The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
evil-winrm-py v1.0.0: Python WinRM shell with NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent., Pass-the-Hash, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application., cert auth, and file transfer
└──▷ GET THIS VERSION
$ git clone --branch v1.0.0 https://github.com/adityatelange/evil-winrm-py.git
# already have the repo? check out this version:$ git checkout v1.0.0
New interactive shell for executing commands on remote Windows systems via WinRM.
Supports NTLM, Pass-the-Hash, Certificate, and Kerberos authentication methods.
Enables SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination.-encrypted WinRM sessions for secure communications.
Supports file upload and download between local and remote Windows machines.
Includes tab completion for remote paths, command history, and colorized output.
BloodHound v7.5.0 adds HasTrustKeys edge, Azure role ingest, custom node icons, zone-based tier management, and search highlight/zoom.
└──▷ GET THIS VERSION
$ git clone --branch v7.5.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v7.5.0
Adds new HasTrustKeys edge type for modeling Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. trust key relationships in the graph.
Ingests AZRoleManagementPolicyAssignment objects from Azure, expanding Azure attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. coverage.
Supports custom node icons in the UI for Generic Ingest custom node types.
Adds Create, Update, and Delete Tier/Zone APIs and UI controls for zone-based tier management.
Adds analysis.tiering parameter to application configuration for controlling tiering analysis behavior.
+7 moreshow less
Highlights and zooms the graph view when using Search Current Nodes on the Explore page.
Displays node type in the Entity Panel for clearer node identification.
Adds in-product help text for the AZRoleApprover edge.
Updates Generic Ingest API with finalized JSON schema and Swagger documentation.
Bundles latest AzureHound release.
Adds Created_by / Updated_by fields using email instead of user ID for better auditability.
Adds join wifi, ping scan, scan tcp, and shutdown wifi CLI commands with PMKIDPMKIDA 128-bit identifier derived from a PMK, the access point MAC, and the client MAC in WPA2 handshakes, allowing offline cracking of Wi-Fi passwords without capturing a full four-way handshake. status icons
└──▷ GET THIS VERSION
$ git clone --branch v1.7.0 https://github.com/justcallmekoko/ESP32Marauder.git
# already have the repo? check out this version:$ git checkout v1.7.0
Adds join wifi <ssid> <passphrase> command to connect the device to a Wi-Fi network
Adds ping_scan <ip_range> command to perform ICMP ping scans across a specified IP range
Adds scan_tcp <host> <ports> command to perform TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port scanning on target hosts
Adds shutdown_wifi command to disable the Wi-Fi radio via CLI
Adds status bar icons for Force PMKID detection and current Wi-Fi connection status
proxmark3 v4.20469 adds PM3ULTIMATE platform, iCLASS SAM info, tearoff simulation modes, and major iCLASS legbrute/legrec speed gains.
└──▷ GET THIS VERSION
$ git clone --branch v4.20469 https://github.com/RfidResearchGroup/proxmark3.git
# already have the repo? check out this version:$ git checkout v4.20469
└──▷ TRY IT
Retrieve SAM-specific details when working with an iCLASS SAM-based reader setup.
$ hf iclass sam --info
Speed up legacy iCLASS key recovery with fast mode and automated AA2 block selection.
$ hf iclass legrec --fast
Simulate an iCLASS card that glitches key block responses to test tearoff attack resilience.
$ hf iclass sim -t 7
Adds PM3ULTIMATE platform support in the build system and FPGA compilation.
New hf iclass sam --info option returns SAM-specific details.
New hf iclass sim -t 7 implements simulation that glitches key block responses.
New hf iclass sim -t 6 implements simulation that glitches SIO block responses.
Adds multithreading support to hf iclass legbrute for faster brute-forcing.
+11 moreshow less
Adds --sl option to hf iclass legrec for speed increase by tweaking communication delays.
Adds --fast option to hf iclass legrec for further speed increase with automated AA2 block selection.
Achieves ~147% speed increase in hf iclass legrec through additional code optimizations.
A tool that detects cell site simulators (IMSI catchers) on a cheap mobile hotspot.
Rayhunter v0.4.0 adds config file analyzer toggles, ZIP download endpoint, and TP-Link M7310 hotspot support
└──▷ GET THIS VERSION
$ git clone --branch v0.4.0 https://github.com/EFForg/rayhunter.git
# already have the repo? check out this version:$ git checkout v0.4.0
└──▷ TRY IT
Programmatically retrieve captured QMDL and PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. files as a zip archive via the API.
The open-source wireless research platform for ESP32.
GhostESP v1.6 adds IR support, BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems. spam, WPA3WPA3The third generation of the Wi-Fi Protected Access authentication and encryption standard, maintained by the Wi-Fi Alliance, offering stronger handshake protection and per-session encryption compared to WPA2. SAE flood attack, and multi-AP deauth
└──▷ GET THIS VERSION
$ git clone --branch v1.6 https://github.com/GhostESP-Revival/GhostESP.git
# already have the repo? check out this version:$ git checkout v1.6
Adds webauth on/off command to enable or disable web UI authentication
Adds FlipperZero IR file support with protocol encoders for NEC, Kaseikyo, Pioneer, RCA, Samsung, SIRC, RC5, and RC6
Adds BLE Spam capability targeting Apple, Microsoft, Samsung, and Google devices
Adds SAE Flood Attack targeting WPA3 networks
Enables Deauth Attack to target multiple APs simultaneously via select -a argument (e.g., select -a 2,3,4)
$ git clone --branch v11.50 https://github.com/v1s1t0r1sh3r3/airgeddon.git
# already have the repo? check out this version:$ git checkout v11.50
New enterprise certificate analysis feature for inspecting certs captured from WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes.-Enterprise networks
Adds DoS to the enterprise identities capture process to improve reliability of credential harvesting
Adds helper functions to simplify hooking menus and hints from plugins
New variables expose adapter support for 802.11n/802.11ac/802.11ax/802.11be standards
Evil Twin fake APs now advertise 802.11n/802.11ac/802.11ax capabilities when the adapter supports them
+1 moreshow less
Supports detection of enterprise networks that report CMAC as their authentication method
Gobuster v3.7.0 adds Host header fuzzing, TLS renegotiation, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. DNS, interface binding, and vhost exclusion filters.
└──▷ GET THIS VERSION
$ git clone --branch v3.7.0 https://github.com/OJ/gobuster.git
# already have the repo? check out this version:$ git checkout v3.7.0
└──▷ TRY IT
Bind outgoing requests to a specific interface when operating from a multi-homed host or pivoting through a specific network path.
$ gobuster dir -u https://target.example.com -w /usr/share/wordlists/dirb/common.txt --interface eth1
Use TCP for DNS queries against a server that blocks UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery., such as one behind a strict firewall.
$ gobuster dns -d example.com -w /usr/share/wordlists/subdomains.txt -r 8.8.8.8 --tcp
Adds --check-cname flag in DNS mode (replaces --show-cname) to check CNAMECNAMEA DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin. records.
Introduces --debug flag replacing --verbose for detailed logging, including logging of HTTP requests when enabled.
Supports fuzzing the Host header in fuzz mode for broader header-level attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. coverage.
Adds --interface and --local-ip parameters to bind outgoing HTTP requests to a specific network interface or IP.
Adds support for TLS renegotiation during HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. scans.
+8 moreshow less
Supports TCP protocol on DNS servers in DNS mode (previously UDP-only).
Allows excluding specific status codes and response lengths in vhost mode for cleaner result filtering.
Warns in vhost mode when --append-domain may have been forgotten, reducing common misconfiguration errors.
Warns when using vhost mode with a proxy and HTTP-based URLs where behavior may be unexpected.
Comments in wordlists (lines starting with #) are no longer silently ignored — they are now treated as entries.
Automatically disables progress output when stdout is redirected, enabling clean pipeline integration.
Adds automaxprocs support for accurate CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. limit detection when running inside Docker containers.
The version command now displays build variables for richer environment diagnostics.
13 details in Everything
└──▷ BREAKING ON UPGRADE
!The --show-cname flag in DNS mode is renamed to --check-cname; any scripts or aliases using --show-cname will break.
!The --verbose flag is removed and replaced by --debug; any scripts using --verbose will break.
!Comments in wordlists (lines starting with #) are no longer ignored and will be treated as words to enumerate; wordlists relying on # comments for exclusion will produce unexpected entries.
gitleaks v8.27.1 adds Heroku API key detection and new Bitbucket/Gitea platform support
└──▷ GET THIS VERSION
$ git clone --branch v8.27.1 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:$ git checkout v8.27.1
Adds detection rule for the new Heroku API Key format (new version pattern).
Adds Bitbucket as a supported platform for secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it..
Adds Gitea as a supported platform for secret scanning.
3 details in Everything
1 more release in this issue
· 2025-06-01 → 2025-06-08
Adds GitLab secret sync and revamps the edit role page in v0.134.0
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.134.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.134.0-postgres
Adds GitLab secret sync integration for automated secret synchronization
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!The secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. v1 queue and webhook endpoint have been removed; existing integrations relying on this endpoint will stop functioning.
9 more releases in this issue
· 2025-06-03 → 2025-06-27
Adds Cloudflare secret sync, GitHub self-serve connection, undefined tag support, and projectSlug to secrets v3 endpoints
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.133.1-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.133.1-postgres
projectSlug parameter added to secrets v3 API endpoints for project identification
Self-serve connection setup now available for the GitHub app integration
Cloudflare app connection with automatic secret synchronization supported
Auto-bootstrap support added to the Helm chart deployment
Infisical v0.133 adds GCP IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. dynamic secrets, Fly.io secret sync, new machine identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. (Alibaba, AWS-EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves.), and PITR revamp.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.133.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.133.0-postgres
Adds GCP IAM as a supported provider for Dynamic Secrets.
Introduces Fly.io Secret Sync integration for App Connections.
Enables Point-In-Time Recovery (PITR) revamp with new snapshot handling.
infisical-cli v0.41.85 adds --project-slug support for dynamic secret commands
└──▷ GET THIS VERSION
$ git clone --branch infisical-cli/v0.41.85 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical-cli/v0.41.85
Adds --project-slug flag to dynamic secret subcommands, enabling targeted credential generation and rotation without context switching
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!Flags have been converted from snake_case or camelCase to dash-case (e.g., --project_slug is now --project-slug); existing scripts using the old format will fail
Infisical v0.132.4 adds k8s metadata in template policies, assume role mode for AWS dynamic secrets, and location support for GCP sync.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.132.4-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.132.4-postgres
Enables assume role mode for AWS dynamic IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. secrets via new configuration
Adds support for syncing GCP dynamic secrets to specific locations
Includes identityName in the Dynamic Secrets userName template
Adds Vertica dynamic secrets, secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. v2 GitHub source, and {{environment}} support in key schemas
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.132.3-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.132.3-postgres
Adds vertica as a supported dynamic secret type for automated credential rotation.
Introduces the secret-scanning-v2 architecture with a new github data source for detecting secrets in repositories.
Adds {{environment}} variable support within key schemas, allowing environment-aware naming.
Updates org users table to include a filter by roles capability.
infisical-cli v0.41.8 adds gateway auth for Kubernetes identities
└──▷ GET THIS VERSION
$ git clone --branch infisical-cli/v0.41.8 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical-cli/v0.41.8
Uses the gateway as a token reviewer for identities/kubernetes-auth
Restores describeReadValue permission to default roles and adds role sorting in user/identity views.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.132.2-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.132.2-postgres
infisical-cli v0.41.6 adds automatic session renewal and new background spawn logic
└──▷ GET THIS VERSION
$ git clone --branch infisical-cli/v0.41.6 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical-cli/v0.41.6
Adds infisical login behavior to automatically re-authenticate when a session expires or becomes invalid, reducing manual intervention.
Changes infisical login to spawn a new session process instead of overwriting the current one, improving reliability.
Adds MySQL secret rotation v2, dynamic secret username templates, and an organizations overview UI for infrastructure management
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.132.1-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.132.1-postgres
Adds feat(secret-rotation): MySQL Secret Rotation v2 to rotate MySQL credentials automatically
Introduces Feat/dynamic secret username template for generating dynamic usernames in secrets
Adds organizations overview and control under instance-management for managing infrastructure at scale
Detection Engine 2.141 adds secret detectors and validity checkers for Kubernetes certificates, AI services, and other platforms.
Adds Kubernetes User Certificate with Port detector that extracts port numbers for Kubernetes user certificates
Adds NVIDIA API Key detector for NVIDIA services
Adds Alchemy API Key v2 detector for Alchemy services
Adds OpenRouter API Key detector for OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code. services
Adds Duffel API Key detector for Duffel services
+12 moreshow less
Adds Apify Token detector for Apify services
Adds Jina API Key detector for Jina services
Adds Deno Account Token detector for Deno accounts
Adds Segment Workspace Key v2 detector for Segment services
Adds Resend API Key detector for Resend services
Adds VKontakte Access Token detector for VKontakte services
Adds Fireworks AI API Key detector for Fireworks AI services
Improves Generic High Entropy Secret detector by removing AWS ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. images from misclassified secrets
Improves Google OAuth2 Keys detector with updated regex for better detection accuracy
Improves Checkout Sandbox Secret Key detector with enhanced pattern and updated endpoint for improved accuracy
Improves Bunny.net API Key detector by fixing checker for better validation
Improves Dify API Key detector by updating checker endpoint for enhanced detection
17 details in Everything
1 more release in this issue
· 2025-06-10 → 2025-06-16
Detection Engine v2.140 adds 12 new detectors for GitLab, K8s JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store., Laravel keys and AI services.
Adds detection for Laravel Encryption Key with Host
Adds detection for Kubernetes JWT with Host
Adds detection for GitLab Feature Flags Client Token with Project ID
Adds detection for GitLab Trigger Token
Adds detection for Brave Search API Key
+8 moreshow less
Adds detection for GitLab Deploy Token
Adds detection for Firecrawl API Key
Adds detection for Dify API Key
Adds detection for GitLab Runner Authentication Token
Adds detection for Ubidots API Key
Adds detection for Vapi API Key
Adds detection for Llama Cloud API Key
Enhances Azure Cosmos DB credentials detector with improved host pattern for higher recall
GitGuardian SaaS adds historical secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. for Confluence Data Center
Enables historical secret scanning for Confluence Data Center, surfacing secrets leaked in past content rather than only real-time detections.
Enhances Jira Data Center integration to include leaker email addresses in incident creation for historical comment occurrences.
2 details in Everything
1 more release in this issue
· 2025-06-19 → 2025-06-30
GitGuardian MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. releases for AI IDEs; Custom Tags API adds key/value filtering.
Releases the GitGuardian MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server on GitHub to bring security scanning and incident management into Cursor, Windsurf, and other Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.-compatible IDEs
Enhances the custom tags filter in the public API to support filtering by key/value pairs in addition to IDs
GitGuardian 2025.6 adds secret detection for Teams, Container Registries, Jira/Confluence history, and Splunk/Loki/Datadog log export.
Adds Microsoft Teams integration for real-time and historical secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. in messages
Adds Jira Cloud and Confluence Cloud historical scanning to detect past secrets
Adds Container Registries secret detection for Azure, Google, JFrog, and DockerHub
Enables Self-Hosted export of logs to Splunk, Loki, Elasticsearch, Kafka, and Datadog
Adds secure API access to secret values via a new endpoint for automation workflows
+3 moreshow less
Adds Kubernetes constraint configuration to limit workers to one per node in deployments
Updates ggscout minimum version requirement to 0.16.6
Requires Kubernetes 1.28 as the new minimum supported version
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Kubernetes 1.27 is no longer supported; clusters must run at least 1.28
!ggscout versions below 0.16.6 are incompatible and must be upgraded
OpenBao v2.3.1 adds KMIP auto-unseal, full namespaces support (CLI/API/UI), CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. for PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets./roles, and unauthenticated rekey disable listener param
└──▷ GET THIS VERSION
$ git clone --branch v2.3.1 https://github.com/openbao/openbao.git
# already have the repo? check out this version:$ git checkout v2.3.1
disable_unauthed_rekey_endpoints (listener config, default: false) to disable unauthenticated rekey operations on sys/rekey/* and sys/rekey-recovery-key/* endpoints.
Adds KMIP Auto-Unseal capability to automatically unseal OpenBao using the KMIP protocol.
Namespace feature with full lifecycle management (create, read, update, delete), isolated secrets engines/auth methods, remounting between namespaces, and locking/unlocking.
X-Vault-Namespace header support for routing requests to specific namespaces alongside path-based routing.
bao namespace CLI subcommands and -namespace flag for programmatic namespace operations.
+4 moreshow less
Namespaces UI Support including a new namespace picker and namespace management pages in the console.
Common Expression Language (CEL) support in PKI for dynamic certificate policies and complex validation.
CEL login roles support in auth/jwt for flexible claim validation and arbitrary templating of logical.Auth data.
Support for multiple certificate issuers in SSH secret engine mounts to enable safer rotation of SSH CA key material.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!Illumos build support removed from the release due to broken builds.
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. agent 4.67.0 adds support for CentOS Stream 10, RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 10, and Alpine Linux 3.22 on x86_64 and arm64.
Fastly Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. for Java 2.8.1 adds ARM64ARM64A 64-bit CPU architecture from ARM Holdings, used in mobile chips, Apple Silicon, and cloud servers; cyber tools target it to run natively on those platforms instead of relying on emulation. support for the shaded JAR.
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. metrics now aggregate Edge and Core WAF counts in Historical Stats API
Socket Dashboard now supports viewing Diff Scans directly by ID via a new dedicated page and API routes.
Adds a dedicated page on the Socket Dashboard to view diff scans using their unique Diff Scan ID
Updates internal URLs in the API and GitHub app to link to the new diff scan route
Enables tracking and sharing of diff scans as standalone resources powered by stored multi-SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. data
3 details in Everything
12 more releases in this issue
· 2025-06-02 → 2025-06-26
Socket MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. is now available as a hosted service on https://mcp.socket.dev for direct client integration.
Adds the option to use the Socket MCP server via the hosted service at https://mcp.socket.dev instead of running it locally.
Socket adds support for analyzing pylock.toml (PEP 751PEP 751A draft Python packaging standard that defines a lock file format for recording exact dependency versions, giving cyber tools a reproducible, machine-readable way to pin their dependency trees.) Python lock files
Supports pylock.toml (PEP 751) Python lock file format for secure, reproducible builds and hash-based security analysis
Apiiro maps an application's architecture and risk graph and runs AI-SAST, SCA, secrets, API and threat-modeling checks on AI- and human-written code.
Apiiro adds malicious open-source package detection with automated PR blocking
Adds detection of malicious open-source packages with detailed malware information in Apiiro’s SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. solution
Enables automatic safeguard workflows to block malicious packages in pull requests
Nexus Repository 3.81.1 moves metrics endpoints to /service/rest/metrics and fixes NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. restore.
Moves all metrics REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints under the /service/rest/metrics prefix (e.g., /service/rest/metrics/prometheus, /service/rest/metrics/data).
1 detail in Everything
1 more release in this issue
· 2025-06-10 → 2025-06-11
Nexus Repository 3.81.0 adds egress monitoring in Licensing Usage tab and Zscaler integration for Repository Firewall.
Adds Total Egress data to the Usage tab under Settings > System > Licensing for on-prem instances
Integrates Sonatype Repository Firewall with Zscaler for malware protection
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Dropwizard metrics org_eclipse_jetty_webapp_WebAppContext_2xx_responses_total are removed and replaced by org_eclipse_jetty_ee8_nested_ContextHandler_CoreContextHandler_2xx_responses_total and org_eclipse_jetty_ee8_nested_ContextHandler_CoreContextHandler_requests_count
!Customized Jetty configuration must be updated due to the upgrade from Jetty 9 to Jetty 12
cosign v2.5.1 adds Rekor v2 support and TUF v2 client to trusted-root create, plus relaxed private PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. validation.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.1 https://github.com/sigstore/cosign.git
# already have the repo? check out this version:$ git checkout v2.5.1
Adds Rekor v2 support to the trusted-root create command.
Adds --base-url and --uri flags to the trusted-root create command.
Upgrades to TUF v2 client with trusted root.
Skips SCT verification for private PKI certificates.
Relaxes EKU chain validation rules for TSA (Timestamp Authority) certificates.
v0.13 introduces comprehensive CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. API endpoints and Vue.js component architecture overhaul with enhanced billing system
└──▷ GET THIS VERSION
$ git clone --branch v0.13 https://github.com/sbomify/sbomify.git
# already have the repo? check out this version:$ git checkout v0.13
Migrated from Django views to modern REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints for all CRUD operations on Products, Projects, and Components
Implemented standardized API schemas and validation for the new REST API
Added reusable Vue.js components including StandardCard.vue, StatCard.vue, and SbomsTable.vue with advanced filtering
3 details in Everything
1 more release in this issue
· 2025-06-20 → 2025-06-25
SBOMify v0.12 adds OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories.-powered CVE scanning, SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. license validation, and new license management API endpoints
└──▷ GET THIS VERSION
$ git clone --branch v0.12 https://github.com/sbomify/sbomify.git
# already have the repo? check out this version:$ git checkout v0.12
└──▷ HOW TO FIND IT
Scan an uploaded SBOM for known vulnerabilities using the new OSV integration
📍Navigate to the Vulnerability Dashboard in the UI after uploading a new SBOM to view severity scores and details.
CVE integration using the OSV database for automated vulnerability scanning of SBOM components
Real-time validation of complex license expressions against SPDX standards
LavaMoat webpack plugin hits v1.0.0 with scuttling, lazy-chunk protection, context-module support, and hardened defaults.
└──▷ GET THIS VERSION
$ git clone --branch webpack-v1.0.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout webpack-v1.0.0
└──▷ USE IT
Harden a webpack bundle by enabling scuttling to prevent dependency packages from accessing or mutating privileged globals.
New @lavamoat/react-native-lockdown beta brings SES-based runtime hardening to React Native apps.
└──▷ GET THIS VERSION
$ git clone --branch react-native-lockdown-v0.0.1 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout react-native-lockdown-v0.0.1
Introduces @lavamoat/react-native-lockdown, a new LavaMoat library that applies SES (Secure ECMAScript) lockdown to React Native environments.
Ships with a vendored SES build, making the lockdown self-contained without relying on an external SES package.
LavaMoat core adds Node.js scuttling support and relaxes scuttling to skip intrinsics, reducing false-positive lockdowns.
└──▷ GET THIS VERSION
$ git clone --branch lavamoat-core-v16.5.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout lavamoat-core-v16.5.0
Adds scuttling support for Node.js environments, extending runtime prototype-pollution defenses to Node targets.
Relaxes scuttling by skipping JavaScript intrinsics, reducing breakage when hardening globals without affecting built-in objects.
Snyk Essentials announces a gradual Enterprise rollout of automatic Bitbucket repository discovery from July 16, 2025.
Adds automatic discovery for Bitbucket Cloud, Cloud App, and Server organization-level integrations, including brokered setups, for users without a configured Essentials Group-level integration.
1 detail in Everything
5 more releases in this issue
· 2025-06-04 → 2025-06-26
Snyk Code Consistent Ignores GA ensures ignores are respected in IDE plugins, CLI, and PR checks
Makes Snyk Code Consistent Ignores generally available for all Snyk Code customers; existing Groups and Orgs can enable it in settings, while newly created Groups and Orgs have it enabled by default.
Snyk announces improved Maven default-profile activation for Open Source SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. scanning, rolling out July 9.
Improves Maven dependency resolution in Open Source SCM scans to follow local Maven profile activation rather than considering only activeByDefault=true profiles.
June 30, 20259 releases · 2025-06-09 → 2025-06-30Stable
Export web applications from EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. as DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. candidates to enable direct scanning in DAST Essentials
8 more releases in this issue
· 2025-06-09 → 2025-06-30
Adds the ability to export web application assets from EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. into DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Essentials for targeted scanning.
Adds the capability to mark discovered EASM assets as DAST Candidates to create scan targets in DAST Essentials
Adds an export workflow allowing web applications identified in EASM to be transferred directly into the DAST Essentials engine
Veracode Fix gains COBOL support with suggested fixes and CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. detection
└──▷ HOW TO FIND IT
View suggested fixes for COBOL vulnerabilities directly in Visual Studio Code during development.
📍In VS Code, open a COBOL file with detected issues; click the lightbulb icon to see suggested fixes provided by Veracode Fix.
Adds suggested_fixes for COBOL in Veracode Fix
Detects CWE-78, 209, 248, 489, and 252 in COBOL code
Enables COBOL support in the Veracode CLI
Enables COBOL support in IDEs (VS Code, Visual Studio, JetBrains)
Veracode Fix adds COBOL support with new detections and CLI/IDE availability
Adds suggested fix generation for COBOL source code in Veracode Fix
Adds CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. coverage (78, 209, 248, 489, 252) specifically for COBOL analysis
Reporting REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. Scans object last_updated_date now includes post-publish scan name changes
Updates last_updated_date in the Reporting REST API Scans object to include modifications made to scans after they have been published.
Ensures last_updated_date reflects updates to scan names.
VS Code extension adds app profile search, SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. paging, node_modules exclusion, and improved error logging
Adds the ability to search application profiles directly within the VS Code IDE
Excludes node_modules files from scan searches by default
Adds paging support to ensure all flaws are fetched during scans
Displays custom error messages when no supported package manager or build system is detected during SCA agent scans
Veracode DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Enterprise mode now supports downloadable scan reports.
└──▷ HOW TO FIND IT
Download the latest report for a completed DAST Enterprise scan to review findings offline.
📍In the console, navigate to Scans › Select your DAST Enterprise scan › Reports tab › click Download
Veracode DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Enterprise mode adds support for downloadable scan reports to improve visibility.
Openlayer adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, automatic test thresholds, BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. integration, anomaly detection, and project-level access groups.
Releases the Openlayer MCP server for IDE workflows
Adds automatic threshold option for tests in the app UI
Introduces anomaly detection to flag test results deviating from automatic thresholds
Supports creating tests via API
Adds direct BigQuery integration for continuous data quality monitoring
Mend SAST 25.5.2-HF1 adds DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. correlation for Exploitable findings and AI code scanning via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server.
Correlates SAST findings with Invicti DAST results, marking confirmed vulnerabilities with the Exploitable risk factor
Mend SAST v25.5.2-HF1 adds Invicti DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. correlation for exploitable findings and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server scanning with Cursor IDE support.
Correlates SAST findings with dynamic analysis results from the Invicti integration, marking confirmed vulnerabilities with an Exploitable risk factor to prioritize remediation
Enables scanning of AI-generated code via the MCP server, with optimized integration for the Cursor IDE to maintain secure coding practices within existing workflows
Mend SAST 25.5.2 adds Code Risk Factors to workflow conditions, OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 templates, and CLI-based secrets detection.
Code Risk Factors column and workflow condition support allows prioritizing findings by endpoint access or high-probability risk
New workflow templates for OWASP Top 10 2021, SANS/CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. Top 25, and PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. standards
C# parser runtime environment updated to .NET 8.0
Added detection for CWE-208, CWE-256, and CWE-352 in Java
Enhanced detection accuracy for CWE-79 (XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session./DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime.-based XSS) in JavaScript/TypeScript and CWE-89 (SQL Injection) in Java
+1 moreshow less
Scan source code and configuration files for exposed credentials with new CLI flag --secrets-detection
GitLab 18.1 introduces Maven virtual registry beta, new GraphQL filter, SLSASLSASupply-chain Levels for Software Artifacts, a framework for assessing how software was built and protecting that process from tampering. Provenance records help verify where a build came from. compliance components, and PHP SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. support.
Adds Maven virtual registry in beta for aggregating upstream repositories behind a single endpoint
Adds accessLevels argument to projectMembers field in GraphQL API
Enables SLSA Level 1 compliance via new CI/CD components wrapping Sigstore Cosign
Adds PHP support to Advanced SAST
Adds variables_override configuration option for pipeline execution policies
DeepSource SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. adds native support for Bun and uv package managers via new discovery triggers.
Adds Bun package manager support in DeepSource SCA for JavaScript projects.
Adds uv package manager support in DeepSource SCA for Python projects.
AFL++ v4.33c adds hidden edge instrumentation, a faster afl-cmin.py, QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. block coverage, and a new desocketing library.
└──▷ GET THIS VERSION
$ git clone --branch v4.33c https://github.com/AFLplusplus/AFLplusplus.git
# already have the repo? check out this version:$ git checkout v4.33c
Adds AFL_PRELOAD_DISCRIMINATE_FORKSERVER_PARENT env var to selectively disable fork when using AFL_PRELOAD.
Adds color output for NO_UI mode in afl-fuzz.
Instruments previously missed hidden edges in PCGUARD plugin (~5% more edges covered vs prior AFL++; ~8% more vs LLVM sancov).
Adds AFL_EXITPOINT support in qemuafl for controlling exit points in QEMU mode.
Adds AFL_QEMU_BLOCK_COV block coverage support in qemuafl.
+4 moreshow less
Adds improved MIPSMIPSA RISC processor architecture originally developed at Stanford and commercialized by MIPS Technologies, widely used in embedded and network devices; cyber tools target it to analyze or exploit routers, cameras, and similar hardware. persistent mode support in qemuafl.
Introduces new faster afl-cmin.py script, now invoked automatically by afl-cmin when Python is available.
Enables full Nyx mode support in afl-cmin for corpus minimization of large targets (previously lost coverage due to fixed map size).
Introduces new desocketing library utils/libaflppdesock for targets where other desocketing approaches fail.
jwt-hack v2.0.0 adds PS and ES algorithm cracking to crack command
└──▷ GET THIS VERSION
$ git clone --branch v2.0.0 https://github.com/hahwul/jwt-hack.git
# already have the repo? check out this version:$ git checkout v2.0.0
crack subcommand now supports cracking JSON Web Tokens using RSASSA-PSS (PS) and ECDSAECDSAThe elliptic-curve signature algorithm behind most TLS certificates, blockchains and many hardware keys. It is one of the algorithms post-quantum signatures are meant to replace. (ES) signature algorithms
New SQL Injection detection module that tests JWT claims for SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. attack vectors
sslscan 2.2.0 adds post-quantum key exchangepost-quantum key exchangeA cryptographic handshake algorithm designed to resist attacks from quantum computers, using math problems like lattices that quantum algorithms cannot efficiently solve, letting tools stay secure against future quantum-capable adversaries. detection and updated cipher/algorithm colouring.
└──▷ GET THIS VERSION
$ git clone --branch 2.2.0 https://github.com/rbsec/sslscan.git
# already have the repo? check out this version:$ git checkout 2.2.0
Supports scanning post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. key exchange groups such as X25519MLKEM768.
Updated colouring of ciphers and algorithms for clearer visual grading of scan results.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Building sslscan now requires a minimum OpenSSL version of 3.5.0 (LTS); distros shipping older OpenSSL versions must use static builds or upgrade.
Juice Shop v18 adds a new Leaked API Key challenge, a DEF CON 33 theme, and a metrics user-agent config option.
└──▷ GET THIS VERSION
$ git clone --branch v18.0.0 https://github.com/juice-shop/juice-shop.git
# already have the repo? check out this version:$ git checkout v18.0.0
└──▷ TRY IT
Run Juice Shop with the DEF CON 33 theme for a themed CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. event.
$ NODE_ENV=defcon33 npm start
Adds new five-star _Leaked API Key_ challenge for advanced CTF/training scenarios.
Adds full-conversion DEF CON 33 theme activatable via NODE_ENV=defcon33 npm start.
Adds metricsIgnoredUserAgents config option to control which monitoring agents count toward challenge tracking.
Adds ftp/package-lock.json to make Vulnerable Components category challenges more accessible.
Switches XML parser from libxmljs to libxmljs2, supporting up to at least Node.js 24.
+1 moreshow less
Official Docker image now uses Node.js 22.x base images.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Node.js 18.x is no longer supported; packaged distributions for 18.x are no longer provided — upgrade to Node.js 20.x or 22.x before upgrading Juice Shop.
!The _Cross-Site Imaging_ challenge now uses https://cataas.com/ instead of http://placecats.com/, which will break existing CTF solution guides and canned setups that reference the old service.
humble 1.50 adds 9 new fingerprint headers, a first-insecure-CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks.-nonce detector, and an enhanced HTML/PDF export.
└──▷ GET THIS VERSION
$ git clone --branch 1.50 https://github.com/rfc-st/humble.git
# already have the repo? check out this version:$ git checkout 1.50
Adds 9 new fingerprint headers to the detection ruleset (added across multiple commits).
Displays the first incorrect/insecure CSP nonce found after analysis, pinpointing misconfigured nonce usage.
Adds 1 new insecure HTTP header check to the analysis engine.
Enhances HTML export output for richer reporting.
Significantly improves spacing and layout when exporting analysis results to PDF.
+1 moreshow less
Improves CSP unsafe-eval and unsafe-inline checks for more accurate detection.
jadx v1.5.2 adds DEX v41 support, a new HexViewer, tree-structure usage search, APKM support, and a Frida snippet dialog.
└──▷ GET THIS VERSION
$ git clone --branch v1.5.2 https://github.com/skylot/jadx.git
# already have the repo? check out this version:$ git checkout v1.5.2
Adds initial support for DEX v41 format, enabling decompilation of newer Android bytecode.
New HexViewer for inspecting binary content directly within the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..
New tree-structure usage search for visualizing where classes, methods, and fields are referenced hierarchically.
Adds export dialog with configurable options, including Gradle export templates for Android app/lib and simple Java projects.
Adds APKM file format support for opening split-APK bundles.
+21 moreshow less
Adds a Preview Tab feature for quick inline inspection of code and resources without fully opening them.
Supports APK Signature Scheme v3.1 signers in the GUI.
Dynamic code editor theme now follows the UI theme automatically.
Adds a dialog for selecting methods when generating Frida class snippets.
Adds Copy All button to the Search dialog for bulk export of search results.
Adds webp image preview support for resource inspection.
Adds support for viewing and opening more resource file types.
Adds script rename feature and confirm dialog when removing scripts.
Adds button to install a desktop file directly from jadx-gui.
Adds option to disable the hover tooltip in the code editor.
Adds Close all left tabs feature for tab management.
Uses file headers to detect extensions for obfuscated resources.
Custom zip reader implementation to handle tampered or non-standard ZIP files.
Parses and uses Kotlin SourceDebugExtension with SMAP for improved class and package renaming.
Adds unload method to JadxPlugin API for plugin lifecycle management.
New plugin API method to add popup menu entries for tree nodes.
Adds plugin API method to get jadx-gui icons by name.
Adds plugin API method to open the usage dialog programmatically.
Generates missing throws declarations and validates exceptions during decompilation.
Replaces constants in annotations of method arguments for cleaner decompiled output.
Notifies user if code contains non-displayable characters with the current font.
Finite State adds universal third-party security scan import from 161 tools via UI upload
Adds support for importing findings from 161 third-party security scanning tools including SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces., container, and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scanners
Adds a new Universal Scan Import interface in the UI for selecting scan types and uploading results with real-time progress tracking
Supports major file formats (JSON, XML, CSV, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface.) for third-party security tool integration
Frida 17.2.0 adds frida-pm CLI and PackageManager API for discovering and installing Frida-specific packages.
frida-pm search command with keywords:frida-gum filter to find Frida-specific packages without Node.js dependency.
frida-pm install <pkg> subcommand to install packages in one command, working without Node.js installed.
New frida-core.h API surface: frida_package_manager_new(), frida_package_install_options_new(), and frida_package_manager_install_sync() for C-based package management.
3 details in Everything
1 more release in this issue
· 2025-06-06 → 2025-06-18
Refinery 0.8.19 adds MSILMSILMicrosoft Intermediate Language, the CPU-agnostic bytecode that .NET compilers produce before the JIT compiler translates it to native code, giving cyber tools a stable target for .NET binary analysis and instrumentation. disassembly (dnasm/dnopc), Access DB extraction (xtxs), image units (imgdb/imgtp), and filtering (iffc).
└──▷ GET THIS VERSION
$ git clone --branch 0.8.19 https://github.com/binref/refinery.git
# already have the repo? check out this version:$ git checkout 0.8.19
Adds dnasm unit for MSIL disassembly
Adds dnopc unit for MSIL disassembly
Adds iffc unit for filtering chunks by size constraints
Adds xtxs unit for extracting data from Microsoft Access databases
Adds b2f unit as a shortcut for pick ::-1
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The transposition option in stego has been removed.
!The HKDF key derivation unit is now lowercase (hkdf); using the old capitalization will fail.
x64dbg gains AVX-512, bitfield/enum type system, half-float dump support, and Copy Graph Image in its first CalVer release.
└──▷ GET THIS VERSION
$ git clone --branch 2025.06.30 https://github.com/x64dbg/x64dbg.git
# already have the repo? check out this version:$ git checkout 2025.06.30
Adds bitfield, enum, and anonymous type support to the type system, enabling all Windows SDK types to be represented and displayed in the struct widget.
Introduces interactive type selection in the struct widget — live preview of data as you choose a type.
Character arrays are now automatically rendered as strings in the struct/dump view.
Adds Display type action directly from the register and stack views for on-the-fly data inspection.
Adds Type Reload functionality in the Struct View.
+16 moreshow less
Supports AVX-512 instruction set for debugging modern high-performance and complex code.
Adds half-precision (16-bit) float display support in the dump view, useful for graphics and ML model reversing.
New Copy Graph Image option copies the function graph directly to the clipboard.
New context menu option to copy calling convention arguments for documenting or reconstructing function calls.
Adds Focus on Window action in the Handles view to bring a target window to the foreground.
Revamped launcher with checkboxes and an uninstall option.
Adds headless mode proof-of-concept for automated/scriptable debugging workflows.
Migrated build system to Visual Studio 2022 and CMake, reducing compilation to a single step.
Switches to CalVer (Calendar Versioning) with proper GitHub releases and tags for easier package manager integration.
Drastic performance improvements to the struct widget for browsing deeply nested pointers and large data structures.
Configurable default maximum pointer depth in the DisplayType command.
Adds DisplayTypeDialog for improved type-display UX.
Improved plugin loading error messages.
Adds selectionChanged signal to SearchListView for plugin/extension authors.
Adds $ prefix to commands to format the command itself in scripts.
Adds string expression functions to the expression engine.
21 details in Everything
└──▷ BREAKING ON UPGRADE
!Windows XP is no longer supported.
!Windows 7 and 8.1 users will receive an unskippable deprecation warning on launch.
capa v9.2.0 adds VMRay support for non-PE/ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. files and 22 new detection rules including exploit gadget and anti-forensic coverage.
└──▷ GET THIS VERSION
$ git clone --branch v9.2.0 https://github.com/mandiant/capa.git
# already have the repo? check out this version:$ git checkout v9.2.0
Supports VMRay analysis of non-PE/ELF file types (e.g., .docx), expanding dynamic analysis beyond traditional executables.
Adds 22 new rules covering socket communication, TripleDES encryption in .NET, Chaskey/Speck encryption, Donut loader shellcode, exploit gadget enumeration (NtQuerySystemInformation, NtFsControlFile), Windows Defender/firewall/Device Guard registry tampering, minifilter driver unloading, and Sysmon anti-forensic unloading.
Cortex-Analyzers 3.5.18 migrates the BitcoinAbuse analyzer to the new ChainAbuse platform.
└──▷ GET THIS VERSION
$ git clone --branch 3.5.18 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.5.18
1 more release in this issue
· 2025-06-13 → 2025-06-23
Cortex-Analyzers 3.5.17 adds an n8n responder for workflow automation integration.
└──▷ GET THIS VERSION
$ git clone --branch 3.5.17 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.5.17
Adds the n8n responder, enabling Cortex to trigger n8n workflows as a response action.
Adds low and informational analytics BIOCs/Alerts for phishing, SCCM registration, and SQL commands.
Added two new Low Analytics BIOCs: 'Office process spawned with suspicious command-line arguments' and Okta FastPass reported phishing attack suspected
Added a new Informational Analytics BIOC: Uncommon SQL like command line
Added a new Informational Analytics Alert: 'Microsoft Configuration Manager device registration and policy request'
Adds Potential DCSync by an unusual user and Uncommon access to cloud platforms sensitive files by a scripting engine' BIOCs
Improved logic of 7 High Analytics BIOCs including Copy a process memory file and Memory dumping with comsvcs.dll
Improved logic of 35 Medium Analytics BIOCs including 'Execution of the Hydra Linux password brute-force tool' and PowerShell runs suspicious base64-encoded commands
Improved logic of 101 Low Analytics BIOCs covering techniques like SUID/GUID permission discovery and Unusual AWS credentials creation
Improved logic of 5 Low Analytics Alerts for scenarios like Failed Connections and Multiple discovery commands
Improved logic of 90 Informational Analytics BIOCs covering behaviors like 'A LOLBIN was copied to a different location' and 'Cloud Unusual Instance Metadata Service (IMDS) access'
+5 moreshow less
Improved logic of 7 Informational Analytics Alerts for events such as Massive file activity abnormal to process and Port Scan
Changed metadata of 3 Low Analytics BIOCs related to email safety indicators
Changed metadata of a Low Analytics Alert for Risk indicators detected in email
Changed metadata of 19 Informational Analytics BIOCs for email URL and attachment checks
Changed metadata of an Informational Analytics Alert for Suspicious theme and sentiment in email
Prisma Cloud adds AESCSF V2 compliance benchmark and updates RQL policy coverage for AWS ElastiCache, Azure Storage, and GCP PostgreSQL.
Adds support for the Australian Energy Sector Cyber Security Framework (AESCSF) V2 as a new built-in compliance standard accessible via Compliance > Standards
Updates the AWS ElastiCache Redis cluster with Redis AUTH feature disabled policy RQL to include RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. Auth exclusion logic
Updates the Azure Storage Account default network access is set to 'Allow' policy RQL to handle missing publicNetworkAccess attributes
Sophos Firewall 21.5 adds NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. Essentials ML threat detection, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., NAT64, and doubles route-based IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. tunnel capacity.
└──▷ HOW TO FIND IT
Configure Microsoft Entra ID SSO for remote access VPN so users authenticate to IPsec or SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. VPN using their cloud AD credentials via Sophos Connect 2.4.
📍In the Sophos Firewall web admin console, go to Authentication › Servers, add a Microsoft Entra ID (Azure AD) server, configure your OAuth 2.0 / OpenID Connect tenant details, then assign it to your SSL VPN or IPsec remote access VPN policy and instruct users to upgrade Sophos Connect to v2.4 or later.
Integrates Sophos NDR Essentials under Active Threat Response, using cloud-hosted ML engines including Encrypted Payload Analysis (no TLS decryption required) and a Domain Generation Algorithm engine to detect active adversaries — available in the Xstream Protection bundle for XGS Series firewalls.
Extends Microsoft Entra ID (Azure AD) SSO via OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. and OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. to the Sophos Connect client (v2.4+, Windows) and VPN portal for remote access IPsec and SSL VPN tunnels.
Adds a Control Center widget for DNS Protection status, enhanced troubleshooting logs and notification emails, and Sophos Assistant guided configuration steps for Sophos DNS Protection.
Increases SD-RED scalability to 1,000 site-to-site RED tunnels and 650 SD-RED devices.
Adds NAT64 support for IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only.-to-IPv4 traffic in explicit proxy mode, enabling IPv6-only clients to reach IPv4 websites, with IPv4 upstream proxy support for IPv6-only clients.
+7 moreshow less
Adds a configurable request (upload) file size limit in WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. (Web Application Firewall) with scanning support for files up to 1 GB.
Adds real-time telemetry gathering with secure hash validation to flag unexpected changes to core OS files (Secure by Design).
Adds Path MTU Discovery in DPI mode — the deep packet inspection engine now automatically detects and adjusts MTU per flow, resolving connection errors caused by ML-KEMML-KEMNIST's post-quantum key-exchange standard (FIPS 203), formerly Kyber. Two parties use it to agree on a shared secret, usually alongside X25519 in a hybrid TLS handshake. (KyberKyberNIST's post-quantum key-exchange standard (FIPS 203), formerly Kyber. Two parties use it to agree on a shared secret, usually alongside X25519 in a hybrid TLS handshake.) key exchange.
Removes RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed. restrictions from virtual, software, Cloud BYOL, and Firewall Home edition licenses; instances are now restricted only by CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. core count.
Extends DHCP prefix delegation to support /48 to /64 prefixes, with Router Advertisements (RA) and DHCPv6 server enabled by default.
Adds resizable table columns (with browser-memory persistence) to SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. routes and profiles, NAT rules, SSL/TLS inspection rules, Hosts and services, and Site-to-site IPsec VPN views.
Extends SD-WAN route free-text search to include route name, ID, objects, and object values (IP addresses, domains); adds content-based object name and value search to Local ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. exception rules.
12 details in Everything
└──▷ BREAKING ON UPGRADE
!XG and SG Series hardware appliances are no longer supported in SFOS 21.0 GA and later, including SFOS 21.5 GA.
!Site-to-site IPsec VPN connection type Site-to-site has been renamed to Policy-based and Tunnel interface has been renamed to Route-based (Tunnel interface) — existing configurations referencing these labels must be updated.
!Default firewall rules and the default rule group created during new firewall setup have been removed; only the default network rule and MTA rule remain in new deployments, and the default firewall rule group is now set to None.
!Default gateway probing for custom gateways is now set to None (previously had a non-None default).
Aviatrix CoPilot 4.22.0 adds Megaport MVE GA support, egress protection workflow, and alert notification bulk actions
Megaport Virtual Edge (MVE) is now a General Availability feature for Edge Transit Gateways when used with Controller release 8.0.
Adds the ability to perform bulk actions on alert notifications in the CoPilot UI.
Adds an Actions list and a Views list to the Alert Notifications interface.
Updates the Details pane for alerts in the Notification feature.
Distributed Cloud Firewall (DCF) is now enabled by default in CoPilot without an additional license or cost.
+5 moreshow less
Network Insights API is now enabled by default in CoPilot without an additional license or cost.
The Add-On Features list has been removed from Settings > Configuration > License due to the licensing change for DCF and Network Insights API.
Network Insights API, Cost IQ, and Billing Insights (legacy) can be turned on or off from Settings > Configuration > General.
Distributed Cloud Firewall can be turned on or off from Distributed Cloud Firewall > Settings.
The Egress Protection Workflow automatically creates SmartGroups and WebGroups for VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules./VNets and trusted domains when protection is enabled.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!The Add-On Features list has been removed from Settings > Configuration > License.
Sophos Email Security 2025.23 adds QR code scanning, SophosLabs reporting, BEC protection, and VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. impersonation management
└──▷ HOW TO FIND IT
View SophosLabs verdicts on reported messages via the report interface
📍Navigate to Reports › SophosLabs Analysis Report in the console
Manage VIP lists to refine impersonation protection policies
📍Go to Protection Settings › Impersonation Protection › VIP Lists to add or remove entries
Enables scanning of messages for malicious URLs and QR codes pointing to unsafe websites, malware, ransomware, or phishing sites
Adds SophosLabs Analysis Report providing verdicts on messages reported as threats or clean by users or admins
Introduces Business Email Compromise protection to manage defenses against account compromise and impersonation attacks
Adds capability to manage internal and external VIP lists for improved impersonation protection
Rspamd 3.12.0 adds Contextal platform integration, HEIC file detection, new email rules, fuzzy server routing, and WebUI enhancements.
└──▷ GET THIS VERSION
$ git clone --branch 3.12.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:$ git checkout 3.12.0
└──▷ TRY IT
Show only non-default (locally overridden) configuration values to audit your local changes against shipped defaults.
$ rspamadm configdump --non-default
Upload an .eml file directly in the WebUI to test selectors against a real message without copy-pasting.
📍In the Rspamd WebUI, go to Test selectors, then click the file upload control to select a local .eml file and evaluate selectors against it.
New plugin to integrate with the Contextal platform for advanced content analysis.
Adds detection support for HEIC image files via the magic module.
New R_HTTP_URL_IN_FROM rule to detect HTTP URLs in the From header.
New FREEMAIL_REPLYTO_NEQ_FROM rule to flag mismatched freemail Reply-To and From addresses.
Adds Sieve and cPanel forwarding symbols for improved forwarding detection.
+9 moreshow less
Supports CDB format for external maps.
Allows specifying the Redis protocol version in configuration.
Allows routing fuzzy operations to different servers per operation type.
Adds exclusion list support for the reputation plugin.
New --non-default option for rspamadm configdump to show only locally overridden configuration.
Replies module now considers all recipients and uses SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure.-level ones for improved tracking.
WebUI gains a Delete hash button and dedicated UI for deleting specific fuzzy hashes.
WebUI Test selectors panel now supports file upload for selector testing.
Improved maps status visibility in the WebUI Maps table.
Suricata 8.0.0-rc1 adds pre_flow/pre_stream hooks, new keywords (tcp.wscale, email.*, ftp.*), pgsql CopyIn, and list-app-layer-hooks CLI flag
└──▷ GET THIS VERSION
$ git clone --branch 8.0.0-rc1 https://github.com/OISF/suricata.git
# already have the repo? check out this version:$ git checkout 8.0.0-rc1
└──▷ TRY IT
Create a detection rule using the new TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. window scale keyword to identify specific TCP initialization patterns.
$ alert tcp any any -> any any (msg:"TCP WScale Match"; tcp.wscale:12; flow:established; sid:1000001;)
Adds pre_flow rule hook to run detection logic before flow tracking
Adds pre_stream rule hook to intercept traffic before stream inspection
Adds tcp.wscale keyword to match TCP Window Scale option values
Adds email.received, email.url, and email.message_id keywords for MIME/Email protocol detection
Adds ftp.completion_code, ftp.reply_received, ftp.mode, and ftp.dynamic_port keywords for FTP protocol detection
+3 moreshow less
Adds query detection keyword for PostgreSQL (pgsql) protocol inspection
Enables CopyIn subprotocol/mode for PostgreSQL database logging
Enhances CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. affinity logic with per-interface NUMA preferences via cpu-affinity config
$ git clone --branch v1.6.9 https://github.com/crowdsecurity/crowdsec.git
# already have the repo? check out this version:$ git checkout v1.6.9
└──▷ USE IT
Enable self-unregistration of a log processor on shutdown to keep Kubernetes node lists clean in LAPI.
yaml
In the log processor's configuration, set the self-delete on shutdown option so the node automatically removes itself from LAPI when it exits.
Configure the HTTP acquisition to listen on a Unix socket instead of a TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port, useful for local log forwarding without network exposure.
Adds option for a log processor to unregister itself from LAPI on shutdown, keeping active processor lists clean in dynamic environments like Kubernetes.
Allowlists now automatically delete matching active decisions when an allowlist is created or updated.
PAPI (Polling API) is now automatically enabled or disabled when CrowdSec detects a console plan change, simplifying initial setup.
Docker datasource now uses Docker events instead of polling to detect new containers, improving performance.
HTTP acquisition now supports a listen_socket option for Unix socket listeners.
Adds support for d (day) suffix in profile duration fields.
LAPI now returns a specific error when a Unix socket path exceeds the OS limit.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Docker acquisition now requires access to the Docker events API endpoint — if you are using a socket proxy, its configuration must be updated to allow this endpoint.
Malcolm v25.06.0 adds role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. via Keycloak, NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. subnet filters, and Zeek intel log extensions.
└──▷ GET THIS VERSION
$ git clone --branch v25.06.0 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v25.06.0
└──▷ TRY IT
Regenerate internal OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. credentials required after upgrading to v25.06.0 before restarting Malcolm.
$ ./scripts/auth_setup
Adds NETBOX_AUTO_POPULATE_SUBNETS to netbox-common.env to specify subnet include/exclude filters for NetBox autopopulation, preventing noisy DHCP ranges from polluting inventory.
Adds ARKIME_INIT_… variables to opensearch.env to pass init arguments to Arkime's db.pl and Malcolm's own index template creation.
Moves OPENSEARCH_MAX_SHARDS_PER_NODE from arkime.env to opensearch.env and renames it CLUSTER_MAX_SHARDS_PER_NODE.
Moves NGINX_LDAP_TLS_… variables from auth-common.env to nginx.env.
Adds role-based access control (RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.) to Malcolm, available when the authentication method is keycloak or keycloak_remote, mapping Keycloak realm roles to OpenSearch, Arkime, and NetBox permissions and enforcing others via NGINX URI path rules.
+5 moreshow less
Adds many new ROLE… variables to auth-common.env to configure RBAC, plus new and changed default variables in netbox.env for RBAC support.
Malcolm's embedded Keycloak instance now automatically creates and configures the default client by ID when specified in ./config/keycloak.env.
Changes OPENSEARCH_URL default in opensearch.env to https://opensearch:9200 for the embedded OpenSearch instance, as all internal connections now use HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. due to the OpenSearch Security Plugin.
Moves Zeek's zeek-kafka plugin configuration to its own file (kafka.zeek), making it easier to override via Docker volume bind mount or Kubernetes configMap.
Extends Zeek's intel.log with additional fields using the corelight/ExtendIntel plugin.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!OPENSEARCH_MAX_SHARDS_PER_NODE is removed from arkime.env and must now be set as CLUSTER_MAX_SHARDS_PER_NODE in opensearch.env.
!NGINX_LDAP_TLS_… variables are removed from auth-common.env and must now be set in nginx.env.
!Inter-container access to the embedded OpenSearch instance now requires authentication; before first startup after upgrading, run ./scripts/auth_setup and select '(Re)generate internal passwords for local primary OpenSearch instance' to generate the credential stored in .opensearch.primary.curlrc.
!OPENSEARCH_URL in opensearch.env now defaults to https://opensearch:9200 (previously HTTP) when using the embedded OpenSearch instance.
Security Onion 2.4.160 adds Playbooks with airgap support, a new index-growth tool, and expanded ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. field mapping.
└──▷ GET THIS VERSION
$ git clone --branch 2.4.160-20250625 https://github.com/Security-Onion-Solutions/securityonion.git
# already have the repo? check out this version:$ git checkout 2.4.160-20250625
└──▷ TRY IT
Check Elasticsearch index growth to identify data sources consuming storage faster than expected.
$ so-elasticsearch-index-growth
Adds Playbooks feature with a dedicated repo config and parsing support for automated response workflows.
Adds airgap support for Playbooks, enabling Playbook functionality in isolated/offline deployments.
Adds so-elasticsearch-index-growth command to monitor Elasticsearch index growth trends.
Adds RulesetName field to Rule Repos for improved rule repository identification.
Adds support for dns.resolved_ip ECS field in parsing.
+3 moreshow less
Uses Zeek's network.community_id when available for improved correlation across data sources.
Enables HTTP Strict Transport Security (STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets.) for browser redirects.
cloud-nuke v0.41.0 adds SageMaker Endpoints, CloudFront distributions, S3 lifecycle rules, and CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. tag filtering.
└──▷ GET THIS VERSION
$ git clone --branch v0.41.0 https://github.com/gruntwork-io/cloud-nuke.git
# already have the repo? check out this version:$ git checkout v0.41.0
Adds support for nuking SageMaker Endpoint resources.
Adds support for nuking SageMaker Endpoint Configuration resources.
Adds support for nuking CloudFront distributions.
Adds tag-based filtering support for CloudTrail resources.
Adds nuking of S3 bucket lifecycle configurations.
Cloud Custodian 0.9.45 adds Comprehend, Keyspaces, Lex v2, and RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed. resource support plus new API Gateway v2 actions.
└──▷ GET THIS VERSION
$ git clone --branch 0.9.45.0 https://github.com/cloud-custodian/cloud-custodian.git
# already have the repo? check out this version:$ git checkout 0.9.45.0
└──▷ TRY IT
Identify Comprehend endpoints not tagged with an owner to enforce tagging compliance.
$ custodian run -s out policy.yml
# policy.yml
policies:
- name: comprehend-endpoint-missing-owner-tag
resource: aws.comprehend-endpoint
filters:
- "tag:Owner": absent
Delete stale API Gateway v2 stages in a non-production environment to reduce attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
Find ElastiCache clusters not in your approved VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. to catch misconfigured network placement.
Adds four new AWS Comprehend resource types: aws.comprehend-document-classifier, aws.comprehend-endpoint, aws.comprehend-entity-recognizer, and aws.comprehend-flywheel.
Adds aws.keyspace and aws.keyspace-table resources for managing Amazon Keyspaces (Cassandra-compatible).
Adds aws.lexv2-bot-alias resource with cross-account filter and delete action for Lex v2 bot aliases.
Adds aws.resource-share-self and aws.resource-share-other resources for managing AWS RAMAWS RAMAWS Resource Access Manager is an Amazon service that lets an AWS account share resources such as subnets or Transit Gateways with other accounts or AWS Organizations, removing the need to duplicate infrastructure across account boundaries. resource shares.
Adds delete and update actions to aws.apigwv2 (API Gateway v2 APIs) and aws.apigwv2-stage resources.
+6 moreshow less
Adds vpc filter to aws.cache-cluster via ElastiCache server-side query support.
Adds topic filter to aws.rds-subscription for filtering RDS event subscriptions by SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. topic.
Adds db-parameter filter to aws.timestream-influxdb resources.
Adds return_allowed configuration option to the cross-account filter, returning matching allowed statements.
Adds support for extended statistics keys in the metrics filter.
Adds cam-policy-used filter support for finding unused CAM policies in Tencent Cloud via boolean flag.
eksctl v0.210.0 updates node role policy to PullOnly, enabling ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. pull-through cache support.
└──▷ GET THIS VERSION
$ git clone --branch v0.210.0 https://github.com/weaveworks/eksctl.git
# already have the repo? check out this version:$ git checkout v0.210.0
1 more release in this issue
· 2025-06-05 → 2025-06-07
CloudGoat v2.3.0 adds a new AWS attack scenario focused on VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. peering over-exposure.
└──▷ GET THIS VERSION
$ git clone --branch v2.3.0 https://github.com/RhinoSecurityLabs/cloudgoat.git
# already have the repo? check out this version:$ git checkout v2.3.0
Adds new vpc_peering_overexposed AWS scenario for practicing attacks against misconfigured VPC peering relationships.
cilium-cli v0.18.4 adds VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments.-over-IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications., IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. tunnel underlay, IPv6 egress gateway policies, and promotes CiliumLoadBalancerIPPool to v2 API.
└──▷ GET THIS VERSION
$ git clone --branch v0.18.4 https://github.com/cilium/cilium-cli.git
# already have the repo? check out this version:$ git checkout v0.18.4
Adds VXLAN-in-IPsec (VinE) support, enabling encrypted VXLAN tunnels via IPsec.
Supports IPv6 as a tunneling underlay for overlay networking.
Adds support for IPv6 egress gateway policies.
Promotes CiliumLoadBalancerIPPoolCRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. to v2 API version.
Adds TLS SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. ServerNames validation in policy configuration.
+5 moreshow less
New clusters created in ENI mode no longer masquerade pod traffic to the external world.
Removes tunnel map references from cilium-dbg, cilium status, and bugtool now that pod CIDRs are stored in the ipcache map.
Allows BINDIR environment variable to be dynamically configured for the CLI install path.
Migrates from corev1.Endpoints to discoveryv1.EndpointSlice internally.
Drops support for Cilium versions older than v1.14.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!Cilium v1.14 is now the minimum required version; clusters running older Cilium releases will not be supported.
Docker Compose v2.37.0 adds Compose Bridge, bake as default builder, and platform/date details in image listings.
└──▷ GET THIS VERSION
$ git clone --branch v2.37.0 https://github.com/docker/compose.git
# already have the repo? check out this version:$ git checkout v2.37.0
└──▷ TRY IT
Opt out of the new bake-based builder if your pipeline depends on the classic per-service build path.
$ COMPOSE_BAKE=false docker compose up --build
Adds compose bridge subcommand for bridging Compose projects to other environments.
Switches to bake as the default image builder, replacing the previous per-service build path (opt out with COMPOSE_BAKE=false).
Includes platform and creation date columns when listing images.
Adds metadata subcommand support for provider services.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!bake is now the default image builder; existing setups that rely on the prior per-service build behavior may behave differently — set COMPOSE_BAKE=false to restore the previous behavior.
kube-bench v0.11.0 adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmark support for AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. 1.7.
└──▷ GET THIS VERSION
$ git clone --branch v0.11.0 https://github.com/aquasecurity/kube-bench.git
# already have the repo? check out this version:$ git checkout v0.11.0
Adds AKS-1.7 benchmark version, enabling CIS compliance checks against Azure Kubernetes Service 1.7 clusters.
Kata Containers 3.18.0 adds TDXTDXIntel Trust Domain Extensions, a CPU feature that creates hardware-isolated virtual machines whose memory is encrypted and inaccessible even to the hypervisor, letting tools run workloads in a confidential computing environment. support in runtime-rs, shared_fs=none for CoCo, and forces guest image pulls.
└──▷ GET THIS VERSION
$ git clone --branch 3.18.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:$ git checkout 3.18.0
Adds runtime: add option to force guest pull to allow pulling images inside the guest environment
Supports shared_fs = "none" for CoCo workloads in runtime-rs
Adds memory prealloc support for qemu/ch hypervisors in runtime-rs
Supports pulling images in guest using Kata Volumes for CoCo in runtime-rs
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The hotplug_vfio_on_root_bus config key is removed from config.toml
Trivy is a comprehensive security scanner that finds vulnerabilities, misconfigurations, secrets, and SBOM in containers, Kubernetes, code repositories, and clouds
Trivy 0.64.0 adds Root.io container scanning, OpenTofu support, CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. metadata, and Terraform partial evaluation
└──▷ GET THIS VERSION
$ git clone --branch 0.64.0 https://github.com/aquasecurity/trivy.git
# already have the repo? check out this version:$ git checkout 0.64.0
Add Root.io support for container image scanning
Add OpenTofu file extension support in misconf scanning
Add partial evaluation for policy templates in Terraform
Dereference all Maven settings.xml environment placeholders
Add manufacturer field to CycloneDX tools metadata in SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. output
Exabeam New-Scale adds 9 new UBA correlation rules, 6 Cloud Collectors, Timeline View in Search, and bulk Scheduled Reports actions.
Adds Cisco Secure Endpoint Cloud Collector, CrowdStrike Context Devices Cloud Collector, Trellix Endpoint Security Cloud Collector, Anomali Cloud Collector, AWS GuardDuty Cloud Collector, AWS Security Lake Cloud Collector, Tenable Cloud Collector, and Zoom Cloud Collector to facilitate ingestion of security events from their respective sources.
Adds 16 new or updated correlation rule templates including 'UBA: Large number of denied access events towards external domain', UBA: Account or Group or Privileges Modified, Server-side request forgeryServer-side request forgeryServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly., and Volume Shadow Copy Created to identify insider threats and reconnaissance.
Expands the Trigger Count filter on the Anomalies Dashboard with an increased maximum value of 10,000 for more accurate anomaly trigger rate reporting.
Adds eight new pre-built compliance dashboards: CMMC Analyst/Management, HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. Analyst/Management, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001 Analyst/Management, NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework. Analyst/Management, NIST 800-171 Analyst/Management, NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. Analyst/Management, and PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. Analyst/Management.
Adds Send Now and Delete bulk actions to the Scheduled Reports tab to send multiple reports immediately or remove them without waiting for configured delivery times.
+6 moreshow less
Expands access to create custom enrichment rules in the Log Stream application to all New-Scale license holders (SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., Fusion, Analytics) and introduces a new operator for context keys and on-the-fly custom field creation.
Adds support for custom user roles in Multi-Org Management to configure permissions tailored to specific needs for parent or child organizations.
Introduces Exabeam Nova Analyst Assistant, an AI assistant that interprets MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. Coverage Summary or Use Case Coverage Summary to generate natural language responses about security posture.
Expands access to the Timeline view of search results to all license types and adds a configurable server-side sort order selector in the Search bar for chronological ordering.
Adds notifications on the Long-Term Consumption Details page when users reach 100% or exceed their long-term search quota based on license terms.
Adds new Public API endpoints for License Consumption to read current license level, historical usage data, and details for each license type (SIEM, NSA/AA, Long-term Search, Long-term Storage, API).
Databricks releases its JDBCJDBCA Java standard API for connecting applications to relational databases, maintained as part of the Java SE platform, letting tools query any compliant database through a single consistent interface. driver source code publicly under Apache 2.0 for community contributions
29 more releases in this issue
· 2025-06-02 → 2025-06-26
Adds ai_parse_document() beta function to extract structured content from unstructured documents using Databricks Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves..
OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. federation for Databricks-to-open Delta Sharing is generally available
Databricks now supports sharing managed Iceberg tables via Delta Sharing in both Databricks-to-Databricks and open sharing modes during Public Preview.
Databricks expands FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments.-Compliant environment support to include Model Serving, Mosaic AI Gateway, and external models
Adds FIPS-compliant support for Model Serving CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. workloads
Adds FIPS-compliant support for Foundation Model API provisioned throughput endpoints (excluding LLaMA 4)
Managed Apache IcebergApache IcebergAn open table format for large analytic datasets, maintained by the Apache Software Foundation, that gives cyber tools reliable schema evolution, time-travel queries, and atomic commits on object storage or HDFS. tables enter public preview with Iceberg REST Catalog API integration.
Enables reading and writing to managed Apache Iceberg tables from Databricks or external engines via the Iceberg REST Catalog API
Automatically applies liquid clustering for predictive optimization in managed Apache Iceberg tables
Databricks introduces Lakebase as a new managed PostgreSQL OLTP service in public preview, allowing users to run transactional workloads integrated with the platform.
Foreign Apache IcebergApache IcebergAn open table format for large analytic datasets, maintained by the Apache Software Foundation, that gives cyber tools reliable schema evolution, time-travel queries, and atomic commits on object storage or HDFS. tables are in Public Preview via Lakehouse FederationLakehouse FederationA data architecture pattern that lets a single query engine read from multiple external data sources—databases, data lakes, warehouses—without moving or copying the data, reducing pipeline complexity for tools that need broad data access.
Reads Iceberg tables managed by foreign catalogs (HMS, Glue, Snowflake Horizon Catalog) using Lakehouse Federation
Applies Unity Catalog advanced features (fine-grained access controls, lineage, and auditing) to these foreign Iceberg tables
Databricks v2025.06 introduces AUTO CDC APIs (AUTO CDC INTO, create_auto_cdc_flow) replacing APPLY CHANGES for Lakeflow Spark Declarative Pipelines.
Adds AUTO CDC INTO SQL API to create flows supporting change data feeds in Spark Declarative Pipelines on Lakeflow
Adds Python APIs create_auto_cdc_flow and create_auto_cdc_from_snapshot_flow for automated change data feedchange data feedA stream of records describing every insert, update, and delete that occurs in a database, captured in real time so downstream systems can react to changes without polling. management
Databricks serverless compute can now use AWS PrivateLinkAWS PrivateLinkAn AWS networking feature that exposes a service over a private VPC endpoint rather than the public internet, letting tools move data between accounts or to AWS services without traffic ever leaving Amazon's backbone. to access S3 buckets privately.
Databricks GA: Manage network policies for serverless egress control to allowlist domains and monitor denials.
Enables configuration and enforcement of outbound network policies for serverless compute resources including SQL warehouses and model serving endpoints.
Adds ability to allowlist specific domains and storage accounts in restricted mode.
Supports a dry-run mode to monitor policy impact before enforcement without blocking traffic.
Allows viewing and analyzing denial logs in Unity Catalog for auditing and troubleshooting outbound egress.
Databricks adds Public Preview of PrivateLinkPrivateLinkAn AWS networking feature that exposes a service over a private endpoint inside a VPC, so traffic never traverses the public internet, giving cyber tools a way to integrate with cloud services without opening public routes. connections from serverless compute to VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. resources via NLB.
Enables AWS PrivateLinkAWS PrivateLinkAn AWS networking feature that exposes a service over a private VPC endpoint rather than the public internet, letting tools move data between accounts or to AWS services without traffic ever leaving Amazon's backbone. connectivity from serverless compute to VPC resources through a network load balancer (NLB).
Databricks Apps now supports HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against., PCI-DSSPCI-DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers., and FedRAMP ModerateFedRAMP ModerateA US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts. compliance security profile standards
Serverless GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. compute is now in Beta for single and multi-node deep learning workloads.
Enables Serverless GPU compute within the Serverless compute offering for custom deep learning training and fine-tuning.
New Integrations Catalog and Custom Apps feature for building private integrations via Automation SDK and GitHub/GitLab sync
Adds the Integrations Catalog as a centralized hub to discover, filter, and manage all Sekoia.io integrations with sorting by Recent/Popular/All and filters by Features, Categories, and Content Types.
Enables creation of private custom integrations using the Sekoia.io Automation SDK, allowing users to define custom playbook actions, triggers, connectors, and intake formats.
RunReveal adds native AI Chat (early access), Remote MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface., and four new log sources.
Adds the RunReveal Native Agent AI Chat feature to all customers in early access
Makes the RunReveal Remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server easier to configure by adding OAuth authentication
Tenzir is a data pipeline engine for security teams that collects, transforms, enriches, and routes telemetry.
Tenzir Platform v1.13.0 adds GCP OAuth CLI support, schema search in Explorer, and diagnostic count modes for heatmaps.
Adds TENZIR_PLATFORM_CLI_EXTRA_HEADERS environment variable to the Tenzir Platform CLI for passing custom HTTP headers
Enables Google OAuth device codeOAuth device codeAn OAuth 2.0 flow where a device with no browser displays a short code; the user authenticates on a separate device, and the original device polls for the resulting token. Useful for CLI tools and headless environments. flow authentication via the Tenzir Platform CLI for internal GCP clients
Adds search functionality to the schemas pane/dropdown in the Explorer page UI
Adds a Count by option in the diagnostics heatmap time range dropdown to toggle between unique pipelines and total diagnostic message counts
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The .env variables TENZIR_PLATFORM_DOMAIN, TENZIR_PLATFORM_CONTROL_ENDPOINT, TENZIR_PLATFORM_BLOBS_ENDPOINT, and TENZIR_PLATFORM_OIDC_ADMIN_RULES are renamed; users must update their existing .env files to use the new names (TENZIR_PLATFORM_UI_ENDPOINT, TENZIR_PLATFORM_NODES_ENDPOINT, TENZIR_PLATFORM_DOWNLOADS_ENDPOINT, TENZIR_PLATFORM_ADMIN_RULES) when upgrading.
8 more releases in this issue
· 2025-06-01 → 2025-06-26
Parse logs separated by a custom delimiter like "||".
$ load_file "data.txt"
read_delimited "||"
publish operator now supports event-dependent topics for flexible pipeline routing
read_delimited operator added for splitting data on exact string or blob matches
read_delimited_regex operator added for splitting data using regular expression patterns
from_http operator now supports the metadata_field option in server mode to extract request headers, query parameters, path, fragment, method, and version
Tenzir v5.5.0 adds OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. normalization, TQL entropy calculation, file rename support, and CEFCEFCommon Event Format, an ArcSight (Micro Focus) log standard that defines a fixed header plus extensible key-value pairs so cyber tools can emit and ingest alerts in a predictable, parseable structure./LEEF output functions.
Adds ocsf::apply operator to normalize events to the OCSF schema based on class_uid, metadata.version, and metadata.profiles. Also adds ocsf::type_uid and ocsf::type_name functions.
Adds entropy() aggregation function in TQL for Shannon entropy calculation, with optional normalize=true parameter.
Updates from_file operator to support a rename parameter for moving/renaming files after reading (e.g., rename=path => f"{path}.done").
Adds print_leef() and print_cef() functions to write nested CEF or LEEF structures inside a syslog frame.
Adds lookup cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools for classifying remote management and desktop tool application IDs in Cisco FTD environments.
Updates lookups cisco_secure_firewall_filetype_lookup and cisco_snort_ids_to_threat_mapping with expanded coverage.
Extends Cisco Secure Firewall Threat Defense (FTD) eStreamer compatibility across 12 updated network and cloud detections, including port scan, TOR traffic, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory., and O365 analytics.
Shuffle v2.1.0-rc2 adds HA for Orborus, public Datastore Categories with automation, and bulk datastore updates.
└──▷ GET THIS VERSION
$ git clone --branch v2.1.0-rc2 https://github.com/Shuffle/Shuffle.git
# already have the repo? check out this version:$ git checkout v2.1.0-rc2
└──▷ HOW TO FIND IT
Publish your own threat intelligence or detection ruleset so other Shuffle orgs can subscribe to it.
📍In the console, go to /admin?tab=datastore, select or create a Datastore Category, and toggle it to Public to make it subscribable by other organizations.
Trigger a response workflow automatically when entries are added to a Datastore Category (e.g., a new IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. hits your threat list).
📍In the console, open the target Datastore Category, navigate to its Automation settings, and configure a workflow trigger or webhook URL to fire on category updates.
Adds High Availability and failover tracking for Orborus in both cloud and on-prem environments.
Enables making Datastore Categories public, allowing teams to subscribe to others' published threat lists or publish their own detection rulesets — managed via /admin?tab=datastore.
Adds Datastore Category Automation: categories can now natively trigger workflow runs or send webhooks when data changes.
Supports bulk setting of Datastore entries, with categories now able to handle hundreds of thousands of entries.
Introduces a Partner & Use Case management system for organizational and workflow flexibility.
+5 moreshow less
Adds sub-organization deletion UI with verification button and associated cache management.
Adds ability to skip SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for admins on sub-organizations.
Enables Singul to automatically upload translations to the Shuffle Datastore, plus a new frontend library for managing apps and authentication in third-party platforms.
Upgrades backend search to OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. 3.0.0.
Adds Helm chart support for specifying service labels, security contexts for worker and app containers, and configurable exposed app port.
MISP v2.5.15 delivers bi-directional correlation rules, role-based API result limits, and faster object restSearch queries.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.15 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.15
└──▷ HOW TO FIND IT
Set a per-role API result cap to prevent high-volume users from overwhelming the instance during bulk exports.
📍In the Admin console, go to Administration › Roles, edit the target role, and set the maximum number of results per API request in the role configuration.
Bi-directional correlation rule exclusions: existing data now avoids correlating against newly added data when exclusion rules apply, ensuring consistent suppression in both directions.
Role-based API result limits: administrators can configure a maximum number of results returned per API request at the role level for granular resource control.
Filter attributes by object_relation field in search queries, adding a new dimension to attribute lookups.
Galaxy view now displays the count of attributes linked to each galaxy cluster.
New Import Choice button surfaced above the attribute list directly on the event view page.
+2 moreshow less
Significant speed-up for object restSearch queries via optimized query builder prioritizing event table lookups and new caps on object lookups.
Database schema updated to support larger TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. server API keys.
7 details in Everything
3 more releases in this issue
· 2025-06-06 → 2025-06-24
MISP v2.4.213 adds bi-directional correlation rules, role-based API result limits, and object_relation attribute filtering.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.213 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.4.213
└──▷ HOW TO FIND IT
Cap how many results a high-volume analyst role can pull per API call to protect server resources.
📍In the console, go to Administration › List Roles, edit the target role, and set the maximum API result limit field to the desired value (e.g. 10000).
Narrow a restSearch query to attributes that share a specific object relation, such as all ip-dst relations across objects.
Bi-directional correlation rule exclusions: existing data now correctly avoids correlating against newly added information when exclusion rules apply, not just the reverse.
Role-based API result limits: administrators can now configure a maximum number of results returned per API request at the role level for granular resource control.
New attribute filter on object_relation: attributes can now be searched and filtered by their object_relation field.
Import Choice button added directly above the attribute list on the event view page for faster import access.
Galaxy view now displays a count of attributes linked to each galaxy cluster.
+1 moreshow less
TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. server API key field enlarged in the database schema to support longer key values.
Searches now use POST requests backed by a Redis token-based system, enabling flawless pagination on complex queries and independent concurrent search tabs.
New event index and REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. filtering by whether an event is extending or extended by another event.
Warninglist filtering now supported on the /attributes/search endpoint.
API accepts desired response format via the Accept header, removing the need to hard-code content negotiation in requests.
Attachments can now be added directly via the quick-add attribute form and are preserved when grouping attributes into a MISP object.
+1 moreshow less
Event reports can now be looked up by UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide..
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The extend[ing/ed] parameter for merging data has been renamed to the include_* syntax; existing API calls using extending or extended for merge operations must be updated.
MISP v2.4.211 revamps search with POST/token pagination, adds event filtering by extend relationships, and warninglist filtering in attribute search.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.211 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.4.211
Attribute and log searches now use POST requests backed by a Redis token system, enabling pagination on complex queries and multiple independent search tabs simultaneously.
New event index and REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. filtering by whether an event is extending or extended by another event.
Warninglist filtering now supported in the /attributes/search endpoint.
API now respects the Accept header to set the desired response format.
Attachments can be added directly via the quick-add attribute form and are preserved when grouping attributes into a MISP object.
+1 moreshow less
Event reports can now be looked up by UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide..
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The extend[ing/ed] parameter for merging data has been renamed to include_* syntax; existing API calls using extending or extended for merging must be updated.
Adds dedicated SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders. and DMARC parsing to Google DNS engine
└──▷ GET THIS VERSION
$ git clone --branch v0.8.4 https://github.com/stanfrbd/cyberbro.git
# already have the repo? check out this version:$ git checkout v0.8.4
PUBLISHER_MANAGER__ENABLE_BUFFERING and PUBLISHER_MANAGER__BUFFERING_SECONDS config keys allow tuning or disabling default notification batching.
Adds Security Platform entity type for mapping detection tool coverage against MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. techniques.
Adds Dynamic From, Dynamic To, and In regards of (dynamic) filters on relationship screens for precise traversal queries.
Adds JSON Feed and JSON Mapper capabilities for ingesting JSON-formatted intelligence sources.
Adds support for MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. sub-techniques in the MITRE ATT&CK Matrix view.
+13 moreshow less
Adds Fintel design customization options (logo and colors) for PDF exports.
Adds Reset Password flow accessible from the login page.
Adds ability to apply a case template directly within Playbooks when wrapping elements into a Case container.
Adds CVSSV2, CVSSV4 metrics and native CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. vector string parsing to the data model.
Adds remediates relationship linking software versions to vulnerabilities they fix.
Adds a risk score field to Organizations for supply chain use cases.
Adds belongs-to relationship between Threats and Channels for counter-disinformation modeling.
Adds Dragos connector for importing intelligence from the Worldview API.
Adds Flashpoint connector support for Compromised Credentials Monitoring (CCM) data.
Adds Email Intel IMAP Connector for ingesting CTI reports via email.
Adds Email Intel Microsoft Connector for ingesting CTI reports via Microsoft Graph APIMicrosoft Graph APIA unified REST API maintained by Microsoft that exposes data and actions across Microsoft 365 services, letting cyber tools query users, emails, files, and sign-in logs through a single authenticated endpoint..
Adds Cofense ThreatHQ connector for phishing threat data ingestion.
Adds ServiceNow connector for importing Security Incidents as Case Incident Response objects.
Adds Flexera Software Vulnerability Research premium feed and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v17.0/v17.1 support to ThreatStream.
Activates the Flexera Software Vulnerability Research premium feed from the APP Store
Supports MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. techniques and sub-techniques associated with v17.0 and v17.1
New Subsearch feature enables embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. queries within main searches to filter, manipulate, or correlate results across multiple tables.
Adds Subsearch capability to embed a search query within the main search for filtering, manipulating, or correlating results across multiple tables.
EUVDEUVDThe European Vulnerability Database, operated by ENISA, is the EU's official registry of disclosed software vulnerabilities, giving cyber tools a regional authoritative source for CVE-equivalent advisories. ID display in CVE cards, product version filtering in dashboard, and JP/KR/RU language support.
Enables filtering vulnerabilities by specific product versions in the Vulnerability Dashboard
Supports discovering insights written in Japanese, Korean, and Russian via English queries
Find all IP addresses associated with a specific capture by its UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide..
Updates PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file proxy handling and replaces netsh with API/PowerShell in ZTSAZTSAZero Trust Security Architecture: a network access model where no user or device is trusted by default, requiring continuous verification before granting access, letting cyber tools enforce least-privilege policies across any environment. module for Windows
Skips connectivity checks for other proxies in the PAC file if any proxy is reachable to streamline connection establishment.
Replaces the netsh command with a Windows API or PowerShell command for improved network configuration stability.
New integration with Nozomi Vantage allows extracting OT/IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. asset and alert data for enhanced IT/OT security visibility.
Adds Nozomi Vantage integration to extract asset data, inventory information, and security alerts from industrial control systems
Enables forwarding of extracted data telemetry to TrendAI Vision One for risk analysis and threat correlation
Trend Vision One Container Security Runtime Malware Scanning now supports ARM64ARM64A 64-bit CPU architecture from ARM Holdings, used in mobile chips, Apple Silicon, and cloud servers; cyber tools target it to run natively on those platforms instead of relying on emulation.CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. node clusters.
Trend Vision One Endpoint Security agent now supports Red Hat Enterprise Linux 9 (ARM64ARM64A 64-bit CPU architecture from ARM Holdings, used in mobile chips, Apple Silicon, and cloud servers; cyber tools target it to run natively on those platforms instead of relying on emulation.).
New platform support for deploying Server & Workload Protection and Endpoint Sensor to Red Hat Enterprise Linux 9 (ARM64) endpoints.
Enables central management of Deep Discovery Inspector detection rules within Trend Vision One's Network Analysis Configuration.
Adds the ability to centrally manage detection rules for all connected Deep Discovery Inspector appliances (v6.8 SP1 or later) via Network Analysis Configuration.
Trend Vision One's Cloud Email and Collaboration Protection now extends its malware scanning capabilities to include active content detection in PDF attachments for Exchange Online.
Detection of active content in PDF files attached to emails.
DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. email header scanning now supports Gmail (Inline Mode) alongside Exchange Online
Extends DLP email header scanning to Gmail and Exchange Online in Inline Mode for broader coverage.
Enables inspection of email headers in addition to subject, body, and attachments.
Customized timeout RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. permissions update for console settings
Updates RBAC permissions so only Master Administrator and Operator can edit pre-defined roles in Console Settings.
Restricts Endpoint Administrator and Email Administrator to view-only access for the Console Settings page.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Endpoint Administrator and Email Administrator roles no longer have permission to make changes to Console Settings.
Trend Vision One Container Security Helm chart upgraded to new repo location with performance and feature enhancements.
Adds access to a new version of the Container Security Helm chart hosted at https://github.com/trendmicro/visionone-container-security-helm.
Requires modification of Helm override file values and firewall exceptions due to repository migration.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The Helm chart repository location has changed from the previous Cloud One endpoint to https://github.com/trendmicro/visionone-container-security-helm.
!Existing Helm override file values must be updated to match the new chart structure.
Helm Chart 3.0.1 adds ARM64ARM64A 64-bit CPU architecture from ARM Holdings, used in mobile chips, Apple Silicon, and cloud servers; cyber tools target it to run natively on those platforms instead of relying on emulation. malware scanning, K8s auth event sending, and cleanup on uninstall.
Adds malware_scanning.architecture support for ARM64 targets
Enables automatic Kubernetes events on expired or invalid authentication tokens
Removes all Container Security custom resources during Helm Chart uninstallation
Enables enabling Real-Time Posture Monitoring while creating a new Azure subscription or turning the feature on for existing subscriptions or organizations via UI settings
TrendVision One Windows agent June 2025 adds SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. queries for Web Reputation and .jsp extension support in Server & Workload Protection
Server & Workload Protection now uses Server Name Indication (SNI) queries by default when determining the risk level of a website via Web Reputation
XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. for Cloud now offers hourly pay-as-you-go billing via AWS Marketplace alongside credit allocation.
Adds hourly pay-as-you-go billing option for XDR for Cloud on AWS Marketplace
Enables switching between credit allocation and consumption-based billing models for existing subscribers in Credits & Billing
Adds EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. sync installation option for File Security Storage CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. template.
Users now have an installation option in the CloudFormation template that enables scanning of S3 buckets by default when EventBridge is enabled.
Sophos Managed Risk gains internal attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. management via Tenable Nessus; AP6 Series adds multiple mesh SSID support.
Adds Internal Attack Surface Management (IASM) to Sophos Managed Risk, extending vulnerability management to internal assets using Tenable Nessus technology, available to all new and existing Managed Risk customers at no additional cost.
Adds multiple mesh SSID support for Sophos AP6 Series access points in Sophos Central.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The Apply License Key button is removed for MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. tenants on the Partner Dashboard; MSP tenants must now update licenses exclusively through the Update Billing conversion flow from MSP to Term.
1 more release in this issue
· 2025-06-07 → 2025-06-28
Sophos Central 2025.23 adds MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. integration health alerts, ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. on-premises network detection, and a device details flyout.
└──▷ HOW TO FIND IT
Set up email notifications for MDR integration health alerts so your team is immediately notified when the Microsoft 365 Management Activity integration goes offline.
📍In Sophos Central, go to Alerts, locate the integration health alert for Microsoft 365 Management Activity, then configure email notification settings based on that alert.
Adds MDR integration health alerts in Sophos Central when a data ingestion integration is unhealthy or offline, starting with the Microsoft 365 Management Activity integration, with email notification support.
Adds on-premises network detection and domain controller support as an agent-based resource in ZTNA, improving usability and performance.
Adds a device details flyout that opens when clicking a device in the Computers and servers page, keeping context on the same page.
Huntress adds identity disablement/enablement for AD synced identities via agent v0.14.22+ and portal
Adds ability to disable and re-enable Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. synced (hybrid) identities using the Huntress agent on an organization’s AD server.
Adds identity disablement as a Containment (automatic) remediation option for AD synced identities in Huntress Managed ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions..
Adds identity disablement as an Assisted (partner-initiated from incident report) remediation option for AD synced identities.
Allows partners to disable AD synced identities directly from the Huntress portal.
Introduces a new escalation notification when an AD synced identity disablement task fails.
5 details in Everything
3 more releases in this issue
· 2025-06-10 → 2025-06-24
Adds Recommendations tab in Incident Report to auto-suggest SAT episodes for assignment
Adds a Recommendations tab to the Incident Report UI for existing SAT customers with EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. and/or ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions..
Enables one-click assignment of recommended SAT episode(s) directly from the Incident Report.
Links assigned training completion back to the SAT portal for tracking.
Huntress adds macOS XProtectXProtectApple's built-in malware detection system for macOS, maintained by Apple and updated silently via XProtect Remediator; cyber tools integrate with or reference it to leverage Apple's own signature-based threat blocking. visibility and Microsoft Defender for Endpoint integration.
Adds visibility into macOS XProtect alerts, triggering high-fidelity signals visible on the new Antivirus page in the Mac agent detail pages in the Portal
Adds Microsoft Defender for Endpoint (MDE) integration generating Signals from MDE alerts and showing Defender status on the Antivirus page
Adds capabilities to request a Defender scan and signature update via the Antivirus page in the Portal
NodeZero June 2025 adds Vulnerability Management Hub for prioritization and a Flex onboarding wizard via new UI workflows.
Adds the Vulnerability Management Hub to prioritize, verify, and remediate weaknesses.
Adds a guided Flex New User Wizard to create clients, runners, and pentests.
Adds bulk allocation and improved parent-level visibility for MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. accounts.
New connectors for Surface Command, AI disposition in InsightIDR, new Insights/harvesters in Cloud Security, and manual update uploads.
Adds Baramundi, Cybereason, Dragos, Markmonitor, Microsoft Defender for IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure., and Zabbix Cloud as Attack Surface Management (Surface Command) integrations
Unifies external and internal attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. discovery in a single interface with seed management and insight dashboards for Discovery Seeds under External Attack Surface in Attack Surface Management (Surface Command)
Allows marking subdomains, IP addresses, or network services as out-of-scope for Continuous Red Teaming (Vector Command) within the External Attack Surface view of Attack Surface Management (Surface Command)
Adds dark mode toggle to Attack Surface Management (Surface Command) workspace
Introduces mitigating controls prioritization in Remediation Hub across Command Platform, Exposure Command, Cloud Security (InsightCloudSec), InsightVM, and Automation (InsightConnect)
+48 moreshow less
Adds Claroty xDome and Imperva WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. as direct cloud log event sources for detection products without additional software
Provides expert-driven remediation guidance for AWS GuardDuty and Azure Defender for Cloud alerts in SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. (InsightIDR) Alerts > Alert Details
Adds dozens of new Suricata rules under ET EXPLOIT, ET EXPLOIT_KIT, and ET SCAN to Network Sensor in SIEM (InsightIDR)
Adds Account Password Reset – Is Watched and Account Password Reset – Is Admin detection rules to the Detection Library in SIEM (InsightIDR)
Migrates legacy UBA rules (Third Party Alert – Cyberark Vault, Third Party Alert – Cybereason, Third Party Alert – Netskope, Zone Policy Violation, Flagged Hash On Asset, Flagged Process On Asset) into the Detection Library in SIEM (InsightIDR)
Introduces a graph-based Principal API Activity Timeline for Azure audit logs in SIEM (InsightIDR) Alerts > Alert Details
Publishes Cloud Security (InsightCloudSec) API documentation accessible via Profile and Help menu for programmatic access
Adds AI Dispositioning to automatically classify alerts as likely benign or malicious with the AI Suggested Disposition field in SIEM (InsightIDR) Alerts > Alert Details
Excludes Enhanced Endpoint Telemetry (EET) data from monthly Fair Use allowance calculations in SIEM (InsightIDR)
Adds False Positive and Security Test as selectable disposition options for alerts and investigations in SIEM (InsightIDR), Managed Threat Complete, and MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools.
Centralizes endpoint exclusion management under Command Platform > Administration > Data Collection > Agents > Endpoint Prevention > Exclusions for Managed Threat Complete and MDR
Adds Insights: Encryption Key Vault With Public Network Access Enabled When Using Private Endpoint and Databricks Workspace Enable Customer Managed Keys (CMK) in Cloud Security (InsightCloudSec)
Removes the Switch to Legacy UI option in Cloud Security (InsightCloudSec) System Settings
Expands Azure Container Registry fields to include local admin and managed identity information in Cloud Security (InsightCloudSec)
Adds Insights: Secrets stored in ConfigMaps and Web App with Remote Debugging Enabled in Cloud Security (InsightCloudSec)
Enables namespace-level fallback for the Guardrails inventory scanner when cluster-wide permissions fail in Cloud Security (InsightCloudSec) Kubernetes Scanner version 4.1.5
Adds Add Organization button to Cloud Accounts > Organizations page in Cloud Security (InsightCloudSec) Modern UI
Adds support for optional custom tags in Automatic LPA Deployment modal and Azure Container Registry tagging in Cloud Security (InsightCloudSec)
Enables local assessments of private OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. registries in Cloud Security (InsightCloudSec)
Deprecates Web App with Remote Debugging Turned On Insight in favor of Web App with Remote Debugging Enabled in Cloud Security (InsightCloudSec)
Adds insights for Azure Storage Account lifecycle policies and query filters: Storage Account Without Lifecycle Policy, Storage Account With Disabled Lifecycle Policy Rules, etc. in Cloud Security (InsightCloudSec)
Supports tagging for deployed resources during Azure LPA and EDH auto-deployment endpoints in Cloud Security (InsightCloudSec)
Adds StartInstances event harvesting with the StartInstancesEventHarvest feature flag to populate launch_time in Cloud Security (InsightCloudSec)
Expands OS package detection for higher-fidelity proof in host and container assessments in Cloud Security (InsightCloudSec)
Adds Storage Account with Default to OAuth Authentication Disabled insight, Azure Stream Analytics Clusters/Jobs harvesting, and associated query filters in Cloud Security (InsightCloudSec)
Adds new Insights: Serverless Function With Enabled Cloud Secret Manager API, Subnet Without VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow Logs Enabled, Cloud Accounts Without Sinks Configured for All Log Entries, and Cloud Account Linked to Cloud Credential Without App Restrictions in Cloud Security (InsightCloudSec)
Adds Query Filters: Resource Encrypted With Cloud Managed Key, Database Migration Endpoint Is/Is Not Encrypted, Cloud Accounts Without Sinks Configured For All Log Entries, and Cloud Credential Without App Restrictions in Cloud Security (InsightCloudSec)
Adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. GCP 3.0 Compliance Pack and updates Insights for CIS GCP 3.0 Recommendations 2.4–2.11 in Cloud Security (InsightCloudSec)
Introduces Azure App Service Environments support with new harvester, resource, and query filter in Cloud Security (InsightCloudSec)
Adds BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. Dataset Tables harvesting support in Cloud Security (InsightCloudSec)
Enables EDH actions TagResource and UntagResource for EFS in Cloud Security (InsightCloudSec)
Adds in-transit encryption support for auto-provisioned EDH queues in Cloud Security (InsightCloudSec)
Updates Databricks Workspace resource expansion with configuration fields and Private Network linkage in Cloud Security (InsightCloudSec)
Allows manual upload of product and content updates for offline environments in InsightVM/Nexpose version 8.13.0
Adds confirmation step requiring CONFIRM to be typed before deactivating console in InsightVM/Nexpose versions 8.11.0+ and InsightIDR Settings
Updates JunosOSVersionComparator logic and canCompare method for better version handling in InsightVM/Nexpose versions 8.11.0+
Adds support for CIS Google Chrome Benchmark 3.0.0 and CIS Microsoft Windows 11 Enterprise Benchmark 4.0.0 content in InsightVM/Nexpose
Adds User Attribution settings page in SIEM (InsightIDR) Settings for customizing account/user involvement in collected log activity
Adds optional fields to AWS GuardDuty event source form for SQS Messages and EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Instance Authentication methods in SIEM (InsightIDR)
Updates default date range for Investigation Details > Inspect Actor Activity to last 24 hours in SIEM (InsightIDR)
Consolidates InsightVM and Agent settings into a Command Platform Features tab in Settings for SIEM (InsightIDR)
Groups related fields with collapsible sections in the event source creation form in SIEM (InsightIDR)
Updates Threat Actor Activity Tracking prioritization by most recent activity in Intelligence Hub version 1.4.2
Adds stream line table search for campaigns and actor profiles by name and description in Intelligence Hub version 1.4.2
Adds domain-type IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. decay score in Intelligence Hub version 1.4.3
Enables partial prefix searches for threat actors/campaigns in Intelligence Hub version 1.4.3
Upgrades Java Runtime to version 17.0.15 and adds CIS Ubuntu 24.04 Benchmark v1.0.0 support in InsightVM/Nexpose version 8.9.1
Adds AI attack coverage configuration details for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Vulnerability Scanning in Application Security (InsightAppSec) AppSpider 7.5.019
53 details in Everything
└──▷ BREAKING ON UPGRADE
!Deprecated Insights and Compliance Packs will remain visible until their specified removal version, but the Switch to Legacy UI option is removed in Cloud Security (InsightCloudSec) System Settings.
!Legacy risk strategies—Temporal, TemporalPlus, Weighted, and PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. ASV 2.0—are deprecated in InsightVM/Nexpose and will cease support on January 21, 2026; users must switch to the Active Risk strategy.
Tenable One Identity Exposure 3.93 adds Exposure Center/Identity 360 UI, new AD IoEs, CSV export separator option, and TrustType/AAD support.
Exposure Overview feature for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. and/or Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. data
Exposure Instances feature (Entra ID only)
Identity 360 identity inventory across Active Directory and Entra ID
New Sensitive Exchange Permissions IoE
New Exchange Group Members IoE
+8 moreshow less
New Unsupported or Outdated Exchange Servers IoE
New Exchange Dangerous Misconfigurations IoE
New ADCS Dangerous Misconfigurations IoE
New Domain Without Computer-Hardening GPOs IoE checking Block NTLM over SMB
New Health Check domain health monitoring
trustType attribute now supports TTAAD (TRUST_TYPE_AAD) value
trustAttributes attribute now supports TDAV (TRUST_ATTRIBUTE_DISABLE_AUTH_TARGET_VALIDATION) value
CSV export separator option (comma or semicolon)
13 details in Everything
8 more releases in this issue
· 2025-06-02 → 2025-06-30
Adds PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. Internal Nessus Agent scan template for internal PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. 4.0 credentialed scanning
Tenable Agent now auto-enters safe mode on error, maintaining connection for remote recovery
Agent Safe Mode automatically activates when Tenable Agent encounters an error, disabling plugin compilation and scans while keeping the connection to Tenable One Vulnerability Management active.
Agents running version 10.9.0 or later are required to utilize this new safe mode capability.
Adds Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. Indicators of Exposure for password expiration and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. device requirements
New IoE Password Expiration Enforced detects domains enforcing password expiration policies that may lead to weak, predictable, or reused passwords.
New IoE Managed Devices Not Required for MFA Registration detects tenants lacking Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. Policies requiring managed devices for MFA registration.
Adds detection for BadSuccessor privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. in Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. dMSAs
BadSuccessor Dangerous dMSA Permissions indicator of exposure detects the BadSuccessor privilege escalation vulnerability in Windows Server 2025 dMSAs
DefectDojo 2.47.4 adds Lenovo and Tailscale vulnerability ID sources and new KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.-related fields on the finding model.
└──▷ GET THIS VERSION
$ git clone --branch 2.47.4 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.47.4
Adds Lenovo as a supported vulnerability ID source (VulnID).
Adds Tailscale as a supported vulnerability ID source (VulnID).
Adds KEV (Known Exploited VulnerabilitiesKnown Exploited VulnerabilitiesCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.)-related data fields to the finding model via database migration.
3 details in Everything
4 more releases in this issue
· 2025-06-02 → 2025-06-30
DefectDojo 2.47.3 adds user filtering by last_login/date_joined via API and renames Burp Enterprise to Burp DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces..
└──▷ GET THIS VERSION
$ git clone --branch 2.47.3 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.47.3
Enables filtering users by last_login and date_joined fields via the API.
Renames the Burp Enterprise integration to Burp DAST in settings.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Burp Enterprise is renamed to Burp DAST — any local_settings.py or settings.dist.py references to the old name may need to be updated.
DefectDojo 2.47.2 adds EUVDEUVDThe European Vulnerability Database, operated by ENISA, is the EU's official registry of disclosed software vulnerabilities, giving cyber tools a regional authoritative source for CVE-equivalent advisories. and Go vulnerability ID support to settings.
└──▷ GET THIS VERSION
$ git clone --branch 2.47.2 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.47.2
Adds EUVD (European Vulnerability Database) vulnerability ID type, configurable via settings.dist.py / local_settings.py.
Adds Go vulnerability ID type, configurable via settings.dist.py / local_settings.py.
DefectDojo 2.47.0 adds ELA/ALEA vuln IDs, Alibaba Cloud Linux 3 advisories, Anchorectl evaluations format, session timeout notifications, and tag comma-separation in import APIs.
└──▷ GET THIS VERSION
$ git clone --branch 2.47.0 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.47.0
└──▷ TRY IT
Import findings with multiple tags using comma separation in a multipart form — useful for CI pipelines that build tag lists as a single string.
Configure Celery log verbosity independently from the application log level to reduce noise in task workers.
ini
CELERY_LOG_LEVEL=WARNING
Adds ELA (Enterprise Linux Advisory) vulnerability ID support to findings.
Adds ALEA vulnerability ID support to findings.
Adds Alibaba Cloud Linux 3 Security Advisory as a supported scanner/parser.
Adds support for the new evaluations format in the Anchorectl parser.
Adds CVSSv4 support to the auditjs parser.
+10 moreshow less
Includes CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. score in findings when using the OpenVAS CSV parser.
Adds session timeout notification to alert users before their session expires.
Adds tag comma-separation support for multipart form submissions in import/reimport API endpoints.
Adds case-insensitive filters to the Dojo Meta API via migration to filterset_class.
Adds Product Announcements feature to surface messages on relevant features in the UI and API.
Enables browser native spell checker in the EasyMDE markdown editor.
Stores Bearer scanner fingerprint in unique_id_from_tool for more precise deduplication.
Helm chart now supports using an external ServiceAccount via serviceAccount configuration.
Celery logging now respects the CELERY_LOG_LEVEL setting.
Improved Excel export handling for finding groups with better logging.
15 details in Everything
└──▷ BREAKING ON UPGRADE
!Helm chart support for postgresql-ha is dropped; deployments using postgresql-ha will break on upgrade.
!Asynchronous import feature is removed; any workflows or configurations relying on async import will no longer function.
Edgescan adds Org ID to license exports, EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. investigation creation from ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. data, and configurable default jumpboxes.
Adds Org Id and Org name columns to Licence Utilization exports
Enables creation of EASM Investigations directly from existing ASM scan results
Sets Jumpbox and domain suffix as automatic defaults when only one exists in the organization
Vuls v0.33.1 strips image tags from server names when scanning containers with Trivy.
└──▷ GET THIS VERSION
$ git clone --branch v0.33.1 https://github.com/future-architect/vuls.git
# already have the repo? check out this version:$ git checkout v0.33.1
Removes image tag from server name automatically when scanning container images via the Trivy contrib integration, producing cleaner server identifiers.
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!When scanning with the Trivy integration, the server name no longer includes the image tag — any pipeline, report, or downstream tooling that matched on the tag-suffixed server name will need to be updated.
1 more release in this issue
· 2025-06-24 → 2025-06-25
$ git clone --branch v0.33.0 https://github.com/future-architect/vuls.git
# already have the repo? check out this version:$ git checkout v0.33.0
Adds Ubuntu 25.04 (Plucky) as a supported scan target.
Adds CVE detection support for Palo Alto and Cisco devices.
Detects Oracle Linux and Alpine Linux vulnerabilities via the vuls2 engine.
Adds ignore vulnerability pattern support in the vuls2 detector.
Adds RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 10 end-of-life data to OS metadata.
+3 moreshow less
Adds row separators to --format-list report output for improved readability.
Auto-downloads the vuls2 database when schema versions differ, removing manual intervention.
Opens the vulnerability database before the server starts, reducing first-request latency.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Oracle Linux and Alpine Linux now use the vuls2 detection engine (feat!(detector): detect oracle and alpine with vuls2), which may require a compatible vuls2 database and could change detection results on upgrade.
Nessus 10.9.0 adds triggered agent scans, offline web app scanning, and nessuscli optimization.
└──▷ TRY IT
Optimize the size and structure of the global configuration database on your scanner.
$ nessuscli system --config-optimization
Adds support for triggered agent scans via Tenable Nessus Manager
Enables web application scanning in air-gapped/offline environments
Adds ability to declare agent versions for Manager agent profiles in offline mode
Reports safe mode status from agents to Tenable Nessus Manager
Introduces nessuscli system --config-optimization command to optimize the global configuration database
+1 moreshow less
Adds --fedcloud parameter to link scanners to FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. environments
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The default debug report and backup file formats are changed from tar.gz to zip.
NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. integration adds filtering by site names and CIDRs.
netbox integration now supports filtering by site_name and cidr parameters to scope discovered assets.
runZero v4.0.250616.0 adds goal management permissions for Users, revises global goal scope, and updates task stats UI.
Users with an inherited or explicit role of User or above within the selected organization can now manage goals
Goals previously configured as global now apply to all currently existing organizations and no longer attach to new or future organizations unless explicitly configured to
Task statistics now display the total count of software and vulnerability records created
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Goals previously configured as global now apply to all currently existing organizations and no longer attach to new or future organizations unless explicitly configured to
runZero 4.0.250604.0 adds TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip.MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. and preserves site:scope in scan templates
Adds TOTP as an MFA option alongside existing WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. and PasskeyPasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices.
ProjectDiscovery Cloud 1.3 adds a new card-driven dashboard, drawer view for vulnerabilities, category filters, and HTTP wildcard auto-exclusion.
Adds cleanhttp-powered HTTP-based wildcard detection and exclusion to skip false positives by default
Adds a new card-driven dashboard highlighting total assets and open vulnerabilities with contextual charts
Adds a drawer view for the vulnerability visualization interface
Adds a category filter (e.g. SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly., Misconfig, RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives.) to single-click filtering across vulnerability data
Adds contains and not contains operators for custom filters supporting multiple values
Fleet 4.70.0 adds Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. conditional access, Android MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. enrollment, and richer host certificate reporting.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.70.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.70.0
└──▷ TRY IT
Override the default output filename when packaging a fleetd installer, useful in CI pipelines where artifact names must be deterministic.
Enable Android MDM and enroll a BYODBYODBring Your Own Device: a policy allowing employees to use personal phones, laptops, or tablets for work, creating a network of unmanaged endpoints that cyber tools must monitor or enforce policy on. device through the Fleet console.
📍In the Fleet console, go to Settings › Integrations › Mobile device management (MDM) and enable Android MDM, then share the enrollment link with the device user.
Adds Microsoft Entra ID conditional access support for both security engineers and IT admins.
Enables Android MDM support for enrolling BYOD devices.
Adds source and username fields to host certificates, reporting system or user based on keychain origin (macOS login keychain = user) and the corresponding username.
Adds a keychain column to the certificates card on host details and My Device pages.
Extends POST /api/v1/fleet/hosts/:id/wipe to allow specifying the remote wipe type for Windows hosts.
+7 moreshow less
Updates the vulnerabilities feed to fall back to non-primary CVSSv2/v3 sources when NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. data is unavailable, rather than omitting scores.
Updates custom SCEPSCEPSimple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention. proxy implementation to include one-time challenges.
Adds support for filtering the hosts page by any of the 3 batch script execution statuses.
Adds an audit log activity item for automatic install policy creation.
Adds new optional --outfile parameter to fleetctl package to override the generated filename.
Adds macOS Redis cluster support.
Implements team dropdown search in the UI.
12 details in Everything
└──▷ BREAKING ON UPGRADE
!The Open Policy Agent (OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic.) upgrade to v1.4.2 drops support for YAML 1.1 in configuration files: yes/on values must be changed to true and no/off values to false in any file passed via the -c option when starting the Fleet server.
!If your server was already using Android MDM via the experimental DEV_ANDROID_ENABLED=1 flag, you must turn off Android MDM before updating your Fleet server.
2 more releases in this issue
· 2025-06-04 → 2025-06-30
Fleet 4.69.0 adds bulk script execution on 5,000 hosts, SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. sync for Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. & Authentik, and Ubuntu 24.10/25.04 OVAL vuln detection.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.69.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.69.0
└──▷ TRY IT
Resend a failing configuration profile to all hosts where delivery failed, scoped by filter, without manually retrying each host.
Adds vulnerability detection via OVAL for Ubuntu 24.10 and 25.04.
Adds ability to sync end user IdP information with Microsoft Entra ID using the SCIM protocol.
Adds ability to sync end user IdP information with Authentik using the SCIM protocol.
Updates Windows 11 Enterprise CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. policies to version 4.0.
Adds new Detail Query luks_verify to verify whether the stored LUKSLUKSA disk-encryption standard built into the Linux kernel that stores encryption metadata in a header on the volume itself, letting cyber tools unlock encrypted drives portably across distributions and implementations. key is valid.
+18 moreshow less
Adds additional checks to vulnerability feed validation to prevent deploying an un-enriched NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. feed.
Adds SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hash of Mac applications to signature information in the host software response.
Adds FLEET_AUTH_SSO_SESSION_VALIDITY_PERIOD environment variable to override how long end users have to complete SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management..
Adds ability to execute scripts on up to 5,000 hosts at a time using filters.
Adds ability to run a script on all hosts matching the current set of supported filters.
Adds new API endpoint GET /scripts/batch/summary/:batch_execution_id for retrieving a summary of a batch script execution's current state.
Adds endpoint POST /api/v1/fleet/configuration_profiles/resend/batch to resend a profile to all hosts satisfying a filter.
Adds a starter library automatically applied to all new Fleet instances during setup.
Adds ability to uninstall software via the Self-service tab of My device.
Adds FLEET_MDM_SSO_RATE_LIMIT_PER_MINUTE environment variable to increase MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. SSO endpoint rate limit and split it into its own rate limit bucket.
Adds UI to filter hosts by config profile status.
Adds UI for viewing custom profile status and batch-resending profiles to hosts where delivery failed.
Adds filtering for host endpoints by MDM config profile and status.
Adds immediate cancellation of profile delivery when a profile is deleted.
Adds ability to turn off MDM for iPhone and iPad hosts from the host details page.
Adds Neon to the list of detected Linux distributions.
Adds ability for GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. mode to add a custom package on the software page and copy/paste the YAML needed for packages that cannot be referenced with a URL.
Adds copyable SHA256 hash to the software details page.
23 details in Everything
└──▷ BREAKING ON UPGRADE
!GitOps users: SSO settings, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. settings, Features, and MDM end-user authentication settings are now cleared if omitted from YAML files in a GitOps run — ensure these settings are present in your global YAML settings file before the next GitOps run.
Adds FLEET_MDM_SSO_RATE_LIMIT_PER_MINUTE to configure MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. rate limiting
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.68.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.68.1
WinGet v1.11 adds stable DSC v3 support and device configuration export; experimental font management
└──▷ GET THIS VERSION
$ git clone --branch v1.11.400 https://github.com/microsoft/winget-cli.git
# already have the repo? check out this version:$ git checkout v1.11.400
Stable support for exporting Windows Settings, WinGet packages, and package settings via the configure export command.
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!Dropped support for running on 32-bit ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. architectures.
1Password for iOS 8.10.82 adds PasskeyPasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. support on FileKey and refines Autofill wording.
Enables PasskeysPasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. usage with the FileKey platform on iOS
Updates Autofill Behavior menu text to Only fill on this exact host including port numbers
2 details in Everything
8 more releases in this issue14 more releases in this issue · 2025-06
Adds data-1p-ignore and data-op-ignore attributes to disable autofill on specific fields
Allows developers to add data-1p-ignore or data-op-ignore HTML attributes to prevent 1Password from offering to save or fill on two-factor authentication or single-sign-on fields
1Password SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Manager June 2025 adds AI contract extraction depth control, contract export with attachments, manual license management, and review exports.
Adds Settings > Contracts configuration to choose AI extraction depth for integrated contracts (App only, Overview fields, or Detailed extraction).
Enables exporting contracts with their associated documents via bulk action Export with attachments to a zip file with an Excel/CSV index.
Adds Settings > Notifications management for access review notifications (email and Slack) including intelligent batching.
Adds Export reviews option in access review exports to create a zip file containing individual app review exports plus the master list file.
Adds manual license addition via the new Add license option in the App view’s Utilization section.
+1 moreshow less
Allows manually added licenses to be selected across SaaS Manager including the User tab, Access level settings, User list imports, and Contract view picklists.
1Password for Android Beta adds PasskeyPasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. support on Samsung FileKey hardware keys
PasskeysPasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. now work on FileKey (Samsung hardware key)
Autofill Behavior menu wording updated to clarify that ports are included in the Only fill on this exact host check
1Password for iOS adds PasskeyPasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. support on FileKey and refines Autofill domain wording.
PasskeysPasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. now work on FileKey.
1Password for Linux 8.10.82-27 beta updates Autofill Behavior menu wording and improves error logging.
The Only fill on this exact domain option in the Autofill Behavior menu is now labeled Only fill on this exact host with ports included in the description.
June 19, 20253 releases · 2025-06-04 → 2025-06-19Stable
Updated Users List with column management, free-text search, saved views, bulk actions, and export to JSON/CSV in Admin Portal.
Adds Column Management to the Admin Portal Users List page to customize displayed user information
Replaces legacy dropdown filters with a free text search field and multi-select filter UI in the Users List
Enables saving private or public named Views of the Users List for later reuse in the Admin Portal
Adds Bulk Actions (add to groups, change state, send reset TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. emails) directly from the Users List selection
Allows exporting current view, selected users, or all data as JSON or CSV files from the Users List
5 details in Everything
2 more releases in this issue
· 2025-06-04 → 2025-06-19
JumpCloud adds targeted Password Policies with precedence for user groups and SaaS ManagementSaaS ManagementA category of software that tracks, governs, and optimises an organisation's portfolio of SaaS subscriptions, covering spend, access, and licence utilisation from a single control plane. V3 with Security Insights.
Introduces Password Policies feature allowing customized complexity, aging, lockout, and recovery settings applied to specific user groups
Adds configurable policy precedence to resolve conflicts when users belong to multiple groups with different password rules
Releases SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Management V3 featuring Security Insights for shadow/shared/former employee detection and OAuth risk analysis via supported connectors
Enables automated email notifications for admin alerts on new SaaS app discoveries, account changes, and upcoming license renewals in SaaS Management
Replaces the legacy aside view with a full-page Applications interface and introduces an Export Attribute Mapping list for SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. configuration
Adds property mapping to override proxy host header
└──▷ GET THIS VERSION
$ git clone --branch version/2025.6.1 https://github.com/goauthentik/authentik.git
# already have the repo? check out this version:$ git checkout version/2025.6.1
1 more release in this issue
· 2025-06-04 → 2025-06-06
Adds name field to RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. Permissions search and new documentation for sessions in database and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. lookup.
└──▷ GET THIS VERSION
$ git clone --branch version/2025.6.0 https://github.com/goauthentik/authentik.git
# already have the repo? check out this version:$ git checkout version/2025.6.0
This release introduces proactive management capabilities for application subscriptions, allowing teams to anticipate renewal dates and receive detailed financial forecasts via automated nudges to their billing contacts.
Nudge Security vApp allows admins to annotate app entries with custom notes, enhancing visibility of application context within the platform's user interface.
Adds a new field in the App Info card of the App Details Page for admins to add custom notes for applications
Nudge Security adds a browser extension for real-time SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. and genAI guardrails.
Adds a browser extension to monitor SaaS and genAI usage with real-time visibility of login activity, API key copying, and file uploads.
Enables detection of identity risks like weak passwords, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. bypass attempts, and unapproved password managers via the new extension.
Delivers automated browser nudges to guide employees toward compliant SaaS and genAI choices.
Full user profile now included in id_token for SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. attribute mapping
Custom SAML attributes now flow through the id_token and are available for mapping in Jsonnet.
New behavior for continue_with payload and verification redirect on login/registration
require_verified_address hook now triggers a pre-filled verification flow redirect for new Ory Network projects to enforce address verification before authentication.
show_verification_ui is removed from the default continue_with array in registration flows unless the show_verification_ui post-registration hook is defined or kratos_feature_flags_legacy_continue_with_verification_ui flag is enabled.
Ory Network adds LINE as a supported OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. (OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.) identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
Keycloak 26.4.0 adds PasskeysPasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices., DPoPDPoPAn IETF standard that binds an OAuth access token to a specific client's cryptographic key pair, so a stolen token cannot be replayed by an attacker who lacks the matching private key. support, FAPI 2 compliance, Federated Client Auth preview, and automated SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. cert management.
Adds fapi-2-dpop-security-profile and fapi-2-dpop-message-signing client profiles for FAPI 2 compliance
Enables Passkeys authentication via the Authentication > Policies > Webauthn Passwordless Policy UI toggle
Adds support for OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. DPoP tokens on Admin REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and Account REST API endpoints
Allows public clients to bind only refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. to DPoP, omitting access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. binding
Supports requiring the dpop_jkt parameter in OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication requests
+3 moreshow less
Adds Federated Client Authentication preview for SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials.JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. SVIDs and Kubernetes service account tokens
Automates SAML client certificate rotation via the Metadata descriptor URL setting in Signature and Encryption section
Exposes OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 Authorization Server Metadata via well-known URI compliant with RFC 8414 for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. integration
8 details in Everything
└──▷ BREAKING ON UPGRADE
!None explicitly documented as breaking; multi-site terminology updated to multi-cluster
sudo v1.9.17 adds SUDO_TTY env var, hardens timing-attack resistance, and enables ignore_dot by default.
└──▷ GET THIS VERSION
$ git clone --branch v1.9.17 https://github.com/sudo-project/sudo.git
# already have the repo? check out this version:$ git checkout v1.9.17
Adds SUDO_TTY environment variable when the user has a terminal, enabling scripts to find the original tty device when sudo runs in its own pseudo-terminal.
Suggests using ssh's -t option when sudo is run via ssh without a terminal and a password is required.
The ignore_dot sudoers setting is now on by default, hardening PATH against current-directory injection; a new --disable-ignore-dot configure option allows opt-out.
Adds new Cantonese translation for sudo.
Uses TCSAFLUSH instead of TCSADRAIN when disabling echo, ensuring buffered password input is discarded and never echoed.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The ignore_dot sudoers setting is now on by default; existing setups that rely on . in PATH being honored will break unless --disable-ignore-dot is used at build time or ignore_dot is explicitly set to off in sudoers.
Acronis Cyber Protect combines backup, disaster recovery, and endpoint protection in one platform for businesses and managed service providers.
Acronis Cyber Protect 2025-06 adds Azure DR, EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device./Defender integration, global AV exclusions, AI patch scoring, workflow automation (EAP), and Alma Linux support.
Adds Microsoft Azure as a new Disaster Recovery destination with wizard-driven configuration in the Acronis console.
Integrates Acronis EDR detections with Microsoft Defender AV for centralized visibility and management via protection plans.
Enables global Antivirus & Antimalware exclusion entries at the partner level to apply policies across all customer tenants.
Adds AI-powered Patch Deployment Scoring in Acronis RMM to assess patch stability before deployment.
Integrates Cloud Management Portal Copilot with the Acronis Knowledge Base for enhanced troubleshooting support.
+2 moreshow less
Makes Workflow Automation available via Early Access Program (EAP) for alert noise reduction and automated response actions.
Adds Alma Linux 8.x and 9.x support for Disaster Recovery workloads.
Druva is a SaaS data protection platform that backs up enterprise workloads, endpoints, and SaaS applications and restores them after ransomware.
Druva adds Data Exception Rules with real-time alerts and Prerequisite Checks for Dynamics 365 backups.
Adds Data Exception Rules to safeguard Dynamics 365 data by setting thresholds for record additions, updates, or deletions and receiving real-time alerts when activity exceeds expected patterns.
Adds Prerequisite Checks feature that automatically validates permissions for backup and restore operations in Microsoft Dynamics 365, displaying a banner with issues if checks fail.
2 details in Everything
10 more releases in this issue
· 2025-06-02 → 2025-06-28
Druva adds Quarantine Bay to isolate EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. and EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. recovery points for ransomware response.
Salesforce Backup now enforces a configurable minimum 90-day retention period to aid regulatory compliance.
Enables configuring a minimum retention period of 90 days for Salesforce backup data
Optimizes snapshot listing by automatically eliminating old entries based on configured retention settings
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Retention periods set to a lower value cannot be increased later, making the 90-day minimum effectively permanent for the lifetime of that configuration.
Druva's June 2025 update introduces Quarantine Bay for AWS snapshot isolation.
Adds Quarantine Bay under Cyber Resiliency > Ransomware Recovery for isolating infected AWS Workloads (EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. and EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. Volume) snapshots
Druva adds Azure subscription deletion, Azure SQL PITR, Cyber Recovery Insights for VMware, and CloudCache R3 with Azure storage support
Adds Azure Subscription Deletion to the Management Console, allowing irreversible removal of Azure subscriptions and their associated backup data directly from the UI.
Introduces Point-in-Time Restore (PITR) for Azure SQL databases, enabling selection of precise timestamps in the restore workflow.
Adds Cyber Recovery sub-tab under the Backups tab on the Configured VMs page for VMware, providing actionable insights for cyber recovery events.
Adds a new Trends tab on the Configured VMs page showing VMware recovery points data for the last 30 days.
Expands CloudCache R3 support to include Azure storage for Files Server, Nutanix AHVAHVAcropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license., VMware, NAS, and Oracle DTC workloads.
+2 moreshow less
Adds a Transient recovery point state in CloudCache R3 for recovery points past retention but syncing to the cloud.
Enhances CloudCache R3 visibility by displaying total counts of unsynced recovery points per backup set and unsynced backup sets per device.
Introducing Recovery Intelligence with Cyber Recovery and Trends tabs for VMware restores
Adds the Cyber Recovery tab to the VMware Backups restore workflow to surface real-time threat indicators including anomalies, encryption status, malware presence, and antivirus scan results.
Adds the Trends tab within the VMware interface to visualize 30-day security insights via graphs for recovery points data trends and file activity anomalies.
Druva adds SSH encryption key selection and cross-account key usage for EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. and EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. restores
Adds support for cross-account key usage, enabling seamless restoration of air-gapped backups of EC2 instances and EBS volumes from unencrypted sources across multiple AWS accounts.
Druva extends IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. sets to all Accelerated Ransomware Recovery license holders and adds a Microsoft Sentinel plugin for Copilot investigations.
Makes Druva Published IOC Sets available to all customers with an Accelerated Ransomware Recovery license
Veeam Kasten is a Kubernetes-native platform for backing up, restoring, and migrating containerized applications and their persistent data.
Kasten K10 8.0.2 adds cacertconfigmap.key Helm parameter and SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. location profile support alongside CSICSIAn ambiguous acronym spanning Container Storage Interface, Crime Scene Investigation, and other expansions — without more context about which domain this tool operates in, a reliable definition cannot be given. ephemeral volume allowance.
└──▷ TRY IT
Set a custom key for the CA certificate bundle ConfigMap when the default key does not match your organisation's bundle structure.
Commvault Cloud is a backup, recovery, and cyber-resilience platform for hybrid, multi-cloud, and SaaS workloads.
Commvault 11.40 adds Cleanroom Recovery to AWS, CrowdStrike integration, Threat Scan on Azure VM restores, and bulk restore for Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments..
Adds Azure VM support for Threat Scan on restores to allow proactive malware detection during recovery
Introduces CrowdStrike Integration to combine Falcon threat intelligence with backup recovery workflows
Enables AWS Support for Cleanroom Recovery in SaaS for automated instance conversion into Amazon EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware.
Adds Active Directory forest recovery capability with parallel domain controller restoration and FSMO role handling
Enables Entra ID: Bulk restore of objects to recover hundreds or thousands of deleted items in one operation
+4 moreshow less
Adds Microsoft Sentinel Connector to pull threat indicators into Sentinel via API integration
Introduces Minimize False Positives with advance encryption detection using machine learning for ransomware identification
Supports Threat Scan Integration with Azure Cleanroom providing detailed reporting and automated alerts within the Cleanroom environment
Adds Region Support for Backup and Recovery of a Control Plane allowing upload to specific regions for targeted recovery
Netskope Inline App Connector AC-127 supports Google Gemini Business/Enterprise Gems activities and WeTransfer file names
Adds Google Gemini app connector support for creating, editing, and deleting Google Gemini Gems with OpenAI API integration and instance ID differentiation
Adds Object/File name extraction support for single file uploads in WeTransfer applications
Netskope v127 adds CFW SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy, Enterprise Browser watermarking/screenshot blocking, SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. Box support, and new Device Classification capabilities.
Adds TCP SOCKS Proxy Support for Cloud Firewall (CFW), allowing TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. traffic to be routed through a Netskope SOCKS5 proxy.
Enables Screenshot and Screen Sharing Browser Protection Policies in the Enterprise Browser to block capture of sensitive content.
Introduces Watermarking as a new Enterprise Browser Protection control to deter unauthorized screen captures.
Adds Box Support to SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPM) with new predefined rules and resource types.
Enables Define Running Hours for Next Generation API Data Protection retroactive scans to limit operational impact.
+3 moreshow less
Extends Device Classification to check for Non-Exportable Private Key in certificates on Windows and macOS.
Adds REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. v2 CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. support for Device Classification objects.
Allows AND/OR logical operators between criteria in Device Classification rules within the web UI.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!The app_category field is deprecated from all SSPM REST API v2 requests and responses starting July 10, 2025.
!Azure AD Identity entities (Application, ServicePrincipal, User, Group) are deprecated in CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps.; no new data will be ingested for them after June 30, 2025.
Bytebase 3.7.1 adds use_ssl field for Terraform database connection SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certificates and moves Review Center to /plans.
└──▷ GET THIS VERSION
$ git clone --branch 3.7.1 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 3.7.1
└──▷ USE IT
Configure a database resource in Terraform to enforce SSL connections.
Plan.spec field earliest_allowed_time removed; use run_at in BatchRunTasksRequest for scheduling
Plan fields steps and target renamed to specs and targets respectively
PlanService.PreviewPlanRPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. removed from the API
ChangeDatabaseConfig now uses release field and has dropped BASELINE from Type and schema_version
Support batch data export from multiple databases or a database group via issue
+5 moreshow less
Support batch data export from limited databases in the SQL Editor
Trino supports data masking
MariaDB supports sql_type in risk condition
SQL Server supports columnstore index
EARLIEST_ALLOWED_TIME setting removed; use SCHEDULED_TIME during rollout
10 details in Everything
└──▷ BREAKING ON UPGRADE
!The earliest_allowed_time field is removed from Plan.spec; migrate to using run_at in BatchRunTasksRequest
!The steps and target fields are removed from Plan; use specs and targets respectively
!The PreviewPlan RPC is removed from PlanService
!For ChangeDatabaseConfig, the BASELINE value is removed from Type, the schema_version field is removed, and a new release field is added
!Setting names are updated to match SettingName proto definitions; existing configurations may need mapping updates
Varonis MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. launch simplifies AI agent execution for data security workflows.
Releases the Varonis MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server to simplify how customers use AI tools and agents to execute complex workflows.
Aembit Edge API for dynamic credential retrieval and expanded Wiz Discovery for Client/Server Workloads
Adds Aembit Edge API endpoint to retrieve credentials on-demand for CI/CD pipelines and serverless functions without deploying additional infrastructure.
Expands Wiz Discovery integration to discover Client Workload resources including VMs, AWS Client Workload Identifies, and Azure Client Workload Identifies.
Expands Wiz Discovery integration to discover Server Workload resources including Azure Blob Storage and GCP BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data..
3 details in Everything
2 more releases in this issue
· 2025-06-02 → 2025-06-17
Adds Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support for Sophos Connect Client on Windows with SFOS 21.5+
└──▷ HOW TO FIND IT
Configure Windows clients to use Entra ID for authentication instead of passwords when connecting via Sophos Connect.
📍Steps: In the SFOS management console, configure Azure AD/Entra ID as an authentication source. Distribute a provisioning file or group policy that enables Use SSO in the Sophos Connect Client settings on Windows machines targeting SFOS 21.5+.
Private Access adds negative match operators to Custom Controls for AppProtection
Adds negative value operator options (Does not match, Does not contain, Does not start with, Does not end with, and Does not exist) to Custom Controls for AppProtection configuration
Allows selecting negative request method options (Not Get, Not Put, etc.) in Custom Controls
2 details in Everything
31 more releases in this issue
· 2025-06-02 → 2025-06-30
Cloud Connectors now support TLS tunnel mode and TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. optimization with SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. learning
Adds TLS as a selectable ZIA tunnel mode for Cloud Connectors, allowing fallback detection that switches from Unencrypted UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. or DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. to TLS when the tunnel is unhealthy.
Adds an integrated TCP optimization module on Cloud Connectors that learns SNI and maintains a database of IP addresses, FQDNs, and wildcard FQDN mappings to optimize HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic without routing DNS through the connector.
Zscaler Breach Predictor adds SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integration, User Threat Profile page, and AI Assist dashboard
Adds Integration with SIEM Applications via the Breach Predictor Portal to send event data for holistic threat visibility.
Introduces the User Threat Profile page (Breach Predictor Portal > Users) with an Overview tab of charts/graphics and a Users List tab for individual user details, broken down by MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. stage, department, threat type, and geography.
Rolls out various updates to the Breach Predictor Portal improving look, feel, usability, with new charts, graphs, filtering options, and updated data visibility.
Adds AI Assist Dashboard (limited availability) using AI/ML for dynamic threat views, customized recommendations, Breach AI Agents monitoring overview, and dynamic prompts from any screen.
Zscaler Cellular adds CSV export for SIM lists, tag-based filtering, dashboard navigation, and refresh buttons
Total Usage field now shows aggregated data usage across SIMs in the current view on the SIMs page
SIMs page supports filtering SIMs using tags from the SIMs or SIM details page
Added option to download the list of SIMs with details as a CSV file from the SIMs page
Dashboard widgets (Total SIMs, Used SIMs, and SIM State Overview) now link directly to the SIMs page with appropriate filters applied when clicking numerical values
Added Refresh button to specific pages (SIMs, Network Events, and Login Tracker) to fetch and display the latest data
Zscaler Client Connector introduces PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file retrieval for WebView2 auth and macOS reconnectT2OnWake config parameter
Adds PAC file retrieval to pass proxy settings to WebView2 during enrollment
Adds reconnectT2OnWake parameter in Application & Custom settings to enable quick reconnect after sleep on macOS
ZIA adds Salesforce client-side onboarding, DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. macros/EDM-IDM support, API endpoints, and file type EUNs.
Adds GET /casbDlpRules, POST /casbDlpRules, GET /casbDlpRules/all, GET /casbDlpRules/{ruleId}, PUT /casbDlpRules/{ruleId}, and DELETE /casbDlpRules/{ruleId} endpoints to manage Data at Rest Scanning DLP policies programmatically
Adds GET /casbMalwareRules, POST /casbMalwareRules, GET /casbMalwareRules/all, GET /casbMalwareRules/{ruleId}, PUT /casbMalwareRules/{ruleId}, and DELETE /casbMalwareRules/{ruleId} endpoints to manage Advanced Threat Protection malware rules programmatically
Adds three new inline web DLP macros for notification templates: ${DEPARTMENT}, ${FILESIZE}, and ${REFERRER_URL}
Enables Exact Data Match (EDM) and Indexed Document Match (IDM) dictionaries and engines in Outbound Email DLP policy rules
Adds support for Custom Browser end user notifications (EUN) with a new Browser Notification Template field in File Type Control policy rules
+4 moreshow less
Adds redaction profile support for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Data at Rest Scanning DLP to mask sensitive data using asterisk (*) or hash (#)
Adds ability to specify trusted users and trusted domains as exemptions in SaaS Security Data at Rest Scanning DLP policies
Adds filtering by Sandbox API Key Name in Web Insight Logs via the API Key Name column category
Expands Onboarding Options for Salesforce to support custom, client-side connector onboarding with minimum set credentials
ZIA adds custom Browser EUN templates for File Type Control and Microsoft IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. support for 3rd-Party App Governance
Adds Browser Notification Template field to File Type Control rule configuration in the ZIA Admin Portal to display custom notifications on endpoints when access is blocked or cautioned.
Adds support for Microsoft as an Identity Provider (IdP) in the 3rd-Party App Governance Admin Portal to authenticate admins and users for Advanced SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. connections.
New STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. VM PSE image available for Nutanix on ZPA
Zscaler Deception adds Gen AI adaptive decoys, Azure integration, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, and macOS agent customization.
Deploys Gen AI adaptive decoys that dynamically adjust responses using generative AI
Creates Generative AI decoys in Microsoft Azure using OpenAI models
Configures IPv6-enabled subnets/VLANs and deploys Internal decoys with dual-stack support
ZIA adds DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. macro support, NSS feed app filtering, Zoom tenant support, Browser Control API, and Sandbox token limits.
Adds ${DEPARTMENT}, ${FILESIZE}, and ${REFERRER_URL} inline web DLP macros for notification templates
Adds webApplicationsExclude and nwApplicationsExclude attributes to the ZmanageNssFeed model in the /nssFeeds API endpoints
Adds support for configuring Zoom as a SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Application Tenant for Data at Rest Scanning policies
Adds GET /browserControlSettings and PUT /browserControlSettings endpoints to the Browser Control Policy API category
Adds new ML-based DLP dictionaries for ID Card, Medical Imaging, Satellite Data, and Schematic Data detection
+5 moreshow less
Adds Endpoint DLP support for predefined dictionaries: CNPJ Number (Brazil), Mexico Unique Population Registration Code, National Economic Registry Number (Poland), Personal Identification Number (Croatia), and Unique Master Citizen Number
Adds fetchLocations query parameter to the GET /locations/groups endpoint to retrieve associated locations
Adds new Allowlist support for URLs and MD5 file hashes in Advanced Threat Protection (ATP)
Supports up to 5 Sandbox API Tokens with filtering by Sandbox API Key Name in Web Insight Logs
Enables custom, client-side connector onboarding for Salesforce using a minimum set of credentials
10 details in Everything
└──▷ BREAKING ON UPGRADE
!The CSV import format for Custom IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. signature rules now requires comma-separated values to be enclosed in three single quotes (''') instead of double quotes (")
ZIA adds AWS CLI tenancy support, SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. user lookup for outbound email DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., and NSS feed fields
Adds Tenancy Restriction support for Amazon Web Services CLI via Tenant Profiles.
Adds SCIM-based user lookup to Zscaler Outbound Email DLP to map email addresses with ZIA login names.
Allows the %s{sender} field in NSS Feed Output Format for Email DLP logs.
ZIA adds Dedicated IP/Geo IP forwarding, Zoom/Workday/Webex SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. support, ATP allowlisting, and new API endpoints.
GET /dedicatedIPGateways/lite endpoint added to retrieve dedicated IP gateways
webApplicationsExclude and nwApplicationsExclude attributes added to ZmanageNssFeed model for excluding applications in NSS feeds
fetchLocations query parameter added to GET /locations/groups endpoint to fetch associated locations
New Dedicated IP forwarding method available in ZIA forwarding policies to use provisioned source IPs
New Geo IP forwarding method available in ZIA forwarding policies to map source IPs to traffic origin country
+10 moreshow less
New Dedicated IP page in Administration menu with Gateways and IP Addresses tabs for managing dedicated IP resources
Sandbox API Token Support allows up to 5 tokens with a 10-character name limit
Web Insight Logs can now be filtered by API Key Name column category
Advanced Threat Protection (ATP) now supports adding URLs and MD5 file hashes to an Allowlist
SSPM Scan checkbox added for onboarding Workday tenants with Advanced SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications.
SSPM Scan checkbox added for onboarding Webex Teams tenants with Advanced SSPM
SaaS Security Data at Rest Scanning policies now support Zoom tenant configuration
Quarantine Tombstone Template can be selected when quarantining files in the Assets Report
Default limit for File Type Control Policy rules increased to 2,048 from 1,024
GET /browserControlSettings and PUT /browserControlSettings endpoints added for Browser Control Policy management
ZPA adds GCEGCEGoogle Compute Engine, Google's infrastructure-as-a-service platform for running virtual machines in the cloud; cyber tools use it for scalable, on-demand compute without managing physical hardware. support for agent groups and a Microsegmentation Overview Dashboard with new widgets
Adds Agent Admin Status inheritance display to show whether the setting is inherited from the agent group or set individually at the agent level
Adds Google Compute Engine metadata discovery (cloud region, project name, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. name) for agents in Microsegmentation agent groups
Adds a new Microsegmentation Overview Dashboard containing Protected-to-Unprotected Resources and Protected-to-Unprotected Resource Groups widgets
ZIA adds Gen AI prompt configuration for Writer and Deepseek via new API fields.
Adds enableDeepSeekPrompt and enableWriterPrompt Boolean fields to the AdvancedUrlFilteringCloudAppOptions model in the /advancedUrlFilterAndCloudAppSettings API endpoint
Extends Gen AI prompt configuration capabilities to the Writer and Deepseek generative AI applications for categorization and storage
Zscaler DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Data Analyst role, AI Security tab dashboard, data duplication detection, AWS evidence/timeline, new posture policies, and unmanaged DB scanning.
Adds the Data Analyst predefined DSPM role for users who need access to evidence data displayed on the Evidence tab
Adds an AI Security tab to the DSPM dashboard providing insights into generative AI services accessing sensitive data stores, including total AI services deployed, accessible data stores, exposed sensitive data volume, accessible files/tables, and open alerts
Adds a Data Duplications page that detects duplicate files and displays details for corrective action to reduce attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources.
Adds Evidence generation for sensitive data findings (currently for AWS resources) allowing validation against DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engines and dictionaries, and a Timeline tab on the Data Inventory page for AWS data stores showing configuration change history
Adds new data posture policies for AWS (including EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware., RDS, S3, Bedrock/Knowledge Base), Azure (including PostgreSQL, AI Foundry Hub), and GCP (Cloud SQL/MySQL/MS SQL) covering encryption, access control, logging, and recovery misconfigurations
ZIA adds Gen AI prompt config for Writer/Deepseek/Grok, SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. user lookup for Email DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., and Webex SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. support
webApplicationsExclude and nwApplicationsExclude attributes added to ZmanageNssFeed model in /nssFeeds API to exclude specific applications from NSS logs
fetchLocations query parameter added to GET /locations/groups endpoint to fetch associated locations for a group
enableDeepSeekPrompt and enableWriterPrompt Boolean fields added to AdvancedUrlFilteringCloudAppOptions model in /advancedUrlFilterAndCloudAppSettings API
enableGrokPrompt Boolean field added to AdvancedUrlFilteringCloudAppOptions model in /advancedUrlFilterAndCloudAppSettings API
SCIM-based user lookup support for Zscaler Outbound Email DLP to map email addresses with ZIA login names
+5 moreshow less
%s{sender} field added to NSS and Cloud NSS feed output format for Email DLP logs
Default limit for File Type Control Policy rules increased to 2,048
Support for Zoom as a tenant in SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Data at Rest Scanning DLP and Malware policies
Tombstone Template selection added when quarantining files to user root folder in Assets Report
SSPM Scan support for Webex Teams tenants in SaaS Security Posture Management
10 details in Everything
└──▷ BREAKING ON UPGRADE
!CSV import for Custom IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. signature rules now requires three single quotes (e.g., ''') instead of double quotes (") to enclose comma-separated values
Workflow Automation enhances incident management with frozen column headers and refined sorting options on the Incidents page
Incident table column headings are now frozen (always visible) when scrolling through multiple pages of incidents
Incident sorting is restricted to specific attribute columns, excluding Transaction ID, Last Change Date, Source DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Type, Labels, Status, Engine, Dictionary, Rule, Dictionary Match Count, Action, Last Change, Incident Groups, Justification Reason, Justification Note, Username, Client IP, File MD5, Home Location, Work Location, File Source Location, File Modification Time, Resolution Date, and Integration
Zscaler DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Data Analyst role, AI Security dashboard insights, duplicate file detection, evidence/timeline for AWS inventory, and unmanaged DB scanning.
Adds the Data Analyst predefined DSPM role for data investigation, analysis, and evidence access
Introduces the AI Security tab on the DSPM dashboard with detailed insights into generative AI services accessing sensitive data
Adds a Data Duplications page to detect and display details of duplicate files containing sensitive data
Adds evidence data for AWS sensitive data discoveries to validate findings against DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engines and dictionaries
Adds a Timeline tab on the Data Inventory page for AWS data stores to view configuration and management changes
+1 moreshow less
Introduces new predefined data posture policies for AWS, Azure, and GCP covering encryption, access control, AI guardrails, and backup settings
ZPA adds API Discovery for API Protection, existing IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. support in Business Continuity, automated updates, and hosting detection.
Adds API Discovery capability for API Protection to identify protected APIs automatically.
Enables use of existing IdP configurations for user authentication during Business Continuity events.
Adds status code SE: Timeout policy blocked access when ZPA blocks Web Browser requests due to timeout policies.
Enables automatic detection or manual entry of data center hosting information for App Connectors.
ZIA adds Gen AI prompt fields for Writer/Deepseek via API and supports Zscaler-Managed Business Continuity Cloud
Added enableDeepSeekPrompt Boolean field to AdvancedUrlFilteringCloudAppOptions model in /advancedUrlFilterAndCloudAppSettings APIs to enable generative AI prompts with Deepseek
Added enableWriterPrompt Boolean field to AdvancedUrlFilteringCloudAppOptions model in /advancedUrlFilterAndCloudAppSettings APIs to enable generative AI prompts with Writer
Support for Zscaler-Managed Business Continuity Cloud service using Private Policy Cache and Private PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. Server components
Prevent the ZTNA agent from sending on-premises traffic through the ZTNA tunnel, avoiding unnecessary hairpinning of internal traffic.
📍In the Sophos Central console, navigate to ZTNA › Settings, enable Don't intercept on-premises traffic, and save the configuration.
Give remote users seamless access to directory-backed resources by registering a domain controller as an agent-based resource.
📍In the Sophos Central console, navigate to ZTNA › Resources, select Add resource, choose Agent-based, and specify your domain controller as the target host.
Adds the ability to prevent the ZTNA agent from intercepting on-premises traffic.
Adds support for adding a domain controller as an agent-based resource to provide seamless connectivity to resources behind it.
Adds Azure DevOps bot joining method, desktop latency detector in UI, and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. http-post binding support
└──▷ GET THIS VERSION
$ git clone --branch v17.5.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.5.1
└──▷ USE IT
Configure a bot in Azure DevOps to join your cluster automatically without manual token management.
yaml
# In your Teleport Cluster configuration or plugin spec:
kind: join
method: azure_devops
Use the http-post binding for SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. when your IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. requires it for enhanced security.
📍# In the Teleport web UI under Zero Trust Access / Auth Connectors › Edit Connector:
preferred_request_binding: http-post
Introduces the azure_devops join method for secretless authentication of bots in Azure DevOps pipelines.
Adds latency measurement displays in the Teleport Connect web UI during remote desktop sessions to monitor user-to-proxy and proxy-to-host lag.
Enables SAML http-post binding via the new preferred_request_binding: http-post field in SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. connector configurations.
Exposes Teleport service cache health metrics via Prometheus for monitoring infrastructure reliability.
Conveyor adds per-questionnaire customization of AI prompts and verbosity
Enables custom verbosity and free response prompt settings for individual security questionnaires or RFPs in the Conveyor web app and browser extension
Vanta adds bulk Adaptive Framework Scoping by resource group, redesigned Azure DevOps code-changes auditor (beta), Pen Test import from Assets, and Wiz Vulns GA integration.
Adds Adaptive Framework Scoping capability to bulk mark resources in/out of scope by resource group for frameworks like PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. and ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27017
Introduces redesigned /code-changes auditor pages (beta) with support for Azure DevOps review groups
Enables direct access to Penetration Tests from the Assets > Vulnerabilities section for streamlined visibility
Makes the Wiz Vulns and Alerts integration generally available (GA) for all customers
4 details in Everything
4 more releases in this issue
· 2025-06-01 → 2025-07-05
New Oracle Cloud integration, auditor action restrictions, and test SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. customization in Vanta.
Adds Test SLA Customization allowing users to customize a test’s SLA category to adjust priority or assign different SLAs based on organizational needs
Introduces Oracle Cloud GA integration featuring new product tests, expanded networking component support, region editing, and multi-tenant configurations
Provides compliance settings to limit auditor actions by preventing auditors from creating audits, modifying controls, or adding additional auditors
Vanta adds Vanta MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. integration, GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. policies in Policy Builder, and new test visibility UI.
Adds Vanta MCP Server (Public Preview) to interact with Vanta data using LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. for audit prep and automated remediation
Expands Policy Builder with two new GDPR policy templates alongside SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. and ISO 27001
Adds failing test entities by segment view on the Test Details page
Adds framework-specific tests table in the Tests section for streamlined navigation
Consolidates comment threads into a new Comment Notifications inbox
+1 moreshow less
Redesigns the AWS Integration Overview Page with tabs for overview, capabilities, prerequisites, permissions, synced resources, and automation details
Personal email tracking for 17 Merge HRISHRISHuman Resources Information System — software that centralises employee records, payroll, and org data. Cyber tools integrate with it to tie identities and access rights to authoritative HR records. platforms, QAuto column adjustments, and TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. review locking.
Adds personal email tracking support for 17 additional Merge HRIS platforms to expand visibility into employee data.
Enables adjusting answer columns in spreadsheet questionnaires and selectively re-running AI responses for unapproved answers in QAuto.
Allows marking TPRM questions as reviewed to lock the primary answer while retaining visibility of latest AI and vendor responses.
Drata Agent 3.8.0 adds Ubuntu 24.04 support with AppArmorAppArmorA Linux kernel security module, maintained as part of the kernel, that confines programs to a declared set of files, capabilities, and network access — letting cyber tools sandbox processes without writing custom kernel code. profiles, Dutch/Spanish/German/French UI, dark/light tray themes, and reduced data collection.
Adds Ubuntu 24.04 compatibility via a default AppArmor profile installed with the agent
Expands language support to Dutch, Spanish (Latin America), German, and French with automatic selection during registration
Enables manual switching between light and dark system themes in the tray menu
3 details in Everything
2 more releases in this issue
· 2025-06-06 → 2025-06-20
Drata adds Cyber EssentialsCyber EssentialsA UK government-backed certification scheme that defines a baseline set of technical controls organizations must implement to defend against common cyber threats, giving cyber tools a compliance benchmark to assess or report against. UK 3.2 framework support with pre-mapped controls
Adds Group column support in CSV import for automatic employee-to-group assignment.
When the auto-create-and-assign import option is selected, creates missing groups from the Group column with a default checklist; the alternative single-group option ignores that column.
1 detail in Everything
23 more releases in this issue
· 2025-06-17 → 2025-06-30
Scrut adds Sophos Central (MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.) integration for automatic device sync and compliance testing
Scrut adds Cyber EssentialsCyber EssentialsA UK government-backed certification scheme that defines a baseline set of technical controls organizations must implement to defend against common cyber threats, giving cyber tools a compliance benchmark to assess or report against. v3.2 framework with full control mapping for UK compliance.
Adds Cyber Essentials v3.2 to the Frameworks module as a new supported framework
Enables viewing mapped controls and linking them to existing policies and evidence
Allows assigning control owners and tracking compliance in real time
Supports cross-mappings with ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, NIST, and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. frameworks
Provides export of detailed readiness reports for certification or internal audits
In Limited Beta for select customers, adds reusable Policy Variables; contact your CSM for access.
In Limited Beta, Policy Variables settings define reusable placeholders such as {{organization_name}} for policy templates.
Updates propagate to policies using the variable, with impact visibility and preview/download; after initial submission, variables can only be edited from an existing policy file.
Automates software compliance checks in the People module by integrating MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. device data into checklists.
Adds Install Required Software checklist item.
Supports Scrut Agent and NinjaOne monitoring agents.
Allows any version or specific version selection for OS-targeted software.
Two-way task sync and access reviews now available for Asana integration in Scrut
Adds two-way task sync between Scrut and Asana so tasks completed in Asana update their status automatically in Scrut.
Adds Access Reviews for Asana allowing users to evaluate user access, roles, inactive accounts, and overprivileged accounts across Asana workspaces directly within the Scrut platform.
Enhances the SentinelOne integration with access-review data and endpoint threat syncing.
Enhances SentinelOne integration to sync user names, emails, roles and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. status into Access Reviews.
Syncs SentinelOne threats into Vulnerability Management with threat name, status and severity; owner email is matched through HRMS where available.
Scrut Monitor adds Microsoft Intune integration for automated device evidence collection
Integrates with Microsoft Intune to automatically fetch device metadata (ID, name, AV status, encryption status, OS, etc.) and attach it to Evidence Tasks
Consistent file preview with zoom, fullscreen, and search across Policies, Evidence, and Vault modules
Adds zoom and full-screen controls to the universal file preview modal
Enables Cmd + F / Ctrl + F in-document search within the preview modal
Expands supported file formats for preview to include .xlsx.xlsxThe file format used by Microsoft Excel for spreadsheets, based on the Open XML standard. Cyber tools use it to ingest or export structured tabular data in a format analysts already work with., .xls, .csv, .eml, .doc, .docx, .ppt, .pptx, .mp4, .pdf, .jpg, .jpeg, and .png
Adds a Show rows per page dropdown to tables for customizable pagination.
Adds a new Show rows per page dropdown at the bottom of major platform tables (Controls, Policies, Evidence Tasks, Tests, Vendor & Risk Management, Trust Vault, Audit Center) allowing users to display 10, 20, 50, or 100 rows.
Introduces dynamic default row counts: 10 rows per page when a single table is present on the screen, and 5 rows per page when two or more tables are visible.
Allows editing the SR/OV couple of strategic scenarios in CISO Assistant v2.6.3
└──▷ GET THIS VERSION
$ git clone --branch v2.6.3 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.6.3
└──▷ HOW TO FIND IT
Update the strategic risk or organizational value linked to a scenario via the UI.
📍In the Strategic Scenarios view, select a scenario and use the edit form to modify the SR/OV couple.
Edit the SR (Strategic Risk) / OV (Organizational Value) pair for existing strategic scenarios
1 detail in Everything
6 more releases in this issue
· 2025-06-01 → 2025-06-30
CISO Assistant v2.6.2 adds Cisco CCF v3.0 mappings, keeps implementation scores on audit Excel export, and displays user groups in the users list.
└──▷ GET THIS VERSION
$ git clone --branch v2.6.2 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.6.2
Adds Cisco CCF v3.0 mappings for framework coverage
Keeps both implementation and documentation scores on audit Excel export
Adds Ebios RM badge for risk assessments in CISO Assistant v2.6.1
└──▷ GET THIS VERSION
$ git clone --branch v2.6.1 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.6.1
Risks created from Ebios RM studies now display a dedicated ebios-rm badge.
CISO Assistant v2.6.0 adds Post-Quantum CryptographyPost-Quantum CryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. framework support and a new API endpoint to update requirements.
└──▷ GET THIS VERSION
$ git clone --branch v2.6.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.6.0
Adds the Post-Quantum Cryptography (PQC) Migration Roadmap (May 2025) as a new supported cyber tooling framework
Adds a new API endpoint to update requirements, implemented via Prefect integration
CISO Assistant v2.5.11 adds NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. v2↔ISO 27001:2022 mapping, NIST SP-800-66 Rev2 mappings, FINMA 2023/01 framework, and evidence attachments in follow-ups.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.11 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.5.11
Adds NIST CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. v2 to ISO 27001:2022 cross-framework mapping to the library.
Adds NIST SP-800-66 Rev2 mappings and mapping tools to the library.
Adds FINMA 2023/01 framework and framework tool to the library.
Supports attaching evidence directly within follow-up items.
CISO Assistant v2.5.10 adds Cisco CCF v3.0 support, global evidence in compliance assessments, and OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. ASVS 5.0.0.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.10 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.5.10
Adds Cisco CCF v3.0 Framework + Framework Tool for new compliance coverage
CISO Assistant v2.5.9 adds PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. authentication for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server and multi-set requirement mapping.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.9 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.5.9
MCP server authentication switches to Personal Access Token (PAT) based validation
Handle multiple requirement mapping sets within libraries simultaneously
New mapping suggestion feature to assist with library mappings
Adds service_tier configuration option for the Groq provider to control service tier selection
Enables Anthropic prompt caching for tool results and tool usetool useA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions. calls in provider configurations
Portkey Data Service 1.2.3 adds configurable FINETUNE_STATUS_CHECK_INTERVAL and BATCH_STATUS_CHECK_INTERVAL environment variables for fine-tuning and batch processing
Adds FINETUNE_STATUS_CHECK_INTERVAL configuration to control provider fine-tuning status check frequency
Adds BATCH_STATUS_CHECK_INTERVAL configuration to control provider batch processing status check frequency
Portkey Enterprise Gateway v1.11.4 adds Bedrock AssumedRole, Anthropic computer use tool, Azure Redis auth, HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. proxy, and more.
Adds AssumedRole support for Bedrock application inference profiles
Adds multimodalmultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats.embeddingsembeddingsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. support for Cohere and Titan providers
Adds support for Bedrock createTranscription, createTranslation, imageGeneration, batch, and files endpoints via Azure Foundry
Adds Anthropic computer use tool support
Adds file_url and mime_type fields for file content parts in Anthropic requests
+7 moreshow less
Adds Gemini/Vertex Thinking mode support in VertexAI
Adds Azure Redis authentication modes: EntraID and ManagedIdentity
Adds separate REDIS_USERNAME and REDIS_PASSWORD environment variables for Redis Cache auth
Adds azure-redis value for the CACHE_STORE environment variable to enable Azure Redis Cache
Adds AZURE_REDIS_AUTH_MODE, AZURE_REDIS_MANAGED_CLIENT_ID, AZURE_REDIS_ENTRA_CLIENT_ID, AZURE_REDIS_ENTRA_CLIENT_SECRET, and AZURE_REDIS_ENTRA_TENANT_ID environment variables for Azure Redis Cache configuration
Adds HTTPS proxy support via the HTTPS_PROXY environment variable for all external calls
Adds virtual key inclusion in custom logs when passed via headers
Adds OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. traces collector endpoint, Data Plane log exports, and new provider parameters
Adds the /v1/otel/v1/traces endpoint to collect OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. spans as Portkey traces.
Enables log exports on the Data Plane, allowing logs to be exported without sending them to the Control Plane (requires Dataservice).
Adds support for background and service_tier parameters for OpenAI providers.
Adds support for custom hosts and private links for Azure Plugins.
microsandbox v0.2.6 adds a configurable host argument to the msb server start command
└──▷ GET THIS VERSION
$ git clone --branch microsandbox-v0.2.6 https://github.com/superradcompany/microsandbox.git
# already have the repo? check out this version:$ git checkout microsandbox-v0.2.6
Added --host flag to the msb server start subcommand and the msbserver binary
Promptfoo tests, evaluates, and red-teams LLM applications to detect vulnerabilities and compare model outputs.
Adds OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. tracing, PROMPTFOO_MAX_EVAL_TIME_MS env var, ModelAudit /model-audit UI, and new red team plugins.
└──▷ USE IT
Run evaluations with an automatic timeout to prevent CI/CD pipeline hangs during long-running checks.
shell
PROMPTFOO_MAX_EVAL_TIME_MS=30000 promptfoo eval
Adds OpenTelemetry tracing support to visualize execution flow and debug performance bottlenecks in complex RAGRAGRetrieval-augmented generation: looking up relevant documents and adding them to the prompt before the model answers. It grounds responses in private or current data without retraining. pipelines.
Adds PROMPTFOO_MAX_EVAL_TIME_MS environment variable to prevent runaway evaluations from consuming excessive resources.
Adds ModelAudit UI accessible at /model-audit when running promptfoo view, featuring drag-and-drop file selection and live scanning progress.
Adds support for scanning SafeTensors format and HuggingFace URLs directly in ModelAudit.
Adds System Prompt Override plugin to test LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. deployments for system instruction manipulation vulnerabilities.
+1 moreshow less
Adds Intent plugin support for JSON file uploads with nested arrays to define multi-step attack sequences.
AI-Infra-Guard v2.5 adds file size to list_dir, multi-param agent support, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. prompt improvements
└──▷ GET THIS VERSION
$ git clone --branch v2.5 https://github.com/Tencent/AI-Infra-Guard.git
# already have the repo? check out this version:$ git checkout v2.5
list_dir now displays file sizes in its output
Agent framework refactored to support multiple parameters
MCP plugin prompts optimized for better interaction
3 details in Everything
1 more release in this issue
· 2025-06-06 → 2025-06-12
AI-Infra-Guard v2.4.1 adds parallel processing for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. scanning to reduce latency.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.1 https://github.com/Tencent/AI-Infra-Guard.git
# already have the repo? check out this version:$ git checkout v2.4.1
Enables parallel execution for MCP (Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) scans to significantly improve scan throughput.
ToolHive v0.1.0 adds new CLI auto-discovery flow and a logs API endpoint
└──▷ GET THIS VERSION
$ git clone --branch v0.1.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.1.0
Added logs API endpoint to expose tool execution logs programmatically
New CLI-based client auto-discovery flow with bulk registration and unregistration operations
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The previous auto_discovery logic has been removed from the CLI, replaced by the new client registration setup; users must use the new bulk registration/unregistration workflow.
ToolHive v0.0.48 adds network isolation with ingress/egress proxies, Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. support, and bulk API endpoints
└──▷ GET THIS VERSION
$ git clone --branch v0.0.48 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.0.48
Initial support for network isolation using ingress and egress proxies for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers
Support for the Streamable HTTP protocol for MCP servers
New --server flag on the regup command to target specific server updates
Implemented API for unregistering clients
Implemented new bulk workload API endpoints
+4 moreshow less
Stop and restart operations are now asynchronous; added a new stop all operation
Workload deletion is now asynchronous
Allows tokens to expire and refresh automatically
Adds MongoDB, Playwright, and Notion MCP servers to the registry
ToolHive operator CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. v0.0.7 adds unregistering clients API, async restart/stop/deletion, secret provider setup, and streamable HTTP client support
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.7 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.7
Implements an API for unregistering clients to remove them from the server's registry.
Adds a new explicit secret provider setup mechanism that forces its use for encrypted providers.
Makes workload deletion asynchronous via Make workload deletion asynchronous capability.
Makes stop operation async and adds a stop all operation for broader control.
Makes restart an async operation to improve responsiveness during client lifecycle management.
+3 moreshow less
Adds support for streamable HTTP clients, enabling new protocol handling in MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers.
Allows isolating container network only when desired via only isolate container network when desired logic.
Uses a different port for ingress proxy by default via the use different port for ingress proxy update.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Force OS keyring for encrypted provider changes the underlying storage mechanism for secrets, potentially requiring migration of existing secret data.
ToolHive v0.0.47 adds comprehensive OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. integration for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. proxies
└──▷ GET THIS VERSION
$ git clone --branch v0.0.47 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.0.47
Helm chart gains Multi-Namespace Support to scope operator watches across multiple namespaces.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.0.10 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.0.10
└──▷ TRY IT
Deploy the operator to watch a specific list of namespaces instead of just one or all.
ToolHive v0.0.40 adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms./OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth for proxy/management APIs, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. audit logging, and registry API.
└──▷ GET THIS VERSION
$ git clone --branch v0.0.40 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.0.40
toolhive mcp start proxy command now supports --oauth, --oidc-issuer-url, and related flags to enable OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0/OIDC authentication
Management API server gains OIDC authentication support via --oidc-* flags
MCPServer CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. in the operator adds spec.auditLog and spec.auth fields for MCP audit logging and OIDC middleware configuration
ToolHive Operator CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. add OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. middleware config to MCPServer CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. and OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms./OIDC support for the proxy command.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.6 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.6
Adds OIDC fields to the MCPServer CRD spec to enable OIDC middleware configuration
New audit log middleware for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers and ability to override annotations/labels on operator resources
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.5 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.5
ToolHive v0.0.39 adds thv inspector, registry URL management, Windows support, and Cline auto-discovery.
└──▷ GET THIS VERSION
$ git clone --branch v0.0.39 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.0.39
└──▷ USE IT
Debug an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server using the built-in inspector container
shell
thv inspector <server-name>
thv inspector subcommand spawns an MCP inspector container for debugging
set, get, and unset commands for managing registry URLs
$ git clone --branch v0.8.0 https://github.com/bytedance/varmor.git
# already have the repo? check out this version:$ git checkout v0.8.0
Adds PodServiceEgressControl feature for restricting access to pods and services
Supports defining multiple ports and port ranges for network egress rules
Adds a pod-self entity to restrict containers from accessing the IP of the Pod they are located in
Adds an unspecified entity to restrict containers from accessing the 0.0.0.0 and ::
Adds a localhost entity to restrict containers from accessing the loopback address
+3 moreshow less
Adds the ingress-nightmare-mitigation built-in rule
Supports injecting metadata into the violation event
Supports BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. enforcer removal from existing policies
New YARA-based output guardrail for code injection detection and Clavata community integration
└──▷ GET THIS VERSION
$ git clone --branch v0.14.0 https://github.com/NVIDIA-NeMo/Guardrails.git
# already have the repo? check out this version:$ git checkout v0.14.0
Adds fuzzy find provider capability to the CLI (nemo-guardrails providers fuzzy-find <query>) allowing practitioners to locate available guardrail providers via shell command.
Adds inline YARA rules support in the output guardrail configuration (setting type: yara_inline and providing rule: <yaml_string>), enabling direct code-injection detection without external files.
Adds a new community integration for Clavata LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. content moderation (provider type clavata) accessible via library configuration or CLI provider selection.
Adds support for preserving and applying guardrails to reasoning traces, controlled by the config key preserve_reasoning_traces (boolean) in Rail YAML definitions.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The config key remove_thinking_traces is renamed to remove_reasoning_traces; existing YAML files using the old name will fail validation or ignore the setting.
!The deprecated argument return_context is removed; code passing this argument to library functions will raise an error.
Obsidian v1.9.2 introduces a new Bases formula syntax, new file properties, and searchable filter operators.
Adds object-oriented file.name.contains() formula syntax replacing contains() function calls
Adds chainable property access like property.split(' ').sort()[0].lower()
Adds note["Property Name"] syntax for referencing properties with spaces or special characters without backticks
Introduces link, date, and list type conversion functions
Exposes new file properties: file.path, file.links, and file.tags
+5 moreshow less
Replaces dateBefore() function with < comparison operators for dates
Enables direct date modification using + operator (e.g., date("01/01/2025") + "1 year")
Updates .base file format to include a new properties section for configuration like displayName
Makes Bases filter operators dropdown searchable
Allows Table cells with long text to expand to show full content when selected in the view
10 details in Everything
└──▷ BREAKING ON UPGRADE
!Bases formula syntax has changed: contains(file.name, "Books") is replaced by file.name.contains("Books") and property names no longer require backticks.
!The .base file format now requires a properties section for configurations like displayName.
The code-oss project is an open-source code editor combining editing, debugging, and extensibility for developers across Windows, macOS, and Linux.
VS Code 1.101 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. auth, prompts/resources/sampling, debug mode, tool sets, and GitHub Copilot Coding Agent integration.
└──▷ GET THIS VERSION
$ git clone --branch 1.101.0 https://github.com/microsoft/vscode.git
# already have the repo? check out this version:$ git checkout 1.101.0
Adds MCP support for prompts, resources, and sampling to expand agent coding workflows.
Enables authentication for MCP servers that require it.
New MCP development mode for debugging MCP servers.
Supports publishing MCP servers directly from an extension via new extension APIs.
Introduces Chat tool sets to group and manage related tools together.
+2 moreshow less
New Source Control History Item Details view for browsing files changed in a commit.
Integrates GitHub Copilot Coding Agent assignment and tracking directly within VS Code.
SysReptor 2025.56 adds bulk note management, CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. hierarchy in PDFs, and incremental markdown parsing.
└──▷ GET THIS VERSION
$ git clone --branch 2025.56 https://github.com/Syslifters/sysreptor.git
# already have the repo? check out this version:$ git checkout 2025.56
Adds incremental parsing in the markdown editor for faster, more responsive editing.
New user setting to disable local login, enabling enforcement of external authentication.
Provides parent CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes. in PDF rendering, giving fuller vulnerability classification context in reports.
Enables copying of individual notes within projects.
Supports bulk delete and bulk export of notes for faster note management at scale.
+1 moreshow less
Adds multi-select in the notes tree UI for operating on multiple notes at once.
kustomize v5.7.0 adds static replacement values, Image Volume support, and Helm devel alias for chart references.
└──▷ GET THIS VERSION
$ git clone --branch kustomize/v5.7.0 https://github.com/kubernetes-sigs/kustomize.git
# already have the repo? check out this version:$ git checkout kustomize/v5.7.0
└──▷ USE IT
Use a static literal value as a replacement source instead of pulling it from an existing resource field.
kustomize api v0.20.0 adds static value sources for replacements, Image Volume support, and Helm devel alias for chart references.
└──▷ GET THIS VERSION
$ git clone --branch api/v0.20.0 https://github.com/kubernetes-sigs/kustomize.git
# already have the repo? check out this version:$ git checkout api/v0.20.0
└──▷ USE IT
Use a static literal value as a replacement source instead of pointing to a field in a resource.
Kali 2025.2 introduces MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. menu organization, CARsenal car hacking set, smartwatch WiFi injection, and new tools like crlfuzz and tinja.
└──▷ USE IT
Copy network interface IP directly to clipboard using the newly default-installed xclip utility
shell
ip a | grep inet | xclip -selection clipboard
Kali Menu reorganized to follow MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&ACK framework structure for tool discovery
BloodHound Community Edition upgrade with full ingestor set (azurehound, bloodhound-ce-python, sharphound)
xclip pre-installed across all desktop environments by default
New GNOME VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. IP Extension showing connection IP in panel with copy-to-clipboard
+5 moreshow less
NetHunter on TicWatch Pro 3 supports wireless injection, de-authentication, and WPA2 handshake capture
CARsenal car hacking tool set renamed and updated with hlcand, VIN Info, CaringCaribou, ICSim modules
New Kali NetKernel for Samsung Galaxy S10 (exynos9820) and Realme C15
Raspberry Pi 5 supported by combined 64-bit image; kernel upgraded to 6.12 with brcmfmac nexmon driver
Cloudflare is a connectivity cloud platform delivering internet security, performance, and developer infrastructure services.
Cloudflare Magic Transit now supports AS prepending for BYOIPBYOIPBring Your Own IP — a cloud provider feature letting customers move their own publicly routable IP blocks into the provider's network, so traffic to those addresses routes through the cloud without renumbering. prefixes, enabling smoother traffic migration and minimizing packet loss during provider changes.
31 more releases in this issue
· 2025-06-02 → 2025-06-30
Cloudflare extends its remote bindings beta to Next.js developers, allowing local development sessions to interact with live D1, KV, and R2 resources via the @opennextjs/cloudflare adapter.
Email Routing now enforces SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders. or DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit. authentication for forwarded emails starting July 3, 2025
└──▷ BREAKING ON UPGRADE
!Emails sent to Cloudflare Email Routing without valid SPF or DKIM signatures will fail to forward after July 3, 2025.
Cloudflare One Agent for iOS 1.11 adds post-quantum cryptographypost-quantum cryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. and toggles QLogs via UI.
Adds post-quantum cryptography support to the WARP tunnel for enabled devices
Includes DNS over HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic in the WARP tunnel by default
Cloudflare One Agent for Android 2.4.2 adds default DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring. in tunnel and post-quantum cryptographypost-quantum cryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA..
Adds Enable qlogs toggle under Settings > Advanced > Diagnostics > Debug Logs to control QLog generation
Includes DNS over HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic in the WARP tunnel by default
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The QLog setting from previous releases is no longer respected; use the new Enable qlogs toggle instead.
Cloudflare introduces Code Sandboxes, enabling Workers to execute untrusted code in isolated container-like environments.
getSandbox() and Sandbox from the new @cloudflare/sandbox module allow Workers to spawn isolated execution environments for running AI-generated or untrusted code safely.
@cloudflare/actors library beta introduces Actor class, storage helpers, and alarm scheduling for Durable Objects.
Introduces the new @cloudflare/actors SDK package in beta for building applications on Durable Objects.
Adds a named Actor class pattern that allows accessing Durable Objects without manually writing the communicating Worker, with default routing to a default DO name.
Exposes a static nameFromRequest method on the Actor class for routing requests to specific Durable Objects by name.
Adds Storage helper class imported from @cloudflare/actors/storage for querying embedded SQLite and managing SQL schema migrations.
Includes alarm helpers within the SDK for scheduling multiple alarms using dates, delays in seconds, or cron expressions.
Cloudflare Zero Trust now provides a Data Security Analytics dashboard in the Insights section, enabling security teams to track sensitive data movement trends and inventory stored data across SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. and cloud platforms.
cloudflare-typescript (4.4.1) and cloudflare-python (4.3.1) add a structured object interface for programmatic Worker deployments that replaces manual multipart/form-data construction.
client.workers.scripts.update() method accepts a metadata object with main_module, bindings, and compatibility_date alongside a files map, handled automatically by the SDK.
AutoRAG now returns custom metadata in search responses and supports a context field to guide LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. answers.
Returns object custom_metadata inside the attributes > file section of /search and /ai-search response payloads
Supports passing an optional context field in object custom metadata to provide additional guidance for AI-generated answers
Cloudflare adds wrangler dev --x-remote-bindings and experimental_remote to allow local Workers to connect to deployed D1, KV, R2 resources
└──▷ TRY IT
Test local code against real production R2 data without redeploying.
$ wrangler dev --x-remote-bindings
Adds the --x-remote-bindings flag to wrangler dev to enable proxying binding calls to deployed Cloudflare resources during local development.
Introduces the experimental_remote boolean field in wrangler.toml or package.json bindings to enable remote access for specific D1, KV, or R2 bindings.
Enables integration with the Cloudflare Vite Plugin and Vitest Plugin for remote binding support in development workflows.
Cloudflare Gateway changes policy evaluation order: Network policies now evaluated before HTTP policies.
Gateway evaluates Network (Layer 4) policies before HTTP (Layer 7) policies, changing the enforcement sequence from DNS→HTTP→Network to DNS→Network→HTTP.
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!Block notifications for domains blocked by both HTTP and Network policies will now reflect the Network policy's notification setting (or silence), as the Network policy triggers first.
Wrangler v4.20+ supports run_worker_first array in assets config for granular SPA routing.
Adds support for an array of route patterns in the run_worker_first config key within .wrangler/config/toml or wrangler.json to control which routes invoke a Worker script for Single Page Applications.
Cloudflare adds a Workers Platform (Read-only)IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role for read-only access to Workers, Pages, Durable Objects, KV, R2, Zones, Zone Analytics, and Page Rules.
Renames the existing Workers Admin role to Workers Platform Admin.
Workers Builds now injects CI, WORKERS_CI_COMMIT_SHA, and other env vars by default.
Adds automatic injection of CI, WORKERS_CI, WORKERS_CI_BUILD_UUID, WORKERS_CI_COMMIT_SHA, and WORKERS_CI_BRANCH environment variables during Workers Builds.
Enables overriding injected defaults or adding custom environment variables via the Worker Settings page.
New centralized Account-Level Load Balancing UI and Private Load Balancers for private network traffic management.
Adds centralized Account-Level Load Balancing UI to view, configure, and monitor all load balancers across every zone in an account from a single interface.
Introduces Private Load Balancers to distribute traffic to applications hosted within private networks via WARP & Magic WAN integration.
New Bindings tab in Cloudflare dashboard visualizes and allows modifying Worker architecture diagrams.
Adds the Bindings tab to any Workers application in the Cloudflare dashboard, providing a visual diagram of the architecture and support for adding and managing bindings directly from the interface.
Cloudflare launches Beta for User Groups, SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. sync, and revamped Permission Policies UI to simplify IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. at scale.
Adds the User Groups IAM primitive for creating collections of account members with inherited permission policies, creatable via API
Introduces SCIM User Groups beta to sync memberships directly from upstream identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. like Okta or Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.
Visually overhauls the Permission Policies UI to improve definition of role-based access for specific principals
THE CYBER TOOLCHAIN
NO. -013