in-file previews for spreadsheets, documents, PDFs, images, videos, and email attachments with zoom, fullscreen, and search.
Adds direct file preview support in the Vendor Portal modal for .xlsx.xlsxThe file format used by Microsoft Excel for spreadsheets, based on the Open XML standard. Cyber tools use it to ingest or export structured tabular data in a format analysts already work with., .xls, .csv, .doc, .docx, .ppt, .pptx, .pdf, .jpg, .jpeg, .pmg, .mp4, and .eml files.
Adds zoom controls, full-screen mode, and Cmd + F / Ctrl + F search within the Vendor Portal file preview modal.
Enables direct download of files from the Vendor Portal preview modal without leaving the interface.
Scrut adds Microsoft Teams integration for real-time compliance and security notifications in channels or DMs.
Adds Microsoft Teams integration to receive real-time notifications and alerts directly in your organization's Teams workspace
Enables configuration of which alerts to receive and allows routing them by user or group via the Settings → Notifications interface
Supports delivery of Task reminders (Personal, Employee), Security report ready status, Sample data availability, Test status changes, Scrut Monitor health changes, Integration failures, and Vendor-related alerts to assigned Teams channels or DMs
ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001:2022 mapping updated for enhanced accuracy with new ISMS Policy Statement template.
Remaps 12 ISO controls for better Unified Control Framework alignment.
Links 4 previously unmapped ISO controls to relevant controls.
Adds guidance suggestions and removes redundant evidence suggestions.
Creates a new ISMS Policy Statement template and reviews existing policy templates.
Adds UI-generated, auditor-ready Statement of Applicability (SoA) downloads for ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001/27017/27018/27701/42001
UI navigation to generate and download an SoA in the Compliance -> Frameworks UI
Generation of auditor-ready SoA documents listing in-scope, out-of-scope controls and applicability status
Automatic email delivery of the generated SoA document
Drata adds OAuth support for Google IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. and UAR integrations, eliminating Super Admin requirement
Adds OAuth-based connection method for Google Identity Provider (IdP) integration, allowing setup with User Management Administrator and Group Reader roles instead of requiring a Super Admin account.
Adds OAuth-based connection method for Google User Access Review (UAR) integration, enabling token-based access without generating or managing an API Key.
Enables revocation of short-lived access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. for Google IdP and UAR connections at any time to reduce risk.
3 details in Everything
12 more releases in this issue
· 2025-07-04 → 2025-07-25
Drata adds Azure GCC HighGCC HighA Microsoft 365 cloud environment restricted to US government contractors handling controlled unclassified information, meeting compliance requirements like ITAR and DFARS that standard commercial tenants cannot satisfy. and Azure Management Groups GCC High connection integrations
Adds Azure GCC High connection support for regulated industry customers.
Adds Azure Management Groups GCC High connection support for hierarchical account management.
Drata adds support for HITRUSTHITRUSTA US-based certification framework for healthcare data security, maintained by the HITRUST Alliance, that maps controls from HIPAA, NIST, and ISO into a single assessable standard tools can target to prove compliance.CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. (e1, i1, r2) framework with pre-mapped controls and unified management.
Adds HITRUST CSF framework support (e1, i1, r2) to the platform
Provides pre-mapped controls for accelerated compliance alignment
Enables unified framework management alongside SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria., ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, and HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against.
Drata MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. introduces a new agent-ready compliance layer enabling real-time risk reporting via Claude and integration with AI IDEs like Cursor.
Drata Data in AI IDEs like Cursor
Automated GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. Workflows
SafeBase launches AI-enabled Trust Library Search for unified querying across documents and controls.
Enables Trust Library Search to ask one-off questions with AI-generated answers and traceable sources
Unifies search across the entire Trust Library including documents, knowledge base entries, Trust Items, Trust Center updates, and synced controls from Drata
Vanta adds TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. vendor AI answers with inline citations, file uploads in Issue Mgmt, and SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. remediation via Agent beta.
Adds TPRM Vendor AI Answers public preview for pre-filling vendor portal responses
Enables file uploads (screenshots, PDFs, docs) directly to issues in Issue Management
Introduces Vanta Agent SLA Remediation beta via the new AI insights banner in the Policies tab
Adds QAuto support for automating spreadsheet questionnaires with custom dropdown responses (private preview)
Adds inline citations to TPRM AI answers referencing specific evidence and page locations
+1 moreshow less
Updates Trust Center chatbot to respect applied tags for resource filtering
New REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints for policies and CSV issue export
Adds GET /api/v1/policies endpoint to list policies via the Vanta REST API
Adds GET /api/v1/policies/{id} endpoint to retrieve a specific policy by ID via the Vanta REST API
Adds .csv download for issues and their metadata in the UI for offline tracking
Risk Ledger beta adds port scanning, Monitoring Dashboard, and enhanced findings navigation for supplier risk assessment.
└──▷ HOW TO FIND IT
Monitor the latest scan summary for all suppliers via the centralised view.
📍In the UI, go to Supplier Overview › Monitoring Dashboard
Review specific findings across a supplier's assets directly in the new tab.
📍In the UI, go to External Monitoring › [Supplier Name] › Findings
port_scanning capability in External Monitoring (Beta) to automatically check suppliers' digital assets for open ports across remote access, databases, web services, file sharing, and infrastructure
Monitoring Dashboard providing a centralised view on the Supplier Overview displaying a summary of latest scan results
New Findings tab in External Monitoring alongside existing Scans and Assets sections, allowing clients to review across an entire supplier’s assets
Panorays Q2'25 adds Gemini AI answer suggestions, simplified supplier onboarding flow, enriched Business Snapshots, and Cyber News webhooks via public API.
Gemini Answer Advisor generates questionnaire answer suggestions from public data and SmartMatch results
New Add Supplier flow initiates a cyber posture assessment automatically upon creation without prior background knowledge
Business Snapshot aggregates broader public data sources for deeper supplier profile visibility
Public API now supports new Cyber News webhooks for real-time threat intelligence
CISO Assistant v2.7.11 adds extra filters on requirements assessments via API.
└──▷ GET THIS VERSION
$ git clone --branch v2.7.11 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.7.11
7 more releases in this issue
· 2025-07-02 → 2025-07-31
Adds Prometheus metrics exporter and enhanced table filters to CISO Assistant v2.7.10
└──▷ GET THIS VERSION
$ git clone --branch v2.7.10 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.7.10
└──▷ TRY IT
Monitor CISO Assistant instance health via Prometheus for alerting dashboards.
$ curl http://localhost:8080/metrics
Filter multiple objects tables by status or type to quickly locate specific items.
📍Use the new filter dropdowns in the multiple objects view (e.g., Frameworks, Controls).
Add prometheus metrics endpoint for exposing instance health and performance data.
Add multi-object table filters to refine search results across frameworks, controls, and assets.
CISO Assistant v2.7.9 adds an observation field to user objects and a new Moroccan cybersecurity risk matrix.
└──▷ GET THIS VERSION
$ git clone --branch v2.7.9 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.7.9
Adds observation field to User objects for capturing additional context on team members
Adds the Moroccan Law 05-20 risk matrix as a new built-in framework option
CISO Assistant v2.7.8 adds EBIOS RMEBIOS RMA French risk-management method published by ANSSI for analysing cyber threats and selecting countermeasures; tools use it to structure risk assessments that satisfy French and EU regulatory expectations. context menu selection, risk appetite support, xlsx risk action plan export, and dual score propagation.
└──▷ GET THIS VERSION
$ git clone --branch v2.7.8 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.7.8
└──▷ HOW TO FIND IT
Generate a spreadsheet of planned mitigation actions for stakeholder review or integration with other planning tools.
📍In the Risk Management view, click Export and select Risk Action Plan (XLSX) as the format.
Add EBIOS RM selection is now available via the context menu for easier framework association
Added support for the risk appetite concept to model organizational tolerance levels
Parent nodes now retain dual scores when propagated (excluding root nodes) for more granular risk visibility
CISO Assistant v2.7.7 adds NIST SP 800-82 Annex F, audit creation dates, and incident time pre-fill.
└──▷ GET THIS VERSION
$ git clone --branch v2.7.7 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.7.7
Adds NIST SP 800-82 Annex F as a new framework available for audits.
Presets incident reporting time to now automatically when opening the incident reporting form.
Includes creation date on audit records.
Updates prepare_framework_v2.py tool to be more user-friendly for framework preparation workflows.
CISO Assistant v2.7.3 adds default assignee for perimeters
└──▷ GET THIS VERSION
$ git clone --branch v2.7.3 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.7.3
Adds inherent risk management, assets for feared events, EBIOS RMEBIOS RMA French risk-management method published by ANSSI for analysing cyber threats and selecting countermeasures; tools use it to structure risk assessments that satisfy French and EU regulatory expectations. graph support, and a YAML-to-Excel converter
└──▷ GET THIS VERSION
$ git clone --branch v2.7.2 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.7.2
└──▷ TRY IT
Convert a framework definition from YAML to Excel format.
CISO Assistant v2.6.5 adds Greek UI translation, NIS2NIS2EU directive that expands mandatory cybersecurity requirements to more sectors and member states than its predecessor, giving cyber tools a compliance framework to map controls and reporting obligations against. framework mappings, and raises the default file upload limit to 25 MB.
└──▷ GET THIS VERSION
$ git clone --branch v2.6.5 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.6.5
Increases default maximum file upload size to 25 MB.
Data Service 1.2.6 adds Azure Redis cache with Entra/Managed Identity support and HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. proxy for inter-POD communication.
azure cache now supports Entra and Managed Identity auth modes
All external calls and HTTPs communication between PODs now route through an HTTPS Proxy
Custom logs can include virtual keys via request headers
3 details in Everything
1 more release in this issue
· 2025-07-10 → 2025-07-22
Portkey Enterprise Gateway 1.11.9 adds S3 Object Lock support, new provider parameters and unified finish reason handling
Adds LOG_STORE_OBJECT_LOCK_RETENTION_ENABLED environment variable to enable S3 Object Lock and Retention-enabled buckets for the log store
Unifies finish_reason values across Anthropic and Bedrock models, retaining provider-returned values when x-portkey-strict-openai-compliance is set to false
Adds support for cost calculation for fine-tuned models on Vertex AI
Adds support for the Computer Use tool for Anthropic models on AWS Bedrock
Handles backward compatibility for Titan G1 embeddingsembeddingsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. model encoding_format parameter on AWS Bedrock
+2 moreshow less
Forwards max_completion_tokens parameter as-is instead of mapping it to max_tokens on Azure AI
Adds support for the web_search_options parameter for chat completions endpoint on OpenAI and Azure OpenAI
Promptfoo tests, evaluates, and red-teams LLM applications to detect vulnerabilities and compare model outputs.
Promptfoo July 2025 adds Docker Model Runner, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support, context transforms in assertions, and agentic red team strategies.
Adds docker model runner for isolated model execution via Docker containers
Adds mcp provider to connect to Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers
Adds Google Imagen model support for multimodalmultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. testing
Adds AIMLAPI provider for unified access to various AI models
Adds Grok-4 and OpenAI Deep Research Models (o3-deep-research, o4-mini-deep-research) as new model providers
+16 moreshow less
Enhances Azure provider with system_prompt support in configuration
Adds LiteLLM EmbeddingsEmbeddingsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. provider for similarity testing and semantic searchsemantic searchSearching by meaning rather than requiring the same words. It commonly compares vector representations to find related content, even when the wording differs.
Adds Google Vision provider for image understanding in multimodal evaluations
Enhances HTTP Provider to support JKSJKSJava KeyStore, a file format maintained by Oracle for storing cryptographic keys and certificates; tools use it to manage TLS identities without depending on the host OS certificate store. and PFXPFXA binary file format (PKCS#12) that bundles a private key and its certificate chain into a single password-protected file, letting cyber tools load credentials without managing separate key and cert files. client certificates
Adds Browser Provider connecting to Chrome via Chrome DevTools Protocol (CDPCDPCisco Discovery Protocol, a Cisco-proprietary Layer 2 protocol that advertises device identity, capabilities, and topology between directly connected Cisco gear, giving cyber tools a passive way to map network infrastructure.)
Adds context transforms to extract data from provider responses for use in assertions
Adds finish-reason as an option in assertions to validate response termination
Adds tracing assertion fields: trace-span-count, trace-span-duration, and trace-error-spans
Allows defaultTest to load test cases from external files for external test configuration
Enhances search with metadata filtering using equals, contains, and not contains operators in Web UI
Adds first-class zooming support in the eval results page via Web UI
Adds re-grade functionality for existing red team scans after changing grading rules
Adds Identity Provider integration to map teams and roles for permission assignment
Adds MCP Proxy feature for access control and traffic monitoring of MCP servers
Adds custom agentic multi-turn red team strategy using natural language instructions
Adds mischievous_user agentic multi-turn red team strategy simulating playful user behavior
ToolHive v0.2.1 adds tool filtering, group management commands, runconfig export/import, Windsurf client support, and .thvignore volume hiding
└──▷ GET THIS VERSION
$ git clone --branch v0.2.1 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.2.1
└──▷ USE IT
Create a server and assign it to a group for organized management
shell
thv run --name myserver --group production
Create a .thvignore file in the mounted volume to hide specific files from the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server
shell
# Add 'secrets/' and '*.key' to <path>/.thvignore
cat > .thvignore <<EOF
secrets/
*.key
EOF
Adds --group flag to thv run to add an MCP server to a named group
Adds thv group list, thv group delete, and rm --group commands for workload grouping management
Adds tool filtering capabilities to the thv serve API and MCPServerCRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.
Adds .thvignore file support to hide mounted volume files from MCP servers
Adds Windsurf IDE client configuration support for MCP connections
+2 moreshow less
Adds streamable HTTP transport with auto-detection to the MCP client via a new flag
Adds --github-output flag for e2e tests running in GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure.
7 details in Everything
15 more releases in this issue
· 2025-07-01 → 2025-07-29
ToolHive operator adds MCPServer tool filtering and runconfig export/import.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.12 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.12
Adds tool filtering capability to the MCPServerCRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it..
Implements runconfig export and import functionality.
ToolHive Operator v0.2.1 adds tool filtering to MCPServer CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. and runconfig export/import.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.2.1 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.2.1
Adds tools field to MCPServerCustom Resource DefinitionCustom Resource DefinitionA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. for selective tool enablement
Adds --group flag to thv run, new runtime check command, streamable HTTP MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support, and Helm chart for operator
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.2.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.2.0
└──▷ TRY IT
Launch a tool and assign it to a group for logical organization
$ thv run --group analytics your-tool
Verify that all required runtime dependencies are installed correctly before deployment
$ thv runtime check
Deploy the ToolHive Operator to your Kubernetes cluster using the new Helm chart
--github-output flag added to e2e tests for GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. CI integration
File-based status tracking implementation for state persistence
--group flag added to thv run command for MCP server grouping
custom_metadata field added to the registry schema
New thv runtime check command for verifying runtime dependencies
+5 moreshow less
New thv list-groups command to display existing tool groups
Tool filtering capability added to the thv serve API endpoint
Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. support enabled in MCP client with auto-detection and transport flag
Helm chart provided for deploying the ToolHive Operator into Kubernetes
Operator chart migrated to use proxyrunner image
10 details in Everything
└──▷ BREAKING ON UPGRADE
!The workload label group is removed; use --group on create or the new list-groups command instead
ToolHive v0.2.0 adds custom_metadata to MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, VS Code mcp.json support, and proxy session management
└──▷ GET THIS VERSION
$ git clone --branch v0.2.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.2.0
Adds custom_metadata property to MCP server configuration for arbitrary key-value metadata on each server entry
Uses mcp.json as the standard location for generating VS Code client MCP configuration (requires VS Code 1.102+)
Enables proxy session management, allowing new flags or endpoints to control isolated proxy sessions
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The deprecated --port flag is removed; use --proxy-port instead
ToolHive v0.1.8 adds operator CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. options for JWK CA bundles, proxy env vars, splits ProxyRunner binary, and moves client commands to thv client
└──▷ GET THIS VERSION
$ git clone --branch v0.1.8 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.1.8
thv client subcommand group now contains client configuration commands (moved from root)
Operator CRD supports spec.jwk.caBundle to specify a CA bundle for fetching JWKs
Operator CRD supports spec.jwk.auth to configure authentication when fetching JWKs
Operator allows setting environment variables for the proxy server via new spec fields
ProxyRunner Capability is split into a separate binary for Kubernetes deployments
+1 moreshow less
API middleware checks for updates on every API call using a new User Agent implementation
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Client configuration commands are no longer available at the root thv level; they are now under the thv client subcommand group
ToolHive Operator adds environment variable support for the proxy server
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.11 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.11
Add proxy.env field to CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. to inject environment variables into the proxy server
Adds CA bundle and authentication options for JWK fetching in ToolHive Operator CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.10 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.10
Adds new caBundle and authentication configuration fields to the ToolHive Operator CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. to allow custom CA verification and authenticated JWK fetching.
Enables secure integration with private or corporate PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. setups by permitting TLS certificate authority bundles when querying JWK endpoints.
ToolHive v0.1.6 adds StreamableHTTP protocol for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers in Kubernetes and support for private OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. registries
└──▷ GET THIS VERSION
$ git clone --branch v0.1.6 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.1.6
Adds a Helm chart for deploying the ToolHive Operator into Kubernetes.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.1.5 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.1.5
└──▷ USE IT
Install or upgrade the ToolHive Operator via Helm.
ToolHive v0.1.3 adds streamable HTTP proxy for STDIO servers and tab-completion for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server names
└──▷ GET THIS VERSION
$ git clone --branch v0.1.3 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.1.3
Adds --transport streamable-http option to the th server run command to proxy STDIO MCP servers over Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication..
Enables shell auto-completion for MCP server names registered in ToolHive when using the CLI.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Removed deprecated MCP servers from the registry; th server run will fail if referencing a removed server.
ToolHive v0.1.2 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. debug commands (mcp/tools, mcp/resources, mcp/prompts), operator authz config, OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. management, and random host port selection for Docker containers.
└──▷ GET THIS VERSION
$ git clone --branch v0.1.2 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.1.2
Adds mcp/tools, mcp/resources, and mcp/prompts subcommands to list available MCP tools, resources, and prompts
Introduces an authz configuration section in the operator settings for access control policy management
Adds OpenTelemetry configuration management capabilities for tracing and metrics
Adds readiness/liveness probes to proxy; logs Cedar diagnostics; updates MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. fetch dependency
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.9 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.9
Add readiness and liveness probes configuration for the proxy container in the Helm chart
Log the Cedar diagnostics policy output during operator startup
Replace the mcp/fetch dependency with stackloklabs/gofetch for tool MCP fetching
toolhive-operator-crds v0.0.8 adds authz config support to the operator
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.8 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.8
The code-oss project is an open-source code editor combining editing, debugging, and extensibility for developers across Windows, macOS, and Linux.
VS Code 1.102 ships GA MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support, Copilot coding agent delegation, custom chat modes, and terminal auto-approval.
└──▷ GET THIS VERSION
$ git clone --branch 1.102.0 https://github.com/microsoft/vscode.git
# already have the repo? check out this version:$ git checkout 1.102.0
MCP (Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) support is now generally available, with a dedicated MCP view and gallery for installing and managing MCP servers.
MCP servers are now first-class resources in profiles and Settings Sync.
Delegates background tasks to a Copilot coding agent session (preview).
Generates custom instructions that reflect a project's conventions.
Adds custom chat modes for tailoring chat to tasks like planning or research.
+3 moreshow less
Enables automatic approval of selected terminal commands (experimental).
Allows editing and resubmitting previous chat requests (experimental).
Adds scroll-on-middle-click behavior in the editor.
curl 8.15.0 adds HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer.DNS-over-HTTPSDNS-over-HTTPSA protocol that tunnels DNS queries inside encrypted HTTPS requests, hiding lookups from network observers. Cyber tools use it to evade DNS-based monitoring or filtering. transport support and new protocol options.
└──▷ GET THIS VERSION
$ git clone --branch curl-8_15_0 https://github.com/curl/curl.git
# already have the repo? check out this version:$ git checkout curl-8_15_0
└──▷ USE IT
Limit the number of retries for DNS resolution when using HTTP/3 DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring..
Adds support for DNS-over-HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. (DoH) over HTTP/3 transports via the --doh-over-http3 flag
Adds new --doh-max-retries option to control DoH retry behavior on HTTP/3
Joplin 3.4.2 adds Joplin Server SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. authentication support
SysReptor 2025.64 adds Excalidraw diagramming, custom finding statuses, PDF outline view, and richer markdown editing.
└──▷ GET THIS VERSION
$ git clone --branch 2025.64 https://github.com/Syslifters/sysreptor.git
# already have the repo? check out this version:$ git checkout 2025.64
└──▷ USE IT
Define custom finding/section statuses to match your team's workflow instead of using the defaults.
yaml
# In your SysReptor configuration (e.g. app.env or docker-compose override):
# See https://docs.sysreptor.com/setup/configuration/#custom-statuses
CUSTOM_STATUSES='{"finding": [{"id": "in-review", "label": "In Review", "color": "#FFA500"}]}'
New excalidraw plugin integrates Excalidraw diagramming directly into SysReptor.
Supports customizing finding and section statuses via configuration.
Limits publicly accessible settings exposed in API responses.
Adds option to skip restoring files when running the restorebackup command.
PDF viewer now includes a PDF outline (table of contents) view.
+2 moreshow less
Markdown editor converts pasted HTML (e.g. Excel tables, Word content) to markdown automatically.
Markdown editor adds a blockquote button to the toolbar.
Magic Transit and Magic WAN health check data is now accessible for accounts with CMB EU enabled via GraphQL API.
magicTransitTunnelHealthChecksAdaptiveGroups and magicTransitTunnelTrafficAdaptiveGroups GraphQL endpoints are compatible with the CMB EU setting.
Access to GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation., IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications., and CNI health check and traffic volume data for Magic Transit and Magic WAN customers with Customer Metadata Boundary (CMB) - Europe enabled.
Deploy to Cloudflare buttons now support passing Worker environment variables, secrets, and Secrets Store secrets during deployment
Deploy to Cloudflare button templates can now include vars, secrets, and secrets_store_secrets definitions in Wrangler config (wrangler.toml or package.json) so these values are presented to users during the dashboard deployment flow.
Support for defining secrets_store_secrets (with binding, store_id, and secret_name fields) in Wrangler configuration files within deployable templates.
Cloudflare Gateway HTTP filtering now applies to non-standard ports in open beta.
Adds Inspect on all ports setting to apply A/V scanning, DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., and file sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls. to proxied HTTP requests on any port.
Expands Gateway filtering surface beyond standard HTTP (80) and HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. (443) ports.
Virtual Cloudflare One Appliance now supports Proxmox VE in open beta for KVMKVMA Linux kernel module that turns the kernel into a hypervisor, letting a process run fully isolated virtual machines using hardware virtualisation extensions. Cyber tools use it to sandbox execution environments at near-native speed.-based branch and data center network connections.
Adds support for deploying the Virtual Cloudflare One Appliance on Proxmox VE hypervisors
Enables connecting branch or data center networks to Cloudflare WAN without dedicated hardware via the new KVM appliance option
Cloudflare Terraform provider v5.7.0 stabilizes the v5 release by adding new infrastructure management resources and fixing critical state drift issues.
WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. Release 2025-07-14 introduces new detection rules for XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. Attribute Overloading and OnToggle abuse.
Adds detection for XSS via HTML attribute overloading (Rule ID 2aa3d845, legacy 100798) to the Cloudflare Managed Ruleset, changing action from Log to Block
Adds detection for XSS via onToggle event abuse on elements like <details> (Rule ID 37548d06, legacy 100799) to the Cloudflare Managed Ruleset, changing action from Log to Block
Cloudflare Zero Trust adds eight new onboarding guides in the dashboard Get Started tab
Adds a Get Started tab to the Zero Trust dashboard containing walkthroughs for setting up common use cases end-to-end.
Includes eight specific onboarding flows: Securely access a private network, Device-to-device / mesh networking, Network to network connectivity, Secure web traffic, Secure DNS for networks, Clientless web access, Clientless SSH access, and Clientless RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. access.
Cloudflare Images now ingests HEIC input format and serves AVIFAVIFAn open image format based on the AV1 video codec, maintained by the Alliance for Open Media, offering smaller file sizes than JPEG or PNG at comparable quality — useful when a tool serves image-heavy web interfaces., WebP, JPEG, PNG
Cloudflare adds App Library for Zero Trust Dashboard to visualize SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. application status, policy references, and CASBCASBA Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. findings.
Adds App Library UI section under My Team for comprehensive visibility of SaaS applications used in Gateway policies, CASB integrations, and Access for SaaS.
Enables tracking of usage across your organization to understand user behavior for individual Applications within the App Library.
Cloudflare Access open beta for browser-based RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. with SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., and recording.
Adds open beta support for Browser-based RDP via Cloudflare Access.
Enables access recording to track user server access for compliance.
Arcade adds value schema support for tool outputs, multiple Jira cloud support, and self-service plan selection
ToolDefinition supports using Tool Output within the ValueSchema, enabling dynamic value generation based on prior tool execution results
Jira Toolkit now supports configuration against multiple Atlassian Cloud instances simultaneously
Arcade Cloud enables self-service plan selection and payment directly through the dashboard
3 details in Everything
└──▷ BREAKING ON UPGRADE
!MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Servers previously hosted in github.com/ArcadeAI/arcade-ai are now closed-source; source code is available only upon request for paying customers
3 more releases in this issue
· 2025-07-04 → 2025-07-25
Arcade 2025-07-11 splits toolkits into separate MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers and adds CLI --debug flag
Adds --debug flag to CLI commands for verbose output
Splits combined Google, Microsoft, and other Toolkits into separate MCP Servers
THE CYBER TOOLCHAIN