The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
Nmap 7.96 adds parallel forward DNS, new NSE scripts for Mikrotik and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only., Zenmap dark mode, Ncat -q, and Nsock engines via --nsock-engine.
Adds mikrotik-routeros-version, mikrotik-routeros-username-brute NSE scripts and new service probes for MikroTik WinBox.
Adds targets-ipv6-eui64 NSE script to generate IPv6 addresses from MACs using EUI-64.
Adds Zenmap dark mode, accessed via Profile->Toggle Dark Mode or the window::dark_mode config key in zenmap.conf.
Nmap now allows specifying targets on both the command line and in an input file (-iL) simultaneously without ignoring command-line targets.
Nmap can now scan IP protocol 255.
+2 moreshow less
Adds Ncat option -q to delay quit after EOF on stdin, matching traditional netcat behavior.
Allows setting Nsock engines (e.g., iocp, poll) via the new CLI argument --nsock-engine=<engine>.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!Ncat in connect mode no longer defaults to half-closed TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections (use -k to restore old behavior).
ldeep 1.0.86 adds formatting and filtering for DNS records in LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. enumeration.
└──▷ GET THIS VERSION
$ git clone --branch 1.0.86 https://github.com/franc-pentest/ldeep.git
# already have the repo? check out this version:$ git checkout 1.0.86
Adds format and filter options for DNS records returned during LDAP enumeration.
New Decision-Maker, Job Title filters and Department-Based grouping in Domain Search UI with selective email reveal.
└──▷ HOW TO FIND IT
Use the new Job Title filter in Domain Search to find specific roles for a given domain.
📍1. Go to Domain Search in the dashboard
2. Input the target domain
3. Select Job Title from filters and enter the desired role
4. Review results grouped by department
Use the Decision-Maker filter to quickly identify key contacts within a company.
📍1. Go to Discover in the dashboard
2. Enter the target company name
3. Use the new Decision-Maker tab (crown icon) to filter highlights
Adds a Decision-Maker filter (tab with crown icon) to highlight decision makers in Domain Search results
Adds a Job Title filter to domain search functionality, allowing users to filter results by specific roles
Enables department-based grouping of found emails in the search interface
Introduces controlled email reveal, allowing users to browse and pick contacts before consuming credits
4 details in Everything
1 more release in this issue
· 2025-05-13 → 2025-05-14
netdiscover 0.20 adds full CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. subnet support and an updated OUI table.
└──▷ GET THIS VERSION
$ git clone --branch 0.20 https://github.com/netdiscover-scanner/netdiscover.git
# already have the repo? check out this version:$ git checkout 0.20
└──▷ TRY IT
Scan a specific CIDR subnet to discover live hosts and their MAC vendors in one shot.
$ netdiscover -r 192.168.1.0/24
Adds full CIDR subnet notation support for targeted network discovery ranges.
Updated OUI table for more accurate vendor identification of discovered hosts.
GhostESP v1.5 adds ESP32C5 support, DHCP-Starve attack, AirTag spoofing, and new CLI/API surfaces
└──▷ GET THIS VERSION
$ git clone --branch v1.5 https://github.com/GhostESP-Revival/GhostESP.git
# already have the repo? check out this version:$ git checkout v1.5
Adds station selection capability to the existing select command for targeting specific stations.
Adds a new timezone command to set the device timezone using a POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. TZ string.
Enables passing a custom DIAL device name via CLI argument for ESP32C5 and other targets.
Adds DHCP-Starve attack capability under the Attacks category.
Adds AirTag selection and spoofing support under Spoofing & Tracking.
+6 moreshow less
Adds Flipper Zero RSSI tracking capability.
Adds custom beacon SSID list management and spam functionality under Beacon Management.
Adds ESP32C5 hardware support (with some channel limitations noted).
Bruce 1.10 adds Sub-GHzSub-GHzRadio frequencies below 1 GHz (typically 300–900 MHz) used by IoT devices, key fobs, garage doors, and industrial sensors; cyber tools target this band to capture, replay, or analyze those wireless signals. raw recording, iBeacon/Airtag detection, PN532Killer RFID support, and WebUI background mode
└──▷ GET THIS VERSION
$ git clone --branch 1.10 https://github.com/BruceDevices/firmware.git
# already have the repo? check out this version:$ git checkout 1.10
Adds Sub-GHz Raw Recording app for capturing raw RF signals
Adds spectogram visualization to subghz module
Adds listening capability to rf signals
Adds Ninebot Scooter Tuning via BLE UART interface
Adds Quick IR Setup feature for Infrared configuration
+7 moreshow less
Adds Simple IR jammer functionality
Adds PN532Killer support via UARTUARTA hardware protocol for serial communication between devices, transmitting data one bit at a time over two wires. Cyber tools use it to access embedded device consoles and debug interfaces without a network stack. for RFID operations
Adds MFRC522 module support for RFID reading
Adds FeliCaFeliCaA contactless smart card standard developed by Sony, widely used in Japanese transit and payment systems, operating at 13.56 MHz with its own proprietary protocol distinct from ISO 14443. support for RFID/NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. operations
Codacy Guardrails MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. now supports Windows via WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host. and auto-updates rules on Git load.
Codacy Guardrails documentation is launched for reference.
Codacy Guardrails MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server now runs on Windows environments via Windows Subsystem for Linux (WSL).
Automatic Rule File Updates on Git Load: When the MCP Server is installed, loading a Git repository will now automatically update the rules file.
Veracode Platform now displays CLI-performed container and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scan results with filtering, severity counts, history, and mitigation guidance.
Displays the results of container and IaC scans, performed from the CLI, on the Veracode Platform
Provides the severity count of scan findings, categorized as critical, high, medium, and low
Allows you to filter and search findings
Presents scan history for each asset to help you track changes in findings reported
New action_type filter in Veracode Reporting API Audit Log report
Adds action_type query parameter to the Reporting REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. Audit Log endpoint for filtering by user actions
New GitLab Workflow Integration enables automated Static, SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scanning from a central location
└──▷ HOW TO FIND IT
Access the new GitLab integration to automate scanning across your repository fleet.
📍Contact Veracode Technical Support to request access to GitLab Workflow Integration
GitLab Workflow Integration automates scans for thousands of repositories from a single location
GitLab Workflow Integration allows Static Analysis, Software Composition Analysis (SCA), and Infrastructure as Code (IaC) scans in a single workflow
GitLab Workflow Integration eliminates the need to configure workflows for individual repositories
Supports autopackaging for Java, .NET, JavaScript, and Python repositories within the GitLab integration
Veracode Scan for Eclipse v1.3.5 adds COBOL and JSP fix suggestions and a new SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. download source
Adds Veracode Fix support for generating flaw suggestions in COBOL projects.
Adds Veracode Fix support for generating flaw suggestions for flaws identified in JSP files.
Enables skipping the vulnerable method analysis during scans in your IDE.
Changes the SCA agent download source from Download.sourceclear.com to Sca-downloads.veracode.com.
Reporting REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. adds Audit Log report generation for detailed user activity queries
Veracode introduces a new EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. capability to assess digital footprint and cyber hygiene.
PR Comments early access for Bitbucket Server adds issue summary and inline comments to pull requests.
Adds Issue Summary Comment for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. via Pull Request Experience section in SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integration settings
Adds Inline Comments for SAST findings (CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances., Priority Score, Snyk Learn URL) via Pull Request Experience section in SCM integration settings
Plans an In Direct Dependency column and filter for Snyk Reports, Snowflake Data Share and the Export API on June 5
Planned for June 5: adds an In Direct Dependency column to issues-centered reports in Snyk Analytics (Issues Detail, Issues Summary, Vulnerabilities Detail, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. Management) to identify vulnerable direct dependencies.
Planned for June 5: adds an In Direct Dependency filter in Snyk Analytics to narrow down results to vulnerabilities present in direct dependencies.
Planned for June 5: adds the In Direct Dependency column and filter to the Snowflake Data Share as part of a new table.
Planned for June 5: exposes the In Direct Dependency data via the Export API in the Issues dataset.
Plans Issues Summary Report progress indicators, dimension picker, expandable views and default filters for June 3
Planned for June 3: #open issues, #new issues, #resolved issues, and MTTR metrics now include a percentage of progress indication in the Issues Summary Report
Planned for June 3: added Table Dimension Picker to the Risk Breakdown table for comparative analysis by asset class or introduction category
Planned for June 3: added expandable view for the Risk Breakdown table, allowing on-demand drill-down into underlying issues without navigation
Planned for June 3: set Issues Severity and Asset Class as default filters in the Issues Summary Report
Snyk Open Source announces Conan package support through SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. workflows and the package issues API, with GA starting May 22, 2025
Announces vulnerability and license intelligence for Conan packages in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. or SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. SBOM workflows, with general availability starting May 22, 2025.
Snyk Essentials adds Project Context on Assets GA with filtering by org and scan details
Adds Project Context on Assets feature to view which Snyk Projects and Organizations each asset belongs to.
Enables viewing key scanning details for assets, including last scan time and surface (SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. or CLI).
Allows filtering assets by associated Snyk Organizations for asset management.
Mend SCA adds Remediation section to findings UI and MEND_SCA_EXCLUDE_DEP_CLASS env var for Gradle scan filtering
Unreviewed items in Direct Libraries, Libraries, and Findings tables now show a blue dot indicator and hover tooltip; suppressed item backgrounds change to light gray.
Introduces the MEND_SCA_EXCLUDE_DEP_CLASS environment variable for Gradle scans via the Mend CLI to exclude specific configurations from scan results.
2 details in Everything
1 more release in this issue
· 2025-05-04 → 2025-05-18
Mend SAST v25.4.2 adds configurable scan timeouts exceeding 30 minutes via CLI and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations.
└──▷ USE IT
Extend scan duration for large repositories by setting a custom timeout via the command line.
shell
mend-sast scan --timeout 3600 <path>
SAST scanning now supports timeout values exceeding 30 minutes, configurable via both the CLI and SCM integrations.
Adds support for SAST scanning timeouts exceeding 30 minutes, configurable via CLI and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations
Checkov 3.2.424 adds a new SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. check for Terraform resources
└──▷ GET THIS VERSION
$ git clone --branch 3.2.424 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.424
2 more releases in this issue
· 2025-05-13 → 2025-05-15
Terraform v1.12 adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Object Storage backend, parallel test runs, and identity-based resource imports.
└──▷ GET THIS VERSION
$ git clone --branch v1.12.0 https://github.com/hashicorp/terraform.git
# already have the repo? check out this version:$ git checkout v1.12.0
└──▷ TRY IT
Speed up a large Terraform test suite by running plan/apply operations in parallel across test runs.
$ terraform test -parallelism=4
Import an existing cloud resource using a structured identity attribute instead of a flat string ID.
hcl
# In your Terraform config:
import {
identity = {
project = "my-project"
region = "us-east1"
name = "my-resource"
}
to = google_some_resource.example
}
Adds new backend for OCI Object Storage, enabling remote state storage on Oracle Cloud Infrastructure.
New -parallelism=n flag for terraform test sets the number of parallel operations during plan/apply in a test run.
Test runs can now be annotated for possible parallel execution, speeding up large test suites.
Logical binary operators (&&, ||) now short-circuit, avoiding unnecessary evaluation of the right-hand side.
import blocks now support a new identity attribute as an alternative to id for identifying resources to import.
+5 moreshow less
OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. backend supports additional standard environment variables, aligning with provider settings.
terraform init now works when test files are present but no .tf configuration files exist in the current directory.
Terraform Test continues subsequent test execution when an expected failure is not encountered.
Detailed diagnostic objects are now produced when test run assertions fail.
Elapsed time in the UI Hook now displays in mm:ss format for clearer progress reporting.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!On Linux, Terraform now requires Linux kernel version 3.2 or later; systems running older kernels will not be supported.
GitLab 18.0 adds Duo AI features, MR pipeline ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text. control, granular job token permissions, GLQL operators, and shared Kubernetes workspaces.
└──▷ USE IT
Force security scanners to run only in MR pipelines for Stable template users who want real-time feedback.
text
AST_ENABLE_MR_PIPELINES: "true"
AST_ENABLE_MR_PIPELINES CI/CD variable controls whether Security scanners run in merge request pipelines instead of branch pipelines
activeREST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. parameter for Groups and Projects endpoints filters by archived status (true for active, false for archived)
shared_namespace agent config field enables GitLab Workspaces to use a shared Kubernetes namespace
Granular permissions for job tokens beta allows fine-grained resource access control in CI/CD workflows
GitLab Query Language views add >=, <= operators for date types and support for view actions like Reload
+1 moreshow less
License approval policies now support package exceptions using PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. format (e.g., pkg:npm/@angular/animation@12.3.1)
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Support for PostgreSQL 14 and 15 has been removed; upgrade to PostgreSQL 16 before upgrading GitLab chart 9.0
!Bundled Prometheus chart updated from 15.3 to 27.11 and Prometheus version from 2.38 to 3.0; manual migration steps required for Alertmanager, Node Exporter, or Pushgateway
!Default NGINX controller image updated from 1.3.1 to 1.11.2; custom NGINX RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. rules must be updated to match new defaults
graudit v3.9 adds JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. and Docker detection rules plus four new repo-scanning helper scripts
└──▷ GET THIS VERSION
$ git clone --branch v3.9 https://github.com/wireghoul/graudit.git
# already have the repo? check out this version:$ git checkout v3.9
New jwt ruleset for detecting JWT-related security issues in source code.
New Docker ruleset for flagging security issues in Dockerfiles and container configs.
New giterate misc script for iterating over git repositories.
New snumerate misc script added to the misc tooling collection.
New svnlog misc script for working with Subversion logs.
+2 moreshow less
New svnscan misc script for scanning Subversion repositories.
Updated rulesets for dotnet, Go, Java, JavaScript, PHP, Python, Ruby, Scala, SQL, and secrets detection.
Adds --ai-max-token flag and AI token limit configuration to control LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. token usage
└──▷ GET THIS VERSION
$ git clone --branch v0.21.1 https://github.com/owasp-noir/noir.git
# already have the repo? check out this version:$ git checkout v0.21.1
└──▷ USE IT
Limit LLM token usage to 5000 tokens during code analysis to prevent excessive API costs or timeouts.
shell
noir analyze --ai-max-token 5000
Adds --ai-max-token CLI flag for controlling the maximum number of tokens the LLM can use during analysis
Adds a new configuration key for setting the AI token limit in the noir config file
DeepSource introduces autonomous Agents (Autofix, CVE prioritization, False Positive Triage), Autofix AI, Vanta SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. integration, and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth.
Adds DeepSource Agents for autonomous code analysis including Autofix™ Autopilot, CVE Prioritization Agent, and False Positive Triage Agent
Enables Autofix™ AI mode via Team Settings to generate context-aware remediations using LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.
Integrates Software Composition Analysis (SCA) with Vanta to surface vulnerable dependencies in the Vanta dashboard
Supports OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. (OIDC) authentication for GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflows
GitGuardian SaaS adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.-based automated user provisioning and deprovisioning for Okta and Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments..
Adds automatic user provisioning and deprovisioning via SCIM integration
Requires Workspace Settings > Authentication to enable SCIM
TruffleHog finds, verifies, and analyzes leaked credentials across Git, chat, wikis, cloud storage, and more
TruffleHog v3.88.35 adds DeepSeek detection, improves JIRA/LaunchDarkly detectors, and supports GitHub/GitLab auth via http.extraHeader
└──▷ GET THIS VERSION
$ git clone --branch v3.88.35 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.35
Adds DeepSeek secret detector and analyzer support.
Supports GitHub and GitLab authentication via http.extraHeader when cloning repositories.
Improves JIRA detector with updated detection logic.
Updates LaunchDarkly analyzer and detector.
4 details in Everything
7 more releases in this issue
· 2025-05-02 → 2025-05-29
TruffleHog v3.88.34 adds pipe/stdin input support and enhances the Smartsheets detector.
└──▷ GET THIS VERSION
$ git clone --branch v3.88.34 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.34
Supports reading input directly from a pipe, enabling integration into shell pipelines and CI workflows.
Enhanced Smartsheets detector with improved secret detection coverage.
TruffleHog v3.88.33 adds indeterminate verification support for letter Z detectors.
└──▷ GET THIS VERSION
$ git clone --branch v3.88.33 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.33
Supports indeterminate verification state for letter Z detectors, enabling more nuanced credential validation results.
TruffleHog v3.88.31 adds Dropbox OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. and Databricks token analyzers plus per-chunk detection logging
└──▷ GET THIS VERSION
$ git clone --branch v3.88.31 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.31
Adds Dropbox API OAuth2 Token Analyzer to validate leaked Dropbox OAuth2 tokens
Adds Databricks Analyzer to validate leaked Databricks credentials
Adds per-chunk detection logging for improved visibility into the scanning pipeline
$ git clone --branch v3.88.30 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.30
New detector for Azure Configuration Connection String keys enables secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. of Azure App Configuration credentials.
New Ngrok API Key Analyzer validates and analyzes detected Ngrok API keys for scope and permissions.
New AccuWeather detector version expands coverage of AccuWeather API key patterns.
New Mux API Analyzer validates and analyzes detected Mux API credentials.
New PostHog Analyzer validates and analyzes detected PostHog API keys.
+1 moreshow less
Improved JDBCJDBCA Java standard API for connecting applications to relational databases, maintained as part of the Java SE platform, letting tools query any compliant database through a single consistent interface. Detector regex broadens detection coverage for JDBC connection string secrets.
TruffleHog v3.88.29 adds Azure API Management detector plus Fastly and Monday.com analyzers
└──▷ GET THIS VERSION
$ git clone --branch v3.88.29 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.29
New detector for Azure API Management Direct Management Keys.
New Fastly analyzer for deeper credential analysis.
New Monday App analyzer for deeper credential analysis.
S3 source migrated to AWS SDK v2, unlocking compatibility with newer AWS features and regions.
TruffleHog v3.88.28 adds xAI and Ngrok Tunnel Authtoken detectors plus a Netlify analyzer.
└──▷ GET THIS VERSION
$ git clone --branch v3.88.28 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.28
New xAI detector to identify exposed xAI API keys in scanned sources.
Adds Ngrok Tunnel Authtoken verification to the Ngrok detector.
New Netlify analyzer for deeper validation of detected Netlify credentials.
$ git clone --branch v3.88.27 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.27
Adds PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. (ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction./external CA), Redis Sentinel support, Kubernetes dynamic secrets, and region flag.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.132.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.132.0-postgres
Adds ACME and external CA support for PKI to manage certificates
Adds Redis Sentinel support for high availability configuration
Adds --region flag to the CLI for selecting deployment regions
Infisical v0.131 adds 1Password secret sync, custom SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. CA certs, audit logs for org/project changes, and approval request bypass policies.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.131.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.131.0-postgres
Adds 1Password Secret Sync integration as a new source for synchronizing secrets
Supports custom CA Certs in the smtp-service configuration for TLS verification
Logs organization updates and project create/update/delete events to audit logs
Enables bypassing approval requests via a specific policy permission
Infisical v0.130.1 adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. secret rotation with UPN support and license server changes.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.130.1-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.130.1-postgres
feature(secret-rotation) now supports target principal self-rotation for LDAP using UPN (User Principal Name).
Enables per-organization shared secret limits and allows specifying email addresses for secret sharing.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.130.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.130.0-postgres
Adds feat(org): Shared Secret limits for org to cap the number of shared secrets an organization can have
Adds feat(secret-sharing): Specify Emails to allow providing specific email addresses during secret sharing
Gateway support for identities; hide specific products from sidebar via org settings
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.129.1-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.129.1-postgres
Adds gateway support for identities to allow identity-based authentication flows through the gateway
Adds an option in Organization Settings to hide specific products from the application sidebar
$ git clone --branch infisical/v0.129.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.129.0-postgres
Infisical v0.128.0 adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Vault integration, PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. subscriber functionality, and project role templates
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.128.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.128.0-postgres
Rate limits on email endpoints, OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. Zod titles, SSH host groups, and template UI improvements
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.127.2-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.127.2-postgres
Adds rate limiting to all email-sending API endpoints
Supports OpenAPI titles for Zod descriptions in the API docs
Adds groups to SSH hosts allowed principals for fine-grained access control
Improves project templates UI with new layout and interaction enhancements
Adds Kubernetes generator support and admin cache invalidation to Infisical
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.127.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.127.0-postgres
k8s generators now support generating manifests directly from Infisical secrets for Kubernetes workloads
Admin interface gains a new Invalidate Cache action to force-clear the application cache without restarting the service
Infisical v0.126 introduces SSH host groups and a Gateway Helm chart.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.126.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.126.0-postgres
└──▷ USE IT
Restrict the Infisical web UI to specific domains by setting an environment variable.
shell
ALLOWED_HOSTS=example.com npm run dev
Adds ALLOWED_HOSTS environment variable to vite.config for controlling allowed hosts.
Introduces Host Groups support in Infisical SSH.
Adds a new infisical-gateway Helm chart for deployment.
Adds Microsoft Teams and HashiCorp Vault integrations, customizable token expiration, and imported secret sync
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.125.3-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.125.3-postgres
Adds microsoft_teams to the workflow-integrations config for notification triggers
New detectors added for Azure Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. tokens, Communication Services, App Configuration, and others
Adds detection for Azure Entra ID authentication tokens.
Adds detection for Azure Communication Services connection strings.
Adds detection for Azure DevOps Personal Access Tokens.
Adds detection for Laravel application encryption keys.
Adds detection for Azure App Configuration connection strings.
GitGuardian Self-Hosted 2025.5 adds ServiceNow scanning, SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning, customizable incidents view, and NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. policy filtering.
└──▷ TRY IT
Configure proxy credentials using Kubernetes secrets instead of plaintext config
Enable SCIM provisioning to sync users with Okta or Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. via the UI
📍In the console, go to Settings › User Management › SCIM and configure the endpoint and token for your IdP.
Create a custom view in the incidents interface to prioritize specific secret types
📍In the console, go to Incidents › Views › Create Custom View and add properties like severity and repository
Adds ServiceNowsecret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. to detect secrets and honeytokens for automated incident tracking
Adds SCIM user provisioning integration with Okta and Microsoft Entra ID for automated onboarding/offboarding
Adds customizable incidents view allowing creation of custom views with specific properties for prioritization
Adds filtering, analytics, and Secret Reuse policy support to NHI Policies improvements
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Renamed images in this release for air gap deployments; users must update their tooling for downloading and uploading GitGuardian images to their private registry
!This release uses Chainguard images without FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments.-approved cryptographic modules; environments requiring FIPS must contact support
LavaMoat Core 16.4.0 adds a redefine global policy value and support for untrusted entrypoints.
└──▷ GET THIS VERSION
$ git clone --branch lavamoat-core-v16.4.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout lavamoat-core-v16.4.0
└──▷ USE IT
Grant a package the ability to redefine a global (e.g. fetch) rather than merely reading it, using the new "redefine" policy value.
Adds "redefine" as a new global policy value in the LavaMoat policy schema, giving policy authors finer-grained control over how globals are exposed to packages.
Supports untrusted entrypoints, allowing LavaMoat to apply compartment isolation even when the application entry module itself is not fully trusted.
LavaMoat webpack plugin now supports webpack context modules and chunk lazy loading.
└──▷ GET THIS VERSION
$ git clone --branch webpack-v0.10.0-beta.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout webpack-v0.10.0-beta.0
Nexus Repo 3.80 adds Hugging Face support for Firewall, Usage Center HA visibility, and new compact blob store task.
Adds Hugging Face component analysis to Sonatype Firewall (requires IQ 191)
Adds Admin - Compact blob store task with Blob Older Than property for S3 cleanup
Makes Usage Center accessible in UI for High Availability deployments
Adds Historical Usage table under the Licensing > Usage section
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Renamed logging module from nexus-pax-logging to nexus-logging; custom Jetty configs referencing org.sonatype.nexus.pax.logging will break unless updated to org.sonatype.nexus.logging
!Removed Expiration Days setting from S3 blob store configuration; cleanup now requires the Admin - Compact blob store task
New Socket MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server adds real-time dependency scoring via Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. for AI tools like Copilot and Claude.
Launches socket-mcp, an experimental MCP server that brings real-time dependency scoring to AI-assisted development
Enables tools such as GitHub Copilot, Claude, and other LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. integrations to query Socket’s depscore API directly during code generation
sbom-tool v4.0.2 adds SPDX 3SPDX 3An open standard from the Linux Foundation for expressing software bill-of-materials data, letting cyber tools exchange dependency, license, and vulnerability metadata in a machine-readable, interoperable format..0 generation and validation via the -mi:SPDX3.0 flag, with a breaking API change.
└──▷ GET THIS VERSION
$ git clone --branch v4.0.2 https://github.com/microsoft/sbom-tool.git
# already have the repo? check out this version:$ git checkout v4.0.2
Enables SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 3.0 support in SBOM generation and validation via the -mi:SPDX3.0 parameter (redaction not yet supported).
Adds AdditionalComponentDetectorArgs to RuntimeConfiguration for passing extra arguments to the component detector.
Adds a DotNet Component Adapter for .NET component detection.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Back-compat interface shims have been removed from the API (see #1028 for details).
GuardDog v2.6.0 adds directory verification support and new Go detections for exec, downloads, and data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..
└──▷ GET THIS VERSION
$ git clone --branch v2.6.0 https://github.com/DataDog/guarddog.git
# already have the repo? check out this version:$ git checkout v2.6.0
└──▷ TRY IT
Scan a local directory of packages for malicious indicators instead of a single package file.
$ guarddog verify <path>
Adds support for verifying entire directories with the verify command, not just individual packages.
New Go detection: identifies Base64-decoded content passed to execution functions.
New Go detection: flags executable downloads within Go packages.
New Go detection: identifies data collection and exfiltration patterns in Go.
Adds a new NPM obfuscation case to existing obfuscation detections.
Syft v1.25.0 adds a PHP interpreter and extensions cataloger for richer PHP SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. coverage.
└──▷ GET THIS VERSION
$ git clone --branch v1.25.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.25.0
Adds PHP interpreter and extensions cataloger to enumerate PHP runtime and installed extensions in SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
syft v1.24.0 adds Dart, PHP Pear, Homebrew, and Nix catalogers plus richer layer and license metadata.
└──▷ GET THIS VERSION
$ git clone --branch v1.24.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.24.0
New Dart pubspec cataloger for inventorying Dart/Flutter dependencies.
New PHP Pear cataloger for PHP PEAR package detection.
New Homebrew cataloger for macOS Homebrew-installed packages.
New Nix dependency detection cataloger.
Portage license strings are now translated to SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. expressions.
+7 moreshow less
Detects whether a full license text or a license name was provided, improving license classification accuracy.
Returns full license string instead of a SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hash when the license string exceeds 64 characters.
Annotates visible/hidden paths when scanning with all-layers scope.
Exposes the LayerID in which a package was first found, enabling layer-level provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. tracking.
Go binaries that previously received (devel) as a version now report UNKNOWN per compliance policy.
Preserves original package IDs from decoded SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. when available, maintaining ID continuity in SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. round-trips.
Base Docker image upgraded to gcr.io/distroless/static-debian12.
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. for HAProxy adds RHEL10 platform support in v1.5.1
7 more releases in this issue
· 2025-05-06 → 2025-05-23
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. 1.7.1 adds rpc_address for Unix domain socket support in NGINX Lua module.
Added support for Unix domain socket connections via rpc_address.
Added defensive logic for rpc_address and rpc_port variables to prevent runtime errors.
Adds default_blocking_response_code, default_redirect_url, and client_ip_headers fields to Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. workspaces.
Adds the default_blocking_response_code field to Next-Gen WAF workspaces to control the HTTP response status code for blocked requests.
Adds the default_redirect_url field to Next-Gen WAF workspaces to specify a URL to redirect to when a request is blocked.
Adds the client_ip_headers option to Next-Gen WAF workspaces to configure which headers contain the client IP address.
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. agent 4.66.0 adds agent-autoupdate for Windows and improves SQLI/log4j detection.
Adds agent-autoupdate utility for Windows distributions
Fastly Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. for NGINX (Native) 1.3.2 improves inspection of GET requests with body.
Adds NGINX native module package options for Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. with Stable, Mainline, Distro, and Plus variants.
Introduces nginx-module-fastly-nxs package compiled with Stable (even-numbered) NGINX Open Source releases
Introduces nginx-module-fastly-nxm package compiled with Mainline (odd-numbered) NGINX Open Source releases
Introduces nginx-module-fastly-nxd package for distribution-provided NGINX Open Source releases
Introduces nginx-module-fastly-nxp package compiled with NGINX Plus releases
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Switching from nginx-module-sigsci packages to nginx-module-fastly packages on SELinuxSELinuxA mandatory access control system built into the Linux kernel, maintained by the NSA and Red Hat, that enforces fine-grained policies restricting what processes can access, even if they run as root. requires updating the SELinux policy
Adds prefer_ipv6 option to backend configs to prioritize IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. during DNS lookups.
Adds NGWAFNGWAFA next-generation web application firewall that inspects HTTP traffic at the application layer, using behavioral analysis and contextual rules rather than pure signature matching to block attacks like SQLi and XSS. 1.3.1 support for Ubuntu 22.04 LTS (NGINX 1.18.0-6ubuntu14.6)
nuclei v3.4.3 adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. version detection, MSSQL query execution, and verbose -duc output in JS templates
└──▷ GET THIS VERSION
$ git clone --branch v3.4.3 https://github.com/projectdiscovery/nuclei.git
# already have the repo? check out this version:$ git checkout v3.4.3
Adds SupportedLDAPVersion support in JS templates for LDAP protocol interrogation.
Adds MSSQL execute-query support in JS templates, enabling active database interaction during scans.
Adds verbose output when using -duc (disable update check), surfacing more detail during runs.
TInjA 1.2.0 adds Handlebars-with-context template engine detection to its SSTISSTIServer-Side Template Injection, a vulnerability class where attacker-controlled input is evaluated by a server-side template engine, enabling remote code execution or data exfiltration. scanner.
└──▷ GET THIS VERSION
$ git clone --branch 1.2.0 https://github.com/Hackmanit/TInjA.git
# already have the repo? check out this version:$ git checkout 1.2.0
Detects handlebars with context as a supported template engine during SSTI scanning.
Caido v0.48.0 adds WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. interception, guest mode, automatic updates, and an API domain allowlist.
└──▷ GET THIS VERSION
$ git clone --branch v0.48.0 https://github.com/caido/caido.git
# already have the repo? check out this version:$ git checkout v0.48.0
New WebSocket interception: capture and modify WebSocket messages directly from the Intercept page, just like HTTP requests.
New guest mode: access Caido without an account using temporary projects and a single plugin.
Automatic updates for desktop users on macOS, Windows, and Linux (AppImage/deb experimental) with background download and one-click install.
New API domain allowlist: restrict Caido API access to trusted domains for improved security.
Adds keyboard navigation support for the sitemap.
+11 moreshow less
Enables deleting nodes and clearing all items directly from the sitemap.
Headers are now preserved when following HTTP redirects.
Shell node max execution timeout raised to 24 hours.
Supports copying multiple request URLs at once from selection.
Adds Close Others, Close Right, and Close Left tab management via right-click on Replay tabs.
Replay tab search now indexes request path, method, host, and SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address..
Adds Temporary Workspace for disposable projects.
Enables quick navigation to related WebSocket streams from a request.
Supports zero-padded numbers as a payload type in Automate.
Plugin SDK: frontend SDK now supports registering custom CodeMirror extensions to the HTTP history request editor.
Plugin SDK: backend SDK allows updating variables assigned to any environment.
CHIPSEC 1.13.12 adds EFI compressed data validation and an env var for brute-force EFI module scanning.
└──▷ GET THIS VERSION
$ git clone --branch 1.13.12 https://github.com/chipsec/chipsec.git
# already have the repo? check out this version:$ git checkout 1.13.12
Adds validation of EFI compressed data before attempting Tiano/UEFIUEFIA firmware specification maintained by the UEFI Forum that replaces legacy BIOS, defining how an OS and hardware initialize at boot. Cyber tools target or hook it to inspect pre-OS execution environments. decompression, preventing unsafe decompression of malformed firmware blobs.
Adds an environment variable to enable brute-force EFI module scanning at the HAL layer, unlocking deeper firmware analysis when standard enumeration falls short.
Automatically detects the running kernel version to locate the correct script for signing the CHIPSEC driver, simplifying secure-boot-enabled deployments.
!The legacy static Module methods (ensureInitialized, findBaseAddress, getBaseAddress, findExportByName, getExportByName, findSymbolByName, getSymbolByName) and Module.enumerateExports() are removed; code using them will fail.
!Legacy callback-style enumeration APIs and their Sync-suffixed counterparts are removed; modern synchronous enumeration methods still return arrays.
1 more release in this issue
· 2025-05-08 → 2025-05-17
Corellium 7.4 adds Rapid Start for iOS/iPadOS, Android Binder Tracing, new hardware appliances, and enhanced CLI/API capabilities.
└──▷ HOW TO FIND IT
Capture and analyze Android IPCIPCInter-process communication, ways for separate programs to exchange data or signals. Examples include pipes, sockets and shared memory. traffic for debugging inter-process communicationinter-process communicationInter-process communication, ways for separate programs to exchange data or signals. Examples include pipes, sockets and shared memory. issues.
📍Run CoreTrace on the Android device, then download the CoreTrace file to view parsed Binder transactions (interface headers, method names, arguments).
Rapid Start: Spins up virtual iOS and iPadOS devices 5X faster using specialized firmware snapshots.
Android Binder Tracing: CoreTrace now parses Android IPC Binder transactions to display interface headers, method names, and arguments in a human-readable format instead of raw hexdumps.
High-Speed Server Appliances: New generation hardware based on the NVIDIA Grace platform runs up to 2X faster with flexible licensing for 60 or 120 VM cores.
File Navigation: Enhanced Files tool adds a path entry field to directly access specific directory or file locations.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!iOS 10–14 versions are moved to End-of-Support (EOS) for cloud customers, receiving no QA testing or enhancements.
!iOS 10–14 versions enter End-of-Support (EOS) for onsite customers, requiring manual re-inclusion for future updates.
!iPhone 6 & 6 Plus models reach End-of-Life (EOL) and are no longer actively supported.
!iPhone 6 & 6 Plus models enter End-of-Support (EOS), will not appear in the IPSW Loader by default, and require manual inclusion upon request.
pwndbg 2025.05.30 adds kernel debugging commands, ✘ branch markers, dump-register-frame, s390x support, and IDA stack variable lookup.
└──▷ GET THIS VERSION
$ git clone --branch 2025.05.30 https://github.com/pwndbg/pwndbg.git
# already have the repo? check out this version:$ git checkout 2025.05.30
└──▷ TRY IT
Inspect the Linux kernel buddy allocator's free-page state while debugging a kernel with QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware..
$ buddydump
Read or write a Model-Specific Register during kernel (ring0) debugging to inspect CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. state.
$ msr
Look up an IDA-named stack variable by name inside a pwndbg expression while reversing a function.
$ p $ida("var_10")
New buddydump command inspects Linux kernel buddy allocator state on x86-64.
New msr command reads/writes Model-Specific Registers during ring0 kernel debugging.
New dump-register-frame command dumps saved register frames, useful for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. Cortex-M exception/interrupt debugging.
Disassembly now marks branches that will NOT be taken with a ✘ marker via emulation.
Adds initial support for the IBM s390x architecture.
+7 moreshow less
Adds Capstone disassembler support and heap (TLS) support for LoongArch64.
Adds Cortex-M exception return address resolution and context handling.
Exposes additional x64 registers for QEMU-system kernel debugging.
Improved slab command output and handling for kernel slab allocator inspection.
Supports stack variable lookup in IDA integration via $ida("var_name").
Upgraded Capstone to version 6, enabling new architecture and disassembly improvements.
One-liner portable install now available for Linux and macOS (both GDB and LLDB variants).
12 details in Everything
└──▷ BREAKING ON UPGRADE
!Passthrough for shell commands has been removed due to stability and security concerns.
RT 6.0 introduces configurable page layouts, core time tracking, article templates, user avatars, and extensive HTMX-driven UI modernization.
Integrates PageLayouts and %PageLayoutMapping configs to allow administrators to customize the structure and content of key pages including Ticket Display, Asset Display, and Dashboards via a new admin UI.
Adds core time tracking functionality with TimeWorker, TimeWorkedDate, and MyWeek page for managing weekly time entries without extensions.
Integrates ArticleTemplates into core RT, enabling ticket variables in articles inserted in replies and comments.
Adds user avatars that can be initials-based or user-uploaded images, supporting unprivileged users.
Extends the Scrip system to support automated actions and notifications for Articles and Assets, including batch scrips.
+4 moreshow less
Enables full-text search indexing for custom field values on objects.
Introduces a dedicated core Description field for tickets, separated from subsequent updates.
Upgrades rich text editing to CKEditor 5 (v40.2.0) with language support and embedded media rendering.
Adds HTMX integration for dynamic page updates, lazy loading, and inline editing across tickets, assets, and dashboards.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!UseSideBySideLayout configuration option is removed.
!Scrip conditions/actions/templates now use LookupType for queue association instead of the old Queue column.
!Saved searches, dashboards, and subscriptions are moved to separated database tables.
!Time tracking data is stored in new Transaction columns, requiring upgrade steps for TimeWorker and TimeWorkedDate.
2 more releases in this issue
· 2025-05-02 → 2025-05-28
mac_apt v1.13.6 adds Velociraptor collection support, JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output, new plugins and --exclude filtering
└──▷ GET THIS VERSION
$ git clone --branch v1.13.6 https://github.com/ydkhatri/mac_apt.git
# already have the repo? check out this version:$ git checkout v1.13.6
--exclude flag allows specifying plugins to skip during analysis
jsonl output type enables line-delimited JSON records for streaming ingestion
COLLECTION module reads Velociraptor created zip file collections (collected using the MacOS.Search.FileFinder module)
New CALLHISTORY plugin collects call history data
New CRASHREPORTER plugin parses crash reporter logs
+4 moreshow less
New WIFI_INTELLIGENCE plugin extracts WiFi intelligence data
FSEVENTS plugin now includes CoreSimulator file system events
Cortex Analyzers 3.5.15 adds a new Lookyloo analyzer for web page capture and investigation.
└──▷ GET THIS VERSION
$ git clone --branch 3.5.15 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.5.15
2 more releases in this issue
· 2025-05-07 → 2025-05-27
Cortex Analyzers 3.5.14 adds a CIRCL Vulnerability-Lookup analyzer integration.
└──▷ GET THIS VERSION
$ git clone --branch 3.5.14 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.5.14
Cortex Analyzers 3.5.12 adds a new Analyzer & Responders Watcher.
└──▷ GET THIS VERSION
$ git clone --branch 3.5.12 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.5.12
osdfir-infrastructure 2.2.9 integrates HashR as a Helm subchart with Timesketch and a dedicated PostgreSQL instance.
└──▷ GET THIS VERSION
$ git clone --branch osdfir-infrastructure-2.2.9 https://github.com/google/osdfir-infrastructure.git
# already have the repo? check out this version:$ git checkout osdfir-infrastructure-2.2.9
Volatility 3 v2.26.0 adds 19 new plugins spanning Linux tracing, Windows GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands./syscall analysis, and regex scanning across platforms.
└──▷ GET THIS VERSION
$ git clone --branch v2.26.0 https://github.com/volatilityfoundation/volatility3.git
# already have the repo? check out this version:$ git checkout v2.26.0
New linux.graphics.fbdev plugin for Linux framebuffer device analysis.
New linux.ip plugin for Linux IP networking artifact enumeration.
New linux.kallsyms plugin to extract kernel symbol table information.
New linux.module_extract plugin to dump Linux kernel modules from memory.
New linux.modxview plugin for cross-referencing loaded kernel modules.
+14 moreshow less
New linux.pscallstack plugin to inspect process call stacks on Linux.
New linux.tracing.ftrace plugin for analyzing Linux ftrace tracing infrastructure.
New linux.tracing.perf_events plugin for examining Linux perf event subsystem artifacts.
New linux.tracing.tracepoints plugin to enumerate Linux kernel tracepoints.
New linux.vmaregexscan plugin to regex-scan virtual memory areas on Linux.
New linux.vmcoreinfo plugin to extract vmcoreinfo data from Linux memory images.
New mac.regexscan plugin for regex scanning across macOS memory.
New windows.deskscan plugin to enumerate Windows desktop objects.
New windows.desktops plugin for Windows desktop enumeration.
New windows.direct_system_calls plugin to detect direct syscall usage (potential evasion indicator).
New windows.indirect_system_calls plugin to detect indirect syscall usage (potential evasion indicator).
New windows.suspended_threads plugin to identify suspended threads on Windows.
New windows.vadregexscan plugin for regex scanning across Windows VAD regions.
New windows.windows and windows.windowstations plugins to enumerate GUI windows and window stations.
iLEAPP v2.2.0 adds Apple Unified Log processing, agency logo branding, hardlinked media, and a Biome keybag module.
└──▷ GET THIS VERSION
$ git clone --branch v2.2.0 https://github.com/abrignoni/iLEAPP.git
# already have the repo? check out this version:$ git checkout v2.2.0
└──▷ HOW TO FIND IT
Add your agency's logo to every HTML report for professional case documentation.
📍python ileappGUI.py
Adds processing of Apple Unified Logs (logarchive.json parser) for timeline analysis of iOS log archives.
Enables embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. a custom agency logo in HTML reports via case data settings.
Supports hardlinks for media files in HTML reports, reducing storage duplication.
New Biome keybag module for parsing iOS Biome keybag artifacts.
Booking and burnerCache modules updated with LAVA output support.
Timesketch 20250521 adds bulk OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. export with PIT/slicing, new tsctl/CLI commands, Yeti bloom analyzer, and investigative questions in Stories.
└──▷ GET THIS VERSION
$ git clone --branch 20250521 https://github.com/google/timesketch.git
# already have the repo? check out this version:$ git checkout 20250521
└──▷ TRY IT
Review the active Timesketch server configuration without opening config files manually.
$ tsctl list-config
Adds efficient bulk export via OpenSearch using Point-in-Time (PIT) and slicing for faster, scalable sketch data extraction.
New tsctl export-sketch command enables full sketch data archival from the command line.
New tsctl list-config command surfaces current Timesketch configuration directly via tsctl.
New CLI client generate-dummy-csv command for generating test/dummy timeline data.
New CLI client sketch export-only-with-annotations command to export only annotated events from a sketch.
+2 moreshow less
Adds Yeti bloom check analyzer for enriching timelines with Yeti threat intelligence bloom filter lookups.
Enables adding and using Investigative Questions inside Stories for structured incident documentation.
Dissect 3.19 adds direct single-file targeting via --direct, NFS acquisition, QNXFS support, and new plugin families
└──▷ GET THIS VERSION
$ git clone --branch 3.19 https://github.com/fox-it/dissect.git
# already have the repo? check out this version:$ git checkout 3.19
└──▷ USE IT
Analyze a single forensic artifact file directly without creating a full target hierarchy.
shell
target-query --direct single_file.bin
Capture NFS shares and their children from a remote host during acquisition.
shell
acquire --children --enable-nfs <host_or_ip>
Refresh target-shell to see new files on disk without exiting and re-opening the session.
shell
target-shell
>>> reload()
Allows target-query to process a single file directly as a target using the new --direct flag
Enables NFS network acquisition in acquire with the --enable-nfs flag alongside --children
Adds reload function to target-shell for re-scanning disk changes without restarting the session
Introduces cstruct-stubgen tool in dissect.cstruct to generate Python stub files (*.pyi) for cstruct definitions
Supports Cellebrite UFDX and UFD loaders for forensic image ingestion
+17 moreshow less
Adds Docker container image support as a new loader/container type
Provides first-release QNXFS module and filesystem support via dissect.qnxfs v1.0
Adds VBK file loader for VirtualBox checkpoint backup files
Supports Oracle VirtualBox child disk images
Implements Apache VirtualHost parsing capability
Expands acquire to handle Colima container runtime acquisition on macOS
Adds vmtar tool in dissect.hypervisor to unpack Visor tar files
Makes chunk size configurable in dissect.archive
Adds Amcache Pca function via -f amcache.general,amcache.applaunches
Supports Rustdesk logs via -f rustdesk.logs
Supports Anydesk logs and file transfer data via -f anydesk.logs,anydesk.filetransfer
Supports capability history via -f cam.history
Supports Windows MSN chat history via -f msn.history
Supports Windows RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. bitmap cache paths and recovery via -f rdpcache.paths,rdpcache.recover
Supports MFT body file parsing via -f mft.body
Supports Rapid7 Velociraptor artifact ingestion via -f velociraptor.results,acquire.hashes,acquire.handles
Adds Egress Security Score under *Security > Egress > Overview* to visually display VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware./VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. egress protection status (Unprotected, Monitored, Partially Protected, Fully Protected)
Updates Auto Right-Sizing to consider Azure local temporary disks for gateway size recommendations
Enables self-service activation of Discovery of Kubernetes Resources via *Settings > Configuration > License > Add-on Features* and *Groups > Settings > Discovery of Kubernetes Resources*
3 details in Everything
1 more release in this issue
· 2025-05-01 → 2025-05-27
Aviatrix CoPilot 4.20.0 adds maintenance windows for auto right-sizing, custom AEP management CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network., and overall health visualization.
Adds a Resize button in Cloud Fabric > Scaling > Auto Right-Sizing to schedule gateway resizing during a custom maintenance window with configurable start time, recurrence (daily, weekly, monthly), and duration.
Enables specification of a custom Management Interface CIDR when adding or editing an Edge device on the Aviatrix Edge Platform (AEP).
Adds an Overall Health section under Settings > Resources > System Health with color-coded bar charts and status labels (Up, Degraded, Down) for Controller and CoPilot.
Allows selecting multiple threat types and severity levels when creating or editing an ExternalGroup with Threat Feeds as the resource type.
Prisma Cloud Compute 34.01 adds host mount path monitoring, PDF exports, new agentless APIs, and env var configuration
Adds HOST_FIM_MOUNTS environment variable to specify additional host mounted paths for runtime monitoring in the Defender deployment file
Adds IMAGE_EXTERNAL_LABELS_CAP environment variable (default 100, max 1024) to configure the maximum number of external labels per image on Console and Defenders
Allows downloading Monitor > Vulnerabilities > Images & Hosts data as PDF files from the UI
Allows downloading Monitor > Compliance > Containers, Images & Hosts data as PDF files from the UI
Adds Cloud Security Agent Hosts column to the Download Image Scan Results API CSV response
+3 moreshow less
Adds new agentless API endpoints /agentless/max-scanners and /agentless/scan-statistics for managing scanner limits and retrieving statistics
Supports Oracle Linux as a container base image for runtime protection
Adds gcp-cloud-run-service enum value to the shared.ScanResultType schema
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Defenders previous to version 31.00 (e.g., v30.03) will disconnect from the Console if not upgraded
!Support removed for x86 operating systems: CentOS 7, RedHat Enterprise Linux 7, VMWare Photon OS 3.0
!Support removed for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.-based orchestrators: Elastic Container Service (ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping.) 1.86.2 and 1.86.3
!The Cloud Native Network Segmentation (CNNS) feature is deprecated; recommended to disable all CNNS-based network monitoring
Cortex Analytics adds new BIOCs for AWS storage changes, auth coercion, M365 access, and NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. relay detection
Added A cloud snapshot of AWS database or storage was modified or shared as a new Informational Analytics BIOC to detect unauthorized AWS data exposure.
Added Possible authentication coercion as a new Informational Analytics BIOC to identify potential credential forcing attacks.
Added Unusual access to Microsoft 365 storage services as a new Informational Analytics BIOC for spotting anomalous M365 storage interactions.
Added Potential NTLM Relay Attack as a new Informational Analytics Alert for detecting NTLM relay attempts.
Prisma Access 6.0 introduces a simplified guided onboarding workflow for SASESASEA network architecture model combining wide-area networking and network security functions into a single cloud-delivered service, letting cyber tools enforce consistent policy regardless of where users or workloads sit. deployments
Introduces a new guided onboarding workflow that automates backend tasks and configures components for securing mobile users and private applications
Seamlessly integrates Cloud Identity Engine and Strata Cloud Manager with Prisma Access during the initial setup process
ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector gets regional Strata logging support and streamlined onboarding in Prisma Access 6.0
Adds Strata Logging Service regional support for ZTNA Connector logs to Indonesia, Qatar, Saudi Arabia, and Taiwan.
Introduces a simplified Day 0 onboarding workflow with guided steps for configuring private apps, applying defaults, and integrating Cloud Identity Engine (CIE), Strata Cloud Manager, and Prisma Access.
Enables ZTNA Connector activation without a dedicated add-on license, granting 10 free connectors with base licensing and unlimited support with the Private Apps add-on.
Adds clickable drill-down and bandwidth monitoring for ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector objects in Strata Cloud Manager
Adds ability to select Total Connector Groups, Total Wildcards, FQDN, or IP Subnet counts in Strata Cloud Manager to view details and status (UP, Partially Up, Down) for each ZTNA object.
Adds ability to monitor a Wildcard's bandwidth via the Action menu.
Prisma Access 6.0 Preferred Innovation adds DNS Proxy customization for Explicit Proxy mobile users to support custom and on-premises resolvers.
Adds comprehensive DNS Proxy customization for Explicit Proxy deployments, enabling integration with regional DNS, custom third-party resolvers, or existing on-premises DNS infrastructure.
Prisma Cloud adds HOST_FIM_MOUNTS env var for runtime path monitoring, Azure VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. flow log ingestion, SUSE RHEL10 support, PDF exports, and new REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services..
Adds HOST_FIM_MOUNTS environment variable to Defender deployment files to specify additional host mounted paths for runtime file system monitoring
Enables downloading Vulnerabilities and Compliance data as PDF files via the Monitor > Vulnerabilities > Images & Hosts and Monitor > Compliance > Containers, Images & Hosts pages
Adds ingestion support for Azure VNet flow logs alongside existing NSG flow logs for Microsoft Azure accounts
Adds AWS ca-west-1 (Canada/Calgary) to resource discovery in the Asset Inventory page
Adds new REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints post-agentless-max-scanners and get-agentless-scan-statistics to configure agentless scanner limits and retrieve statistics
+1 moreshow less
Extends runtime protection support to SUSE Linux Enterprise Server 15 SP6, Oracle Linux base images, Google GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. autopilot v1.31.6-gke.1064001, and Oracle OKE V.1.32.1
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Removes support for CentOS 7, RedHat Enterprise Linux 7, and VMWare Photon OS 3.0 x86 operating systems
!Removes support for Elastic Container Service (ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping.) 1.86.2 and ECS 1.86.3 ARM-based orchestrators
Adds optional RSSI-based logging for wireless clients with low signal strength.
Improves log messages for captive portal authentication using social login or vouchers.
Improves log messages for enterprise authentication.
Enhances roaming logs when wireless clients roam between AP6 access points.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Removed the fix for WIFIX-3329 which previously showed IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. details in the local UI; those details will no longer be visible due to a memory leak issue.
OpenSnitch v1.7 adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. tunnel support, Cilium eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. backend, and ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. sync scripts
└──▷ GET THIS VERSION
$ git clone --branch v1.7.0.0 https://github.com/evilsocket/opensnitch.git
# already have the repo? check out this version:$ git checkout v1.7.0.0
Adds IPv6 tunnels protocol support in the daemon for inspecting tunneled traffic
Replaces the eBPF library from gobpf to Cilium for improved kernel compatibility
Adds a bash script to automatically update ipasn and asnames databases for ASN lookups
Introduces a new 12-hour duration option in the UI for temporary rule expiration
Adds support for loongarch64 architecture in the daemon build rules
Abnormal AI lets you add images or logos to GenAI response headers/footers in AI Security Mailbox.
└──▷ HOW TO FIND IT
Brand your AI-generated email replies so recipients instantly recognize them as legitimate internal communications.
📍1. Navigate to the AI Security Analyst configuration page.
2. Select Insert Images and upload your logo.
3. Preview the placement in Step 3 before deploying to your mailbox.
Adds the ability to upload and insert images or logos into the header or footer of GenAI responses within the AI Security Mailbox.
1 detail in Everything
2 more releases in this issue
· 2025-05-07 → 2025-05-21
Snort3 3.8.1.0 adds flow allowlisting, per-flow timestamp validation, gap detection, ESP IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, and richer HTTP event data.
└──▷ GET THIS VERSION
$ git clone --branch 3.8.1.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.8.1.0
Adds option to move excess flows to the allowlist, giving operators a new overflow-handling strategy instead of dropping.
Implements per-flow packet timestamp checking: packets with timestamps earlier than the previous packet on that flow can now be dropped.
Adds stale-packet counting (always on) with configurable dropping; drop_stale_packets defaults to false.
Adds id_offset to filenames produced by stream.dump_flows(), enabling more granular file identification in high-volume captures.
Adds gap detection in the packet stream via the stream module, surfacing sequence holes for improved analysis.
+5 moreshow less
Adds ESP to valid next-header types in IPv6 processing, broadening IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. traffic inspection coverage.
Exposes all headers, response string, and HTTP method from HttpEvent via pub_sub, enriching event-driven integrations.
Extends the extractor with support for the conn.log history field.
Adds handling for AYT (Are You There) commands in the Telnet splitter.
Prints stream_tcp state when queue limits are hit, aiding capacity and tuning diagnostics.
10 details in Everything
1 more release in this issue
· 2025-05-08 → 2025-05-28
Security Onion 2.4.150 adds external Kafka access with auth, background config UI actions, subgrid support, and Strelka scanner improvements.
└──▷ GET THIS VERSION
$ git clone --branch 2.4.150-20250512 https://github.com/Security-Onion-Solutions/securityonion.git
# already have the repo? check out this version:$ git checkout 2.4.150-20250512
Enables external access to Kafka topics via username/password authentication for remote clients.
Supports background actions via the config UI, allowing long-running operations without blocking the interface.
Adds additional grid and subgrid support in the SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. UI for richer data display.
Adds missing Strelka scanners and restarts Strelka containers automatically on config change.
Displays user.name instead of internal identity ID across the SOC UI via Kratos user.name lookup.
+3 moreshow less
Collects Elasticsearch index sizes as a new storage metric.
Adds url_base to the web certificate for more flexible deployment configurations.
Automatically runs so-rule-update when rule configuration changes.
CSET v12.4.0.3 adds CMMC 2.0 scoring/POA&MPOA&MA Plan of Action and Milestones: a US federal government document that tracks known security weaknesses in a system, the remediation steps planned, and the deadlines for completing them, required under FISMA compliance., sector-specific CPG goals, per-user settings, and JSON PCII field visibility controls.
└──▷ GET THIS VERSION
$ git clone --branch v12.4.0.3 https://github.com/cisagov/cset.git
# already have the repo? check out this version:$ git checkout v12.4.0.3
└──▷ HOW TO FIND IT
Generate a POA&M template after completing a CMMC 2.0 assessment to document gaps and remediation actions for leadership or auditors.
📍In the Reports page, locate the CMMC 2.0 section and select Generate POA&M Template to download the Plan of Action and Milestones document.
Enable password encryption on assessment exports and set your preferred language from the new per-user Settings window.
📍Click your User Profile dropdown › Settings, check Enable password encryption for assessment exports, and select your preferred language, then save.
Review sector-specific CPG goals with tailored guidance when assessing an IT or Chemical sector organization.
📍In the Prepare section, set Sector to Information Technology Sector (or Chemical Sector (Not Oil and Gas)), then navigate to the Assessment section where the sector-specific CPG goals page appears as a separate tab.
Adds show/hide control for PCII fields within exported JSON reports.
Adds a Settings option to the User Profile dropdown menu, allowing users to enable password encryption for assessment exports and choose their preferred language.
Adds CMMC Scoring and CMMC Scorecard pages to the Results section to track organizational progress against CMMC 2.0 cybersecurity standards.
Enables generation of a Plan of Action and Milestones (POA&M) template from the Reports page for CMMC 2.0 assessments.
Displays sector-specific CPG goals as a separate page within the Assessment section when Chemical Sector (Not Oil and Gas) or Information Technology Sector is selected in the Prepare section, each with tailored implementation guidance.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The password encryption checkbox has been removed from the My Assessments page; password encryption for exports is now controlled exclusively through the new Settings window under the User Profile dropdown.
Malcolm v25.05.0 adds ROC Plus ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. protocol support with Zeek analyzer and makes the Zeek metrics port configurable.
└──▷ GET THIS VERSION
$ git clone --branch v25.05.0 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v25.05.0
└──▷ USE IT
Disable the new ROC Plus Zeek analyzer if your environment does not have ROC Plus traffic and you want to reduce noise.
env
ZEEK_DISABLE_ICS_ROC_PLUS=true
Override the default Zeek metrics port when the default conflicts with another service in your deployment.
env
ZEEK_METRICS_PORT=9099
Adds ZEEK_DISABLE_ICS_ROC_PLUS to zeek.env and control_vars.conf to control whether the new ROC Plus analyzer is enabled.
Adds ZEEK_METRICS_PORT to zeek.env and control_vars.conf to make the Zeek metrics port configurable (default blank, meaning use the default port).
Adds support for the Emerson ROC Plus ICS protocol, including a Zeek analyzer and corresponding dashboard.
Improves ability to upload PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. files via cURL.
Inspektor Gadget v0.40.0 adds a bpfstats gadget, image-based advise_seccomp, inspect command for kubectl-gadget, and WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. caching.
└──▷ GET THIS VERSION
$ git clone --branch v0.40.0 https://github.com/inspektor-gadget/inspektor-gadget.git
# already have the repo? check out this version:$ git checkout v0.40.0
└──▷ TRY IT
Build a custom gadget image and control how the builder image is pulled (e.g., always pull the latest builder in CI).
New bpfstats gadget for inspecting eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. program statistics.
Implements advise_seccomp as an image-based gadget.
Adds inspect command to kubectl-gadget with OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. metadata, mermaid graphs, and eBPF relocation details.
WASM operator now uses a cache to significantly speed up gadget execution.
Adds ls and rm aliases for ig image list and ig image remove.
+5 moreshow less
Adds --builder-image-pull flag to ig image build to control builder image pull behavior.
Introduces value.one-of annotation for gadget parameter validation.
Adds generic collect-ustack parameter and templates for user-space stack collection.
KubeNameResolver now supports image-based gadgets.
Adds Kubernetes recommended labels to Helm chart resources.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!The ebpf-builder image is renamed to gadget-builder; any references to ebpf-builder in build scripts or configs must be updated.
Docker Compose v2.36.0 adds external binary service providers, a build --check flag, network interface naming, and COMPOSE_PROGRESS control.
└──▷ GET THIS VERSION
$ git clone --branch v2.36.0 https://github.com/docker/compose.git
# already have the repo? check out this version:$ git checkout v2.36.0
└──▷ TRY IT
Validate your build configuration in CI before committing — catches misconfigured Dockerfiles or build args without running a full build.
$ docker compose build --check
Suppress animated progress output in non-TTY CI environments where spinner/bar rendering produces noisy logs.
$ COMPOSE_PROGRESS=plain docker compose up
Pin a Compose network to a specific host interface name for deterministic routing in multi-NICNICA network interface card or adapter, the hardware that connects a computer to a network. It sends and receives packets over the link. environments.
Grype v0.92.0 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scores and CISA Known Exploited Vulnerability flags to scan results, plus an improved HTML report template.
└──▷ GET THIS VERSION
$ git clone --branch v0.92.0 https://github.com/anchore/grype.git
# already have the repo? check out this version:$ git checkout v0.92.0
Adds EPSS (Exploit Prediction Scoring SystemExploit Prediction Scoring SystemExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching.) metrics to vulnerability scan results.
Adds indication of CISA Known Exploited VulnerabilitiesCISA Known Exploited VulnerabilitiesA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing CVEs confirmed to have been actively exploited in the wild, which cyber tools use as a high-signal prioritization feed for patching and scanning. (KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.) in scan output.
Improves the built-in HTML report template for richer vulnerability output.
Kata Containers 3.17 adds VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space.-AP support, hot-plug block devices in qemu-rs, and OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Helm chart publishing
└──▷ GET THIS VERSION
$ git clone --branch 3.17.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:$ git checkout 3.17.0
Adds runtime/config VFIO configuration support for IBM SEL via VFIO config entries.
Enables hot-plug block device support in the Rust runtime (qemu-rs) using QMP commands.
Publishes helm charts to OCI registries for Kata Containers releases.
Adds RISC-V 64-bit architecture support for the kata-agent.
Adds EROFS Snapshotter Support to Kata containers for faster image processing.
Trivy is a comprehensive security scanner that finds vulnerabilities, misconfigurations, secrets, and SBOM in containers, Kubernetes, code repositories, and clouds
Trivy 0.63.0 adds Bottlerocket and MinimOS support, bun.lock analysis, license scanning enhancements, and JUnit location exports.
└──▷ GET THIS VERSION
$ git clone --branch 0.63.0 https://github.com/aquasecurity/trivy.git
# already have the repo? check out this version:$ git checkout 0.63.0
Add Bottlerocket OS package analyzer
Support license scanning in both GOPATH and vendor directories for Go projects
Add a Bun lock file analyzer for Node.js dependencies
Scan the vendor directory for licenses associated with go.mod files
Support compound licenses using SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. operators
+5 moreshow less
Extract maintainer field for Alpine APK packages
Export raw Terraform data to Rego for misconfiguration scanning
Add minimum Trivy version requirement support for misconfiguration rules
Include misconfiguration location information in JUnit output templates
Set the current working directory for the Terraform parser
Prowler 5.7.0 adds GitHub provider with 11 CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. checks, ThreatScore for M365, CIS AWS v5.0 & M365 v4.0 frameworks, and high-performance findings endpoints.
└──▷ GET THIS VERSION
$ git clone --branch 5.7.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 5.7.0
└──▷ TRY IT
Audit your GitHub organization's security posture against the CIS GitHub Benchmark v1.0.0 — useful for teams that want to enforce branch protection and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. policies at scale.
$ prowler github --list-checks
Score your Microsoft 365 tenant's security posture with Prowler ThreatScore to quickly prioritize the highest-risk misconfigurations.
Adds new high-performance API endpoints to retrieve the latest findings and metadata quickly.
+7 moreshow less
Optimizes /findings/metadata and resource-related filters for significantly faster querying; optimization applies to scans from this release onward, including service, region, and resource_type filters.
Enhances /overviews endpoints for better response times and scalability in large environments.
Adds a new background queue for backfill tasks in the API.
Supports setting cluster name in in-cluster mode for Kubernetes provider.
Adds new passed/failed findings split chart to the UI.
Enhances Provider UID filter in the App with cloud provider icons (AWS, GCP) and alias display for faster multi-cloud analysis.
Adds AWS CloudFormationAWS CloudFormationAn AWS service for declaring cloud infrastructure as code in JSON or YAML templates, letting cyber tools provision and tear down entire environments reproducibly without manual console steps. Quick Link in the IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Role credentials step for one-click IAM Role stack setup.
12 details in Everything
1 more release in this issue
· 2025-05-09 → 2025-05-20
Prowler 5.6.0 adds Microsoft 365 support with 33 new checks, Prowler ThreatScore framework, SOC2SOC2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. for Azure, and a new GCP unused service accounts check.
└──▷ GET THIS VERSION
$ git clone --branch 5.6.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 5.6.0
└──▷ TRY IT
Enumerate all new M365 checks across Teams, Defender, Purview, and Exchange before running a full assessment.
$ prowler m365 --services teams defender purview exchange --list-checks
Detect unused GCP service accounts to identify dormant identities and reduce attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
$ prowler gcp --check iam_service_account_unused
Adds Microsoft 365 (M365) provider support with 33 new checks spanning Teams, Defender, Purview, and Exchange for identity governance and risk reduction.
New Prowler ThreatScore compliance framework available for AWS, Azure, and GCP, covering IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access., Attack Surface, Forensic Readiness, and Encryption.
Adds SOC2 compliance framework assessment for Azure (prowler azure --compliance soc2_azure), matching existing AWS and GCP SOC2 support.
New GCP check iam_service_account_unused detects dormant service accounts to reduce attack surface.
New M365 Teams checks include teams_external_domains_restricted, teams_email_sending_to_channel_disabled, teams_meeting_anonymous_user_join_disabled, teams_unmanaged_communication_disabled, teams_external_users_cannot_start_conversations, teams_meeting_anonymous_user_start_disabled, teams_meeting_external_lobby_bypass_disabled, teams_meeting_dial_in_lobby_bypass_disabled, teams_meeting_external_control_disabled, teams_meeting_external_chat_disabled, teams_meeting_recording_disabled, teams_meeting_presenters_restricted, teams_security_reporting_enabled, and teams_meeting_chat_anonymous_users_disabled.
+12 moreshow less
New M365 Defender checks cover Common Attachments filter, Outbound Antispam Policy, Antiphishing Policy, Internal user notifications, Bypass Disable for mailboxes, Transport Rules whitelist, Inbound Antispam allowed domains, Connection Filter Policy allowlist/safelist, and DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit. enablement.
New M365 Exchange checks cover Organizations Mailbox Auditing enabled, External Mails Tagged, and Modern Authentication enabled for Exchange Online.
New M365 SharePoint check sharepoint_onedrive_sync_restricted_unmanaged_devices restricts OneDrive sync on unmanaged devices.
New defender_chat_report_policy_configured check for M365 Defender.
Supports CLOUDSDK_AUTH_ACCESS_TOKEN environment variable for GCP authentication.
Prowler Hub launched as a public, searchable library of versioned checks, cloud service artifacts, and compliance frameworks with a documented public API.
Launches Prowler Studio with modular sub-packages (prowler-studio-core, prowler-studio-cli, prowler-studio-api, prowler-studio-mcp-server) and MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. integration for AI code assistants.
Compliance Exports in the Prowler App now allow downloading individual compliance frameworks from the Compliance page, and scan reports bundle all supported frameworks.
Delta indicator (•) added to findings in the Prowler App to highlight new or changed findings since the previous scan.
Finding URLs in the UI now include the finding ID, enabling direct sharing within an organization.
Adds option to customize the number of items displayed per table page in the Prowler App.
New API endpoint to fetch and download any specific compliance file by name, plus ZIP-export functionality for all compliance reports.
AzureHound v2.5.0 adds collection of unified role eligibility schedule instances and a new list role-assignment-policies command.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.0 https://github.com/SpecterOps/AzureHound.git
# already have the repo? check out this version:$ git checkout v2.5.0
└──▷ TRY IT
Enumerate role assignment policies across your tenant to audit PIMPIMProtocol Independent Multicast, an IETF routing protocol that distributes IP multicast traffic across networks without depending on a specific unicast routing protocol, letting tools monitor or manipulate multicast group traffic. and assignment rules.
$ azurehound list role-assignment-policies
Collects unified role eligibility schedule instances, improving visibility into PIM-eligible role assignments in Azure AD.
New list role-assignment-policies command surfaces role assignment policy configurations for Azure RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. roles.
eksctl v0.208.0 adds Nitro Enclave support in EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Launch Templates and AL2023 arm64 NVIDIA AMI type.
└──▷ GET THIS VERSION
$ git clone --branch v0.208.0 https://github.com/weaveworks/eksctl.git
# already have the repo? check out this version:$ git checkout v0.208.0
Enables Nitro Enclave options in EC2 Launch Templates for nodegroups requiring hardware-isolated enclaves.
Adds support for the AL2023 arm64 NVIDIA AMI type for GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. workloads on ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.-based instances.
Adds an Amazon Linux 2 end-of-life warning when creating clusters or nodegroups to prompt migration.
Falco 0.41.0 adds JSON output field control, container plugin architecture, and ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 8601 timestamps in Docker images.
└──▷ GET THIS VERSION
$ git clone --branch 0.41.0 https://github.com/falcosecurity/falco.git
# already have the repo? check out this version:$ git checkout 0.41.0
└──▷ USE IT
Include only specific fields in JSON alert output to reduce noise when forwarding to a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
Falco v0.41.0 adds json_include_output_fields config option and switches build system to container plugin.
Adds json_include_output_fields option in .falco/config.yaml to control which output fields are included in JSON events
Switches build system to use the container plugin for image builds
Enables ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 8601 time format by default in Docker images via override config
Deprecates print of container.info in userspace, requiring migration of rule outputs
Databricks adds FedRAMP ModerateFedRAMP ModerateA US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts. support in AWS us-east-2 and us-west-1 regions
Databricks SQL introduces a consolidated Beta interface for managing alerts, combining query setup, conditions, schedules, and notifications.
Adds a new consolidated UI for Databricks SQL alerts in Beta, unifying query setup, condition definition, scheduling, and notification destinations into a single interface.
Databricks Model Serving workloads now support HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against., PCI-DSSPCI-DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers., and UK Cyber EssentialsCyber EssentialsA UK government-backed certification scheme that defines a baseline set of technical controls organizations must implement to defend against common cyber threats, giving cyber tools a compliance benchmark to assess or report against. Plus via compliance security profiles
Adds HIPAA to the list of supported compliance standards for Model Serving CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. workloads.
Adds PCI-DSS to the list of supported compliance standards for Model Serving CPU and GPU workloads.
Adds UK Cyber Essentials Plus to the list of supported compliance standards for Model Serving CPU and GPU workloads.
Databricks allows account admins to require or recommend MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for all users at login
Databricks Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves. provisioned throughput now supports HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against., PCI-DSSPCI-DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers., and UK Cyber EssentialsCyber EssentialsA UK government-backed certification scheme that defines a baseline set of technical controls organizations must implement to defend against common cyber threats, giving cyber tools a compliance benchmark to assess or report against. Plus compliance profiles
Adds HIPAA to the list of compliance security profile standards available for Foundation Model APIs on provisioned throughput workloads
Adds PCI-DSS to the list of compliance security profile standards available for Foundation Model APIs on provisioned throughput workloads
Adds UK Cyber Essentials Plus to the list of compliance security profile standards available for Foundation Model APIs on provisioned throughput workloads
Databricks JDBCJDBCA Java standard API for connecting applications to relational databases, maintained as part of the Java SE platform, letting tools query any compliant database through a single consistent interface. 2.7.3 adds Azure Managed Identity OAuth, token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user., VOID/Variant/TIMESTAMP_NTZ types, and cloud.databricks.us/mil support.
Added Auth_Flow=3 property for Azure Managed Identity OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. authentication
Added OAuth Token Exchange for IDPs different than host to exchange access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. for a Databricks access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions.
Added VOID, Variant, and TIMESTAMP_NTZ data type support in getColumns() and getTypeInfo() APIs
The driver now lists columns with unknown or unsupported types and maps them to SQL VARCHAR in the getColumns() metadata API
Added support for cloud.databricks.us and cloud.databricks.mil domains when connecting via OAuth (AuthMech=11)
Databricks lineage system tables updated with new primary key and metadata columns for May 2025
system.access.column_lineage and system.access.table_lineage now include a new record_id column as the primary key for each lineage record.
entity_metadata column is added to system.access.column_lineage and system.access.table_lineage, replacing the deprecated entity_type, entity_run_id, and entity_id columns.
event_id column is added to log the identifier for the lineage event across multiple related rows.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The entity_type, entity_run_id, and entity_id columns in system.access.column_lineage and system.access.table_lineage are deprecated and replaced by entity_metadata.
Databricks Runtime 16.4 LTS adds cloudFiles.cleanSource to Auto Loader, Python DataSourceReader.pushFilters API, and listagg/string_agg SQL functions.
└──▷ USE IT
Use the new IDENTIFIER clause to dynamically specify a catalog name in DBSQL
sql
CREATE CATALOG IDENTIFIER(:param)
Adds the cloudFiles.cleanSource Auto Loader option to instruct the stream to move or delete processed files from the source directory
Adds pushFilters method to the DataSourceReader Python interface to allow filter pushdown for batch reads
Supports MERGE INTO on tables with fine-grained access control on dedicated compute, now generally available (GA)
Adds support for using IDENTIFIER clause in DBSQL catalog operations such as CREATE CATALOG, DROP CATALOG, COMMENT ON CATALOG, and ALTER CATALOG
Adds new SQL aggregate functions listagg and string_agg to aggregate STRING and BINARY values within a group
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Files with a .gzip extension are now read as gzip-compressed files; previously uncompressed data in .gzip files will fail with java.io.IOException: incorrect header check unless the extension is renamed or decompression is skipped using io.compression.codecs=org.apache.hadoop.io.compress.PassthroughCodec
!Data source table reads now respect options set for all plans when cached; previously only the first cached plan's options were used, so queries changing options like delimiter on a cached table may produce different results
!Redaction rule moved from analyzer to optimizer; DataFrames saved with valid SECRET SQL functions will no longer contain redacted values in the target table
Databricks GA: Automatically provision users via Just-in-Time (JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility.) provisioning on first SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login
Enables just-in-time (JIT) provisioning to automatically create new user accounts during first-time authentication for Single Sign-On (SSO) users.
Llama 4 Maverick support added to Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves. on provisioned throughput workloads (Public Preview)
Exabeam May 2025 adds CrowdStrike and STIX/TAXIISTIX/TAXIISTIX is an OASIS-maintained JSON schema for expressing threat intelligence objects; TAXII is the companion HTTP protocol for exchanging them, giving cyber tools a vendor-neutral way to share indicators and threat data. Cloud Collectors, custom enrichment rules in Log Stream, and alert management features.
Adds CrowdStrike Context Devices Cloud Collector to ingest device data without the Exabeam Ingester for CrowdStrike license add-on
Adds STIX/TAXII Cloud Collector to collect threat intelligence about IP addresses or domains and auto-generate a context table in Context Management
Adds Recorded Future Context Cloud Collector to collect STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form./TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. threat intelligence and auto-generate a Recorded Future context table
Enables creating, editing, and duplicating custom enrichment rules directly in the Enrichments tab of Log Stream for those with a New-Scale Analytics license or Early Access program
Adds AI-generated MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. coverage summary in Outcomes Navigator identifying top three techniques with increased/decreased scores and recommendations
+5 moreshow less
Adds watchlists feature to monitor and rank entities by risk score over time, including five pre-built lists and custom creation based on entity tags
Adds entity tags from Attack Surface Insights to Threat Center cases or alerts to enable searching for specific kinds of entities
Enables dismissing individual or multiple alerts with reason, user, and timestamp recorded in the Overview tab and alert history
Allows marking alerts as read/unread, tracking status in the STATUS column, and reverting dismissed alerts to unread when risk scores increase by a specified percentage (default 10%)
Adds Hide Dismissed toggle in the Alerts tab to filter out dismissed alerts from the list
Sumo Logic v2.12 adds Threat Intel integration for AWS apps and OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. OTRM Source Templates
Adds integration with the new Threat Intel feed to nine AWS observability apps and four monitors
Releases 14 OpenTelemetry (OTRM) Source Templates to simplify log and metric collection from various systems
Migrates 28 classic apps to next-gen versions for easier management
May 26, 20254 releases · 2025-05-02 → 2025-05-26Stable
Google SecOps introduces STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets.-based feed types in preview for Google Cloud Storage, S3, SQS, and Azure Blobstore
3 more releases in this issue
· 2025-05-02 → 2025-05-26
Google SecOps adds data table RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. and enables data tables as search sources in YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching..
└──▷ HOW TO FIND IT
Use data tables as a source in YARA-L searches via the Investigation menu.
📍Steps: In the web interface, go to Investigation › Data Tables. Run a YARA-L search using a selected data table as the data source.
Manage access to data tables using RBAC in custom roles.
📍Update custom role permissions in Google SecOps to grant access to data_tables via the new APIs if you encounter access errors on the detection UI page.
data_tables are now accessible from the Investigation menu and usable as a data source in YARA-L search queries
Role-based access controlRole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC) for data_tables management
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Feature rollout on May 8, 2025 introduced new APIs that may require updated permissions for custom roles to access the detection UI page
Wazuh v4.12 adds eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. whodata to FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification., MS Graph riskDetections integration, and indexed vulnerability package conditions.
└──▷ GET THIS VERSION
$ git clone --branch v4.12.0 https://github.com/wazuh/wazuh.git
# already have the repo? check out this version:$ git checkout v4.12.0
FIM now supports whodata using an eBPF-based integration
Added support for the riskDetections relationship in MS Graph
Added a time delay option in the MS Graph integration to prevent log loss
Added a page size option to the MS Graph integration
Deleted the restriction for the use of the AWS profile in the Amazon Security Lake integration
+1 moreshow less
Added package condition field in indexed vulnerabilities
Admins gain UI capability to reset user 2FA tokens; enhanced 2FA setup flow with immediate backup code generation.
Adds Reset User 2FA action to the Admin UI Settings > Users interface for resetting a specific user's two-factor authentication
Enhances the Profile → Security page to allow users to choose between TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. apps and security devices during setup
Generates backup codes immediately during the new enhanced 2FA setup process
Sekoia.io Forwarder 2.7.2 adds RELPRELPReliable Event Logging Protocol, an open protocol for transporting syslog messages over a persistent TCP connection with application-layer acknowledgements, so a cyber tool built on it can guarantee log delivery without silent message loss. protocol support and configurable intake queue_size.
queue_size config key added to an intake definition to set a specific retention size in memory
protocol: relp value added to allow sending events via the RELP protocol instead of TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it.
ESET PROTECT 6.3 adds MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. dashboards, CSV incident export, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. column, and Workflow app notifications.
Adds Workflows app integration for MS Teams notifications
Adds Incident list CSV export
Adds Waiting for input status for Incidents
Adds Open, In progress, Waiting for input incident states to MDR/MDRU dashboards
Trend Vision One Container Security now includes Runtime Secret Scanning to detect secret exposures in production containers via the Cloud Security module.
Adds Runtime Secret Scanning capability within Cloud Security → Container Security → Container Inventory to detect secrets in running containers.
Enables detection of secret exposures in production containers via TrendAI Vision One™.
2 details in Everything
33 more releases in this issue
· 2025-05-01 → 2025-05-31
Runtime Malware Scanning adds HTTP, HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate., and SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy support for Container Security.
Trend Vision One now supports Forcepoint logs in custom detection filters.
Adds Forcepoint log type support to TrendAI Vision One custom detection filters.
Introduces 43 new alert source indicators for Forcepoint logs (e.g., Connection Allowed, Firewall System Security Policy Reload, IKE Invalid Exchange Type) available in the tm-v1-detection-models GitHub repository.
Cloud Email Gateway Protection adds the ability to enable security risks and anomalies scanning for approved senders within Sender Filter Settings.
Allows administrators to determine whether to apply security risks and anomalies scanning on emails from approved senders in addition to existing Connection Filtering and Spam Filtering criteria.
Trend Vision One reduces StackSets execution role permissions to minimum necessary
The CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. template for File Security Storage now automatically assigns least-privilege permissions to the StackSets permission execution role.
Virtual Network Sensor 1.0.1479 adds QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. protocol support and new FQDNs.
Trend Vision One adds support for Microsoft Defender for Endpoint logs in custom detection filters
Adds custom detection filters for Microsoft Defender for Endpoint logs (e.g., Clearing of System Logs, HTA Startup Persistence) to enable monitoring specific MDE telemetry events.
New integration allows importing these detection filters from the tm-v1-detection-models GitHub repository into your TrendAI Vision One environment.
Trend Vision One adds up to five custom parameters per risk event rule for automatic status handling.
Adds support for configuring up to five custom parameters (e.g., IP address matches, users, devices) within the Event Rule Management interface for all risk events.
Enables automatic marking of associated risk events as Remediated, Accepted, or Dismissed when all rule parameters are met.
XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. for Cloud now supports Azure Activity Logs in public preview.
Detection models identify suspicious activities such as privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., attempted data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels., critical resource disruption, and more
Zero Trust Secure Access Private Access Connector 2.36.0.3401 adds Web-RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. keyboard layout selection and DNS query fixes.
Adds keyboard layout selection for Web-RDP internal applications in the User Portal
Adds NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. v2 authentication support for Internet Access via the On-Premises Gateway.
Internet Access now supports transparently authenticating end users on an on-premises Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. server using the NTLM v2 protocol
Trend Vision One adds new CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline.GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. Benchmark v1.7.0 compliance scanning capability for GKE clusters.
New capability to scan Google Kubernetes Engine (GKE) clusters against the CIS GKE Benchmark v1.7.0 standards
Adds SAT and SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. usage counts to ConnectWise, Autotask, and Organizations API billing integrations
May 19, 20252 releases · 2025-05-17 → 2025-05-19Stable
Sophos Central adds AI Search for endpoint data and Microsoft 365 Response Actions for MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools.
└──▷ HOW TO FIND IT
Query endpoint data in the New AI Features EAP using natural language instead of structured queries
📍In the console, navigate to the AI Search section and enter natural language questions about endpoint logs.
Enable MDR analysts to respond directly to incidents in a Microsoft 365 environment
📍In the console, go to Integrations and enable the M365 Response Actions integration.
Enables AI Search for endpoint data in the New AI Features EAP, allowing natural language queries against the Sophos Data Lake
Adds M365 Response Actions integration to let MDR analysts contain and neutralize attacks in Microsoft 365 environments
2 details in Everything
1 more release in this issue
· 2025-05-17 → 2025-05-19
Sophos Central 2025.20 adds AI Search for endpoint data and MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. Microsoft 365 Response Actions.
Adds MDR Microsoft 365 Response Actions integration, enabling MDR analysts to contain and neutralize attacks in a customer's M365 environment; included in all MDR licenses at no additional cost.
Extends XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. AI Search (New AI Features EAP) to endpoint data in the Sophos Data Lake, allowing analysts to query endpoint telemetry using natural language in addition to detections.
Fibratus v2.4.0 adds 24 new detection rules, callstack coverage for VirtualAlloc/OpenProcess/OpenThread, new filter operators, and a match-all rule engine strategy.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.0 https://github.com/rabbitstack/fibratus.git
# already have the repo? check out this version:$ git checkout v2.4.0
└──▷ TRY IT
Use foreach with ps._ancestors to check any ancestor process name, replacing the removed ps.ancestor indexed lookups for multi-level chain detection.
$ fibratus run --filter "foreach(ps._ancestors, $a, $a.name = 'winword.exe')"
Adds callstack telemetry for VirtualAlloc, OpenProcess, and OpenThread events, enabling stack-aware detection of memory and handle abuse.
Introduces *.path filter fields (registry.path, image.path, file.path) for matching full path values in filter expressions.
New intersects operator for filter expressions to check set intersection between field values.
New foreach function for iterating over pseudo fields such as ps._ancestors, ps._modules, and pe._sections in rule conditions.
Adds CreateSymbolicLinkObject event type for detecting object-level symbolic link creation.
+7 moreshow less
Incorporates thread pool event telemetry and exposes corresponding thread pool filter fields.
Adds thread start address symbol and module filter fields for richer thread-origin detection.
Adds additional callstack filter fields for deeper stack inspection in rules.
Introduces match-all rule engine strategy to evaluate every matching rule rather than stopping at the first match.
New isolate rule action for isolating a host when a rule fires.
Adds 24 new built-in detection rules covering LSASS dumping, ClickFix infection chains, DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. side-loading, shellcode via ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors., WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. abuse from Office, Windows Defender tampering, suspicious print processors, Vault client DLL loads, XSL/HTA script execution, and more.
Extends substr function with an optional argument for more flexible string slicing in filter expressions.
12 details in Everything
└──▷ BREAKING ON UPGRADE
!registry.key, image.name, and file.name now yield only the base name. Use registry.path, image.path, or file.path to obtain the full path.
!ps.ancestor indexed-field now always returns the ancestor process name for the given level; use the foreach function with ps._ancestors to evaluate other process attributes.
!ps.modules field has been removed; use the foreach function with ps._modules to evaluate module attributes.
!ps.pe.sections field has been removed; use the foreach function with pe._sections to evaluate section attributes.
!Callstack index fields ustart, uend, kstart, and kend have been removed.
Ask AI prompt suggestions and threat actor tags in MISP integration added to Feedly Threat Intelligence
Adds prompt suggestions (expert-curated and LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-generated) in Ask AI when selecting multiple articles for Feedly Threat Intelligence Advanced 2024 plans.
Adds threat actor tags support in the MISP integration for Feedly Threat Intelligence Advanced plan.
2 details in Everything
2 more releases in this issue
· 2025-05-01 → 2025-05-28
Feedly Ask AI adds contextual prompt and variable suggestions based on article content.
Ask AI now scans the current article to instantly suggest expert (curated by TI/MI analysts) and dynamic (LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-generated) prompts
Ask AI suggests relevant variables for refinement fields in expert prompts based on article metadata and subject, supporting aliases for threat actors or companies
Cloudmersive adds automatic virus scanning for SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. (v1/v2/v3) and CIFS network shares with tagging and file actions
Adds support for SMB (v1, v2, and v3) and CIFS Network Shares in Cloudmersive Storage Protection Virus Scanning.
Enables automatic virus scanning of new and modified files on SMB/CIFS shares with applied security policies.
Allows tagging, copying, moving, or deleting clean and infected files detected in SMB/CIFS network shares.
Cloudmersive adds CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and Memory Usage monitoring via the Management Portal for Managed Instances.
Adds Monitoring capability (CPU Usage and Memory Usage) to Cloudmersive Managed Instance Infrastructure Analytics
Provides a new UI path: Management Portal > Managed Instances > instance name > Monitoring tab
ThreatStream adds limited User & Role Management and enhanced Polyswarm sandbox submissions.
Enables role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. via the new User & Role Management feature for the Anomali platform
Adds support for multiple platform submissions in Sandbox malware detonation on Polyswarm
Adds QR code scanning capability for Sandbox malware detonation on Polyswarm
Adds file password protection support for Sandbox malware detonation on Polyswarm
Adds URL and file artifact submission support for Sandbox malware detonation on Polyswarm
ThreatStream adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. and ThaiCert open source feeds in APP Store; deactivates TeamT5 APAC and OpenPhish
Activates MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. Attack open source feed via the APP Store for threat intelligence enrichment
Activates ThaiCert open source feed via the APP Store for regional threat data integration
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The TeamT5 APAC Centric APT Intelligence Report premium feed has been deactivated and removed from the APP Store.
!The OpenPhish.com open-source feed has been deactivated and removed from the APP Store.
ThreatStream OnPrem 5.9 adds ServiceNow bidirectional integration, new MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. profiles, and expanded indicator types
Adds Can Audit permission control setting to the User Admin tab in Settings
Enables bidirectional integration with ServiceNow ITSMITSMIT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows., configurable via the Integrations tab in Settings with domain dropdown selection
Supports MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v15.1 and v16.1 techniques/sub-techniques and allows creation of multiple MITRE ATT&CK profiles with independent security coverage representation
Increases character limit for advanced search queries to 4,000 characters
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Integration with RiskIQ is no longer available due to end-of-life
MISP v2.5.12 adds extended vulnerability validation, split event indicators, and optional extended-event index display.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.12 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.12
Extends validation for vulnerability attributes across all supported ID formats via vulnerability-lookup integration.
Splits Known Identifier from False Positive indicators in the event view for clearer analyst workflows.
Introduces optional display of extended events in the event index.
Adds a default value for extendedEvents in the event index to prevent undefined behavior.
Updates misp-stix, misp-galaxy, and warning-list components to their latest versions.
+2 moreshow less
Improves support for combining multiple authentication methods (OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets./OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.).
Switches OpenPhish feed to a stable, officially supported GitHub-based URL.
MISP 2.4.210 adds split Known Identifier/False Positive indicators, extended vulnerability validation, and optional extended-event index display.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.210 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.4.210
Splits Known Identifier from False Positive indicators in the event view for clearer analyst triage.
Extends vulnerability attribute validation to cover all supported ID formats via vulnerability-lookup.
Adds optional display of extended events in the event index.
Updates misp-stix, misp-galaxy, and warning-list components to their latest versions.
Improves support for combining multiple authentication methods (OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets./OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.).
MISP v2.5.11 adds ad-hoc workflow debugging, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. selection, user IP tools, and UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.-based collection management.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.11 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.11
└──▷ TRY IT
Manage a collection by UUID — useful when you don't have the numeric ID available (e.g., cross-instance references).
$ GET /collections/view/<uuid>
Adds ability to run debugged ad-hoc workflows on specific event IDs directly from the Workflow Editor.
Introduces _env dictionary in Jinja rendering to expose environmental context (e.g., base_url) within workflow templates.
Supports filtered/unfiltered overrides in workflow execution.
Adds OIDC identity provider selection and mixedAuth configuration for flexible authentication setups.
Adds new userIP and IPUser tools to the user controller for IP-based user lookups.
+4 moreshow less
Enables editing, viewing, and deletion of Collections by UUID.
Extends OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. documentation coverage for Collections.
Makes event.info collation case-insensitive at the database level.
Adds PUT method support to CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information.add components.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!The event.info column collation is now case-insensitive, which may affect existing queries or indexes that relied on case-sensitive matching.
MISP v2.4.209 adds ad-hoc workflow debugging on events, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. selection, and new user IP lookup tools.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.209 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.4.209
└──▷ HOW TO FIND IT
Enable mixedAuth so users can authenticate via either OIDC or local credentials, with identity provider selection at login.
📍In the MISP admin console, go to Administration › Server Settings › OIDC and enable mixedAuth along with configuring the identity provider selection.
Adds ability to run debugged ad-hoc workflows directly on specific event IDs in the Workflow Editor.
Introduces _env dictionary in Jinja rendering to expose environmental context (e.g., base_url) within workflows.
Supports filtered/unfiltered overrides in workflow execution.
Adds OIDC identity provider selection and mixedAuth configuration for flexible authentication setups.
Introduces userIP and IPUser tools in the user controller for IP-based user lookups.
+4 moreshow less
Enables editing, viewing, and deletion of Collections by UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide..
Extends OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. documentation for Collections.
Adds missing PUT method support in CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information.add components.
Makes event.info collation case-insensitive at the database level.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!The event.info field collation is now case-insensitive, which may affect queries or integrations that relied on case-sensitive matching of event titles.
MISP v2.4.208 adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. filter escaping config, auth plugin loading from config, and updated threat-intel content packages.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.208 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.4.208
Adds a new configuration option to escape LDAP filters in LdapAuth, hardening directory-based authentication.
Introduces support for loading authentication plugins (e.g., OidcAuth) based on configuration settings rather than requiring manual bootstrap code.
Updates bundled content packages: misp-stix, misp-objects, warning-lists, and misp-galaxy.
MISP v2.5.10 adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. filter escaping, auth plugin config loading, and S3 prefix validation.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.10 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.10
Adds a new configuration option to escape LDAP filters in LdapAuth, hardening directory-based authentication.
Introduces support for loading authentication plugins dynamically based on configuration settings.
Adds validation for S3 bucket prefix when deleting events.
Adds warning logging for remote server version mismatches during sync.
Updates bundled threat-intelligence components: misp-stix, misp-objects, warning-lists, and misp-galaxy.
IntelOwl v6.4.0 adds Nuclei, Bbot, Debloat, IPQuery, and Mullvad DNS analyzers plus GreedyBear and Malshare ingestors.
└──▷ GET THIS VERSION
$ git clone --branch v6.4.0 https://github.com/intelowlproject/IntelOwl.git
# already have the repo? check out this version:$ git checkout v6.4.0
New Nuclei analyzer: run Nuclei template-based scans against targets from within IntelOwl.
New Bbot analyzer: surface BBOT (Bighuge BLS OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. Tool) recon results as an IntelOwl analyzer.
New Debloat analyzer: analyze binaries for bloat/packing detection via the Debloat tool.
New IPQuery analyzer: enrich IP observables using the IPQuery service.
New Mullvad DNS analyzer: check observables against Mullvad's DNS-based blocklists.
+9 moreshow less
New GreedyBear ingestor: automatically pull threat intelligence feeds from GreedyBear into IntelOwl.
New Malshare ingestor: automatically ingest malware samples and hashes from Malshare.
Spamhaus analyzer gains IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. and ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. support.
Adds ability to search investigations by observable in the UI.
Frontend toggle controls for showing/hiding investigations in the UI.
Modals can now be closed with the Escape key in the frontend.
Abuse.ch integration now requires a mandatory API key.
The analyzers_data_model field has been removed from the job report serializer.
The load_env command is removed from the start script; .env files are now initialized automatically.
14 details in Everything
└──▷ BREAKING ON UPGRADE
!The analyzers_data_model field is removed from the job report serializer — any API client or integration reading that field will break.
!The load_env subcommand is removed from the start script; automated workflows that call load_env explicitly must be updated.
!Abuse.ch integrations now require a mandatory API key — existing configurations without a key will stop working.
New detection rules for M365 OAuth abuse, AWS S3 and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. activity, and MSFT Tenant phishing.
└──▷ GET THIS VERSION
$ git clone --branch dev-v1.2.0 https://github.com/elastic/detection-rules.git
# already have the repo? check out this version:$ git checkout dev-v1.2.0
Microsoft 365 OAuth Redirect to Device Registration rule added
Microsoft Entra ID Protection Anonymized IP Risk Detection rule added
MSFT Tenant OAuth Phishing via First-Party VSCode Client rule added
AWS S3 Static Site JavaScript File Uploaded rule added
AWS IAM or STS API Calls via Temporary Session Tokens rule added
Splunk Security Content v5.6.0 adds 8 new analytics including 6 Cisco Secure Firewall/Snort rules, Lumma Stealer and Veeam CVE-2023-27532 detections, and two new analytic stories.
└──▷ GET THIS VERSION
$ git clone --branch v5.6.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v5.6.0
Adds Cisco Secure Firewall - High Priority Intrusion Classification analytic to surface high-priority intrusion events from Cisco Secure Firewall logs.
Adds Cisco Secure Firewall - Intrusion Events by Threat Activity analytic to group firewall alerts by threat actor activity using Snort IDs.
Adds Cisco Secure Firewall - Lumma Stealer Activity, Lumma Stealer Download Attempt, and Lumma Stealer Outbound Connection Attempt analytics to detect Lumma Stealer behaviors via Cisco Firewall intrusion logs.
Adds Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity analytic that correlates specific Snort IDs triggered in a short window to identify exploitation attempts.
Adds Windows PowerShell FakeCAPTCHA Clipboard Execution detection to identify Fake CAPTCHA campaign TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. involving PowerShell clipboard abuse.
+4 moreshow less
Adds Windows Renamed Powershell Execution detection for identifying PowerShell executing under a renamed binary.
Introduces a new Threat Activity by Snort IDs dashboard correlating Cisco Firewall eStreamer logs with a curated Snort-to-threat-actor lookup to visualize device activity, file trends, and host risk profiles in Splunk Enterprise Security.
Adds two new lookups — cisco_snort_ids_to_threat_mapping and threat_snort_count — mapping Snort intrusion IDs to specific threat actors.
Publishes two new analytic stories: Fake CAPTCHA Campaigns and XWorm, providing structured detection coverage for each threat.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!Several detections previously announced for removal in ESCU v5.4.0 have been removed in v5.6.0; users must transition to recommended replacements (see the List of Removed Detections in ESCU v5.6.0).
1 more release in this issue
· 2025-05-08 → 2025-05-21
Splunk Security Content v5.5.0 adds 2 new analytic stories and 5 new detections covering SAP NetWeaver CVE-2025-31324, AMOS Stealer, and Windows post-compromise activity.
└──▷ GET THIS VERSION
$ git clone --branch v5.5.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v5.5.0
New analytic story: SAP NetWeaver Exploitation, targeting CVE-2025-31324 with the SAP NetWeaver Visual Composer Exploitation Attempt hunting detection.
New analytic story: AMOS Stealer, including the MacOS AMOS Stealer - Virtual Machine Check Activity detection that identifies suspicious osascript execution with specific command-line strings.
New detection: Windows EventLog Recon Activity Using Log Query Utilities to surface adversary reconnaissance against the Windows Event Log.
New detection: Windows Eventlog Cleared Via Wevtutil to alert when an adversary clears the Windows Event Log via Wevtutil.
New detection: Windows File Download Via CertUtil to catch malicious file downloads executed through the CertUtil utility.
+1 moreshow less
Updated is_nirsoft_software lookup with additional Nirsoft tooling entries.
pySigma v0.11.23 adds flatten_rules to SigmaCorrelationRule and updates MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. coverage to v17.
└──▷ GET THIS VERSION
$ git clone --branch v0.11.23 https://github.com/sigmahq/pysigma.git
# already have the repo? check out this version:$ git checkout v0.11.23
Adds flatten_rules method to SigmaCorrelationRule to flatten correlation rules into their component rules.
Updates MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. framework support to v17.
Sigma r2025-05-21 adds 15 new detection rules covering Ivanti EPMM RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., CrushFTP, WDAC abuse, and more.
└──▷ GET THIS VERSION
$ git clone --branch r2025-05-21 https://github.com/SigmaHQ/sigma.git
# already have the repo? check out this version:$ git checkout r2025-05-21
New rule: detects Clfs.SYS loaded by a process in a potentially suspicious location.
New rule: detects crash dumps created by the operating system (potential exploit artifact).
New rule: detects HTTP requests to low-reputation TLDs or suspicious file extensions.
New rule: detects Kalambur backdoor curl TOR SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. proxy execution.
New rule: detects Notepad-based password file discovery activity.
+22 moreshow less
New rule: detects PUA AdFind.EXE execution.
New rule: detects PUA NimScan execution.
New rule: detects potential CVE-2024-35250 exploitation activity.
New rule: detects potential exploitation of CVE-2025-4427/4428 Ivanti EPMM pre-auth RCE.
New rule: detects potential unconstrained delegation discovery via Get-ADComputer in ScriptBlock logs.
New rule: detects potentially suspicious WDAC policy file creation.
New rule: detects suspicious autorun registry modifications via WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk..
New rule: detects suspicious CrushFTP child process spawning.
New rule: detects suspicious LNK command-line padding with whitespace characters.
New rule: detects suspicious processes spawned by CentreStack Portal AppPool.
Updated AADInternals detection rules with additional framework strings for broader coverage.
Updated AnyDesk rules to cover the AnyDesk MSI variant (AnyDeskMSI.exe).
Updated audio capture rule to add ecasound detection.
Updated buffer overflow attempt rule with reworked logic and new keywords.
Updated malicious PowerShell commandlet rules to detect Veeam-Get-Creds.
Updated suspicious eventlog clearing rules to cover clearing via .NET dotnet class.
Updated COM object hijacking rule with additional CLSID entries.
Updated potential binary impersonation of Sysinternals tools to include ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead.-compiled binaries.
Updated potential browser data stealing rule to add esentutl.exe.
Updated process memory dump via Comsvcs.DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. rule with additional obfuscation method coverage.
Updated ESXi esxcli rules to align with MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. framework v17.
Cribl Stream 4.12 adds disk-based lookups, Copilot editor, foldkeys function, workspace data transfer, and improved billing/metrics visibility
Adds Disk-Based Lookups as an alternative to in-memory lookups for optimizing memory usage across Worker Processes
Introduces the Copilot Editor with interactive plain-language prompting to generate Regex or JavaScript Expressions for Pipelines
Adds the foldkeys Function to transform flat field names with common separators into nested objects
Expands Cribl.Cloud billing portal with labeled tabs for credit/usage stats, detailed product consumption tables, and an invoice export tab
Introduces Configurable Metrics Levels (Minimal, Basic, Detailed) in Worker Group settings and expands available metrics types
+6 moreshow less
Enables Data Transfer Across Workspaces or Environments using Cribl TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. or HTTP Source/Destination pairs for non-shared Leader workers
Enhances Packs to support Sources, Destinations, and Event Breakers with exportable end-to-end solutions and Pack-level metrics
Improves Import Packs from Git feature with write-back capability for round-trip Git integration
Updates Helm chart to configure Kubernetes Service Account for Leader deployment IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role binding
Adds encoding parameter to Cribl HTTP Source JSON configuration (e.g., "encoding": "utf8") for character encoding support
Adds Enable enhanced TLS handshake for proxy protocol toggle in Syslog Source to preserve source IP/port via PROXY headers
11 details in Everything
└──▷ BREAKING ON UPGRADE
!Persistent queueing (PQ) is no longer available in the free tier of Cribl Stream and requires Standard or Enterprise license plans.
NodeZero adds Flex Access pay-as-you-go option, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. Tripwire deployment, aarch64 RAT support, and parent MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. resource visibility
Introduces Flex Access as a new pay-as-you-go entry point for one-time pentesting without continuous commitment.
Adds SMB-based deployment method for Tripwires to improve implant delivery reliability.
Extends RAT support to aarch64 Linux targets for post-exploitation.
Improves RAT deployment over SSH by evading noexec mount points during startup.
Enables MSP parent accounts to view subclient resources (API Keys, NodeZero Runners) without manual switching.
Rapid7 May 2025 adds attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. connectors, AI dispositioning, ET rules, and bulk exclusion workflows
Attack Surface Management (Surface Command) integrates with Baramundi, Cybereason, Dragos, Markmonitor, Microsoft Defender for IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure., and Zabbix Cloud as new third-party connectors.
Cloud Security (InsightCloudSec) expands the /v2/prototype/apa/path-mapping API endpoint to map old Attack Path IDs to new ones.
SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. (InsightIDR) adds False Positive and Security Test as selectable disposition options for alerts and investigations.
Network Sensor activates Enhanced Emerging Threats (ET) rulesets including ET EXPLOIT, ET EXPLOIT_KIT, and ET SCAN for network traffic detection.
Cloud Security (InsightCloudSec) adds the CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. GCP 3.0 Compliance Pack for cloud account auditing.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The ContainerRegistryHarvester harvester is deregistered and replaced by ArtifactRegistryHarvester in Cloud Security (InsightCloudSec).
!The query filter Dataset Tables Not Leveraging Customer-Managed Encryption Key (CMEK) is removed in Cloud Security (InsightCloudSec).
Tenable One ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. adds Google Cloud Platform integration and keyless auth for AWS, Azure, GCP
Integrate with Google Cloud Platform (GCP) to add assets from your GCP accounts
Support keyless authentication for integrations with AWS, Azure, and GCP
2 details in Everything
12 more releases in this issue
· 2025-05-06 → 2025-05-28
Tenable One Identity Exposure 3.94 adds 5 new Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. IoEs and expands AD coverage with Exchange group tracking
Managed Devices Not Required for Authentication IoE flags tenants not requiring managed devices for auth.
Risky Users Without Enforcement IoE identifies accounts flagged as risky but lacking Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. enforcement.
Authentication Methods Migration Not Complete IoE detects incomplete migration to new authentication policies.
Dangerous Application Permissions Affecting Data IoE finds app permissions threatening user data in Entra ID.
Tenable Data Stream now supports host audit and web app scanning data streaming with new payload fields.
Adds Tenable One Vulnerability Management host audit findings data streaming via Tenable Data Stream (TDS)
Adds Tenable One Web App Scanning assets, tags, and findings data streaming via Tenable Data Stream (TDS)
Adds new fields to VMMVMMA Virtual Machine Monitor is software that creates and manages virtual machines, abstracting physical hardware so multiple OS instances run in isolation; cyber tools use it to sandbox execution or emulate target environments safely. findings payload: Resurfaced Date and Time Taken to Fix
Tenable One OT Exposure 4.2.38 SP 2 updates Nessus to 10.8.4 and adds filenames/checksums to downloads
Nessus engine updated to version 10.8.4 for Tenable One OT Exposure.
Tenable One OT Exposure Downloads page now publishes filenames alongside MD5 or SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. checksums.
Tenable Security Center 6.6.0 adds plugin attachments, dark mode toggle, TLS for external Postgres, and agent scan triggers.
Analysis > Vulnerabilities > Vulnerability Detail List view now displays Plugin Attachments for Nessus and Agent scans to provide additional informational data, controlled by the Import Additional Scan Data setting under Settings > Configuration > Miscellaneous.
License activation can now use a machine UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. instead of the OS hostname, enabling licensing in air-gapped or restricted environments via the new SC License by UUID method.
Agent scans can now be configured to run when triggered by a file added to the agent trigger directory, using the Triggered Agent Scans configuration option under Agent Scan Settings.
Analysis top navigation bar now includes a toggle for Dark Mode, with an option to follow OS settings via User Account Options.
External PostgreSQL connections now support TLS encryption, expanding supported versions to 13 through 17 and allowing customer-created databases without DBcreate permissions.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Upgrade from version 6.2.1 or earlier with more than 10,000 active IPs requires updating the Apache configuration file; failure to do so may cause upgrade issues.
!External PostgreSQL database must be running and reachable before upgrading to 6.6.0.
DefectDojo 2.46.0 adds new parsers, vulnerability ID sources, OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. mitigation data, and API risk-acceptance controls.
└──▷ GET THIS VERSION
$ git clone --branch 2.46.0 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.46.0
└──▷ TRY IT
Set a recommendation and decision on a risk acceptance via the API — newly writable fields in this release.
Adds Alibaba Linux vulnerability IDs to the vulnerability ID tracking system.
Adds Amazon Linux Security Center advisories as vulnerability IDs.
Adds Cisco Security Advisory as a vulnerability ID source.
Adds HCL Commerce KB vulnerability IDs.
Enables setting recommendation and decision fields on risk_acceptance via API.
Updates tag allowed characters to a unified format (API and database change).
Reimport now respects special finding statuses (e.g., false positive, out-of-scope) carried from reports.
Tenable importer now validates mandatory columns before importing.
Shows date and author on the most recent note in the finding UI.
Speeds up UI page loading by serving smaller (minified) JS and CSS resources.
Improves accessibility by restoring focus indicators when tabbing through the UI.
Publishes nightly builds of the dev branch as Docker images.
Removes non-working DD_SLA_BUSINESS_DAYS setting to eliminate misconfiguration.
21 details in Everything
└──▷ BREAKING ON UPGRADE
!The DD_SLA_BUSINESS_DAYS setting is removed; any configuration referencing it will no longer have effect and should be cleaned up to avoid confusion.
!Tag allowed characters are changed to a unified format — existing tags containing previously-allowed characters that fall outside the new format may be affected (database migration required).
Edgescan adds Jira Data Center integration, licensing filters, sitemap export, ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. asset creation, and vulnerability event re-sending.
Integrates Edgescan vulnerabilities into Jira Data Center for developer workflows.
Adds filtering of assets by Penetration_tests, licence status, auto renewal, and licence UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide..
Enables exporting sitemap data directly from the scope configuration page.
Allows creation of assets directly from ASM results.
Exposes a subset of vulnerability definitions in the user GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..
5 details in Everything
1 more release in this issue
· 2025-05-12 → 2025-05-26
Edgescan adds SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. metrics to customer dashboards and asset tier classification fields
Adds SLA-related metrics to customer dashboards for performance tracking and compliance monitoring
Adds an asset tier field to asset records to classify assets by tier
Adds improved indicators to distinguish manually scanned assets from fully automated ones
Adds the ability to display the user who accepted a risk on a vulnerability report
Custom Roles feature now live for all customers, enabling granular RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. and multiple role assignments per user.
Enables creation of custom Account and Global roles with granular read, write, edit, and delete permissions for every Automox feature
Allows assigning multiple roles to a single user, tailored to individual needs and specific organizations
runZero 4.0.250529.1 adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. cert expiration banners and fixes PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. exclusion on Explorers.
Banners notify superusers when the SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. certificate used for single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. (SSO) is expiring soon
PII attribute exclusion now works correctly when integrations are configured to run on an Explorer
runZero 4.0.250513 adds role info to User API, MS365 avMode filtering, asset Network ID filtering, crypto/export scripting, and dashboard update footers.
User API endpoints now return default, assigned, and effective role information for users
Microsoft 365 Defender integration imports the avMode attribute and only sets the EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. name when avMode is Active
Qualys integration filters assets by Network IDs
Custom integration scripts can call sha256, sha512, sha1, and md5 crypto hashing functions
Custom integration scripts can export asset data to a json.gz file for import into a runZero organization
runZero 4.0.250505.0 adds PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. exclusion for integrations and new capabilities for custom integration scripts.
Adds configurable attributes to exclude from data collection in some integrations via excluding integration attributes
Allows custom integration scripts to treat a None return value as success instead of failure
Enables limited session-like functionality for making HTTP requests within custom integration scripts
Adds base64 encoding and decoding functions to the custom integration script environment
Intruder adds an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server enabling AI agents to manage vulnerability scans and remediation via natural language
Adds an open-source Python module implementing the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCP) for Intruder's API
Enables AI agents to programmatically add targets and run vulnerability scans through a standardized interface
Exposes existing API endpoints to AI agents via FastMCP for prioritizing issues, generating management summaries, and validating remediation
Adds --authenticated-attach-code CLI flag and corresponding configuration parameter to registration messages, enabling authenticated machine attachment.
Adds USG (Ubuntu Security Guide) plugin with an example.conf for hardening profile management via the Landscape client.
Adds support for .sources format files when applying and disassociating repository profiles on Noble and later Ubuntu releases.
Enables RISC-V (riscv64) snap builds of the Landscape client.
Reduces high CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage in the Landscape client package reporter.
Fleet 4.68.0 adds Microsoft Entra conditional access, batch script execution, GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. YAML generation, and webhook query logging.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.68.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.68.0
└──▷ USE IT
Pin a software installer in GitOps by its SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hash to ensure the exact expected binary is used and matches any already-downloaded installer.
yaml
# In your software YAML:
software:
- url: https://example.com/myapp-1.0.pkg
hash_sha256: "4d9e2bdfef1dd602e758e514ddbb235b1c325f5f4699b6a80e1272fdb3c932a4"
Enable Microsoft Entra conditional access on a specific policy so hosts that fail it are blocked from SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management..
📍In the Fleet UI, go to Policies, select a policy, open its settings, and enable the Conditional access (Microsoft Entra) toggle.
Adds Microsoft Entra integration to conditionally block SSO for hosts failing policies.
Adds CVE ID as a matching criterion for host software queries (in addition to software name).
Adds webhook as a logging configuration option for query automation.
Adds webhook query automation logging with query ID included in automation logs.
+17 moreshow less
Adds shell and PowerShell syntax highlighting in the script editor UI.
Adds ability to run a script on a batch of hosts in a single user flow.
Adds hash_sha256 field to software YAML for download validation and existing-installer matching in GitOps.
Adds hash_sha256 field to the GET /software/titles API response.
Adds fleetctl generate-gitops command to generate GitOps YAML files from the current Fleet configuration.
Enables saving Integrations > Advanced settings in GitOps mode.
Adds support for uploading and installing tarball archives (.tar.gz).
Adds support for Fleet-maintained apps (FMA) in GitOps, including via fleetctl YAML files.
Adds UI for manual agent install of a bootstrap package.
Adds categorization and filtering for self-service software on the My device page.
Adds count of policies triggering automatic software installs in the software table.
Adds support for FLEET_VAR_HOST_END_USER_IDP_USERNAME, FLEET_VAR_HOST_END_USER_IDP_USERNAME_LOCAL_PART, and FLEET_VAR_HOST_END_USER_IDP_GROUPS Fleet variables in macOS MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. configuration profiles.
Adds last_mdm_enrolled_at and last_mdm_checked_in_at fields to host detail endpoints.
Adds macos_setup.manual_agent_install option in Mac setup experience to bypass automatic fleetd installation.
Allows uploading VPP apps when GitOps mode is enabled.
Allows viewing install/uninstall status details from the My device page.
Displays decimal representation of certificate serial numbers (below 2^63) alongside hex for easier macOS keychain matching.
Adds passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. support for Windows via MSIX beta; adds Autofill username toggle in Settings > General
Supports using, saving, and syncing passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. across devices when installed from the MSIX beta channel.
Adds Autofill username when creating a new login setting under Settings > General to control autofill behavior for manually created logins.
Adds a welcome prompt to install the 1Password browser extension for business SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. users
1Password SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Manager May 2025 adds manual AI re-extraction, image support, domain restrictions and support access controls
Adds manual Process with AI refresh for existing contracts via the attachment context menu, providing real-time status updates
Extends AI extraction to support PDF and JPG image file types
Enforces new User Restrictions preventing modification, creation, or invitation of users from domains not owned by the organization
Adds Allow support to access your organization control in account settings for managing direct support team data access
Adds 'Autofill username when creating a new login' setting and restricts device location usage to Home screen with Nearby items tile.
Adds the "Autofill username when creating a new login" setting under Settings > General to control whether the username field is pre-populated for manually created logins
Restricts device location access to only when the user is on the Home screen and has enabled the Nearby items tile
1Password for Windows adds passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. provider support and a new autofill username setting.
Adds support for using, saving, and syncing passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. as a third-party passkey provider
Adds a new 'Autofill username when creating a new login' toggle under Settings > General
Welcome prompt for installing the browser extension when joining a business SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. account
Nudge Security is a SaaS security platform that discovers shadow IT assets, manages identity governance, and hardens security posture.
Spend dashboard now highlights SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. apps with high subscription counts to aid consolidation.
Adds a new card to the spend dashboard identifying SaaS apps with many individual subscriptions.
1 detail in Everything
3 more releases in this issue
· 2025-05-07 → 2025-05-21
Ory Network adds LoginInitiated, RegistrationInitiated, RecoveryInitiatedByAdmin events and full SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. event stream for user/group lifecycle.
Adds LoginInitiated event emitted when a login flow is started
Adds RegistrationInitiated event emitted when a registration flow is started
Adds RecoveryInitiatedByAdmin event emitted when an account recovery flow is initiated by an administrator
Adds SCIM-based events for all data-writing endpoints: IdentityCreated, IdentityUpdated, IdentityDeleted, SCIMGroupCreated, SCIMGroupUpdated, SCIMGroupDeleted, SCIMProvisioningError
Emits IdentityUpdated events for affected users when group members are modified or groups are deleted
+1 moreshow less
Includes ScimClient attribute in all SCIM-triggered events holding the initiating client ID
6 details in Everything
3 more releases in this issue
· 2025-05-08 → 2025-05-09
Ory Tunnel adds SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. support for local development testing
Ory enhances account security and multi-tenant onboarding with new enumeration controls and org-aware registration flows in its preview Account Experience.
QR Verify feature added to Verify API for limited early access
Enables QR-based verification as a new MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. method via the Verify API
Telesign Verify API adds Push Verify callback events (delivery and read) to track push notification status.
└──▷ HOW TO FIND IT
Monitor push notification delivery status for verification codes in an Android app.
📍// Use Telesign Verify SDK helper classes to register callbacks for delivery and read events
// Refer to developer documentation: https://developer.telesign.com/enterprise/changelog/push-verify-callbacks-added-to-verify-api
Enables manual and automatic callback integration on Android and iOS via helper classes
Passbolt v5.1 adds opt-in encrypted resource metadata, default password expiry for new installs, and tag rotation APIs.
Adds encrypted resource metadata support as an opt-in feature to protect names, URLs, and other contextual fields cryptographically
Enables password expiry by default for all new Passbolt installations in v5.1
Adds /metadata/keys.json API endpoint that now returns the creator field alongside metadata keys
Adds email claim alias support for OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. providers via server config, enabling custom email mappings
Adds PRO tag management API endpoints to get and rotate tags with expired metadata keys (PB-37364)
+3 moreshow less
Adds PRO tag upgrade capability from v4 format to v5 format (PB-37702)
Adds datacheck command support for v5 resources in Passbolt administration
Adds dedicated autofill input in the browser extension to fix autofill on specific websites
Acsense adds customizable IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. alerting with email/Slack/SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. channels via the UI's New Alert Subscription flow.
└──▷ HOW TO FIND IT
Set up a customizable IAM alert for key events with real-time notifications via Email, Slack, and SIEM.
📍Navigate to Settings › Alerts page. Click New Alert in the Create Alert Subscription pop-up window. Fill out details (optional Actor ID/Target IDs). Select notification channels (Email, Slack, SIEM). Select up to 5 event types from dropdown. Click Save.
Adds ability to create customizable alerts for key IAM events via the Alerts page in Settings
Enables real-time notifications via Email, Slack, and SIEM channels for alert delivery
Supports selecting up to 5 event types per alert configuration
ZIA adds Workday/Webex SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications., Grok prompts via API/config, file type controls, SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. for email DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., and SharePoint site groups.
Adds enableGrokPrompt Boolean field to the AdvancedUrlFilteringCloudAppOptions model in /advancedUrlFilterAndCloudAppSettings APIs for Grok AI prompt configuration.
Adds SSPM Scan checkbox onboarding support for Workday tenants via Advanced SSPM.
Adds SSPM Scan checkbox onboarding support for Webex Teams tenants via Advanced SSPM.
Expands File Type Control and DLP to include Appinstaller Files (.appinstaller) in the Other Documents category.
Enables password-protected criteria (.pdf, Encrypted Office, ZIP, RAR, 7-Zip, etc.) for File Type Control rules and adds passwordProtected criterion to /fileTypeRules endpoints.
+6 moreshow less
Enables microphone and camera functionality for users in isolated browser profiles when Turbo Mode is enabled.
Adds SCIM-based user lookup support for Zscaler Outbound Email DLP to map email addresses with ZIA login names.
Adds %s{sender} field to NSS/CloudNSS Feed Output Format for Email DLP logs.
Supports DLP policy rules without content inspection for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API Data at Rest Scanning.
Adds Site and Site Groups management (view, add, edit, bulk upload via CSV up to 10,000 sites/group) for SharePoint tenants in SaaS Application Tenants and DLP policies.
Supports unified onboarding, editing, and deletion of SaaS application tenants with 3rd-Party App Governance or Advanced SSPM from the ZIA Admin Portal.
11 details in Everything
36 more releases in this issue
· 2025-05-01 → 2025-05-30
ZIA adds unified onboarding of SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. app tenants to Admin Portal and new Web Insights Bandwidth by Data Center filter
Adds ability to onboard, edit, and delete new SaaS application tenants enabled with 3rd-Party App Governance or Advanced SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. directly from the Add SaaS Application Tenant page in the ZIA Admin Portal
ZIA adds risk explainability to 3rd-Party App Governance and Advanced SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. via hover tooltips.
Adds ability to view breakdown of app risk score by hovering over the risk score in the App Panel header
Adds ability to view breakdown of control severity level by hovering over the severity in the Control Panel header
Adds STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against.-compliant RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 Private Service Edge image for Nutanix deployments.
Zscaler Client Connector 4.4.1 adds Device Events dashboard, Linux Telemetry option, and Disable Reasons API export.
Adds a Device Events dashboard displaying ZIA and ZPA service status and statistics on users turning off services via passwords
Supports a new endpoint in the Zscaler Client Connector API to download or export the Disable Reasons report under enrolled devices
Adds a Device Upgrade Status section to the Zscaler Client Connector Registered Device Details window that displays the status of an in-progress upgrade
Updates the Zscaler Client Connector Portal to support using device groups with app profiles for Authentication Service users
ZIA adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. email DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. lookup, password-protected file rules, isolation mic/cam, site group DLP, and extensive cloud API endpoints.
POST /cloudApplicationInstances, PUT /cloudApplicationInstances/{instanceId}, DELETE /cloudApplicationInstances/{instanceId} for managing cloud application instances via API
/fileTypeRules API now supports the passwordProtected rule criterion
GET /users API rate limit updated to 10 calls/minute and 40 calls/hour
New API categories: Alerts, Bandwidth Control & Classes, Cloud Nanolog Streaming Service, Forwarding Control Policy, FTP Control Policy, Mobile Malware Protection Policy, Time Intervals, Admin & Role Management, Cloud Applications, NAT Control Policy, Firewall Policies, Cloud App Control Policies, and Service Edges
GET /virtualZenClusters, POST /virtualZenClusters, PUT /virtualZenClusters/{virtualZenClusterId}, DELETE /virtualZenClusters/{virtualZenClusterId} for managing Virtual Service Edge clusters
+20 moreshow less
New API endpoints for alert subscriptions: GET /alertSubscriptions, POST /alertSubscriptions, GET /alertSubscriptions/{alertSubscriptionId}, PUT /alertSubscriptions/{alertSubscriptionId}
New API endpoints for bandwidth control rules: GET/POST/PUT/DELETE /bandwidthControlRules and /lite variants
New API endpoints for bandwidth classes: GET/POST/PUT/DELETE /bandwidthClasses and /lite variants
New API endpoints for NSS servers: GET/POST/PUT/DELETE /nssServers
New API endpoints for mobile malware protection: GET/PUT /mobileAdvanceThreatSettings
New API endpoints for FTP control settings: GET/PUT /ftpSettings
New API endpoints for third-party proxies: GET/POST/PUT/DELETE /proxies and /lite variants
New API endpoints for time intervals: GET/POST/PUT/DELETE /timeIntervals
New API endpoints for password expiry settings: GET/PUT /passwordExpiry/settings
New API endpoints for cloud application risk profiles: GET/POST/PUT/DELETE /riskProfiles and /lite variants
New API endpoints for DNAT control policies: GET/POST/PUT/DELETE /dnatRules
New API endpoints for DNS Gateways: GET/POST/PUT/DELETE /dnsGateways and /lite variants
New API endpoints for tenant profiles: GET/POST/PUT/DELETE /tenancyRestrictionProfile
SCIM-based user lookup added to Zscaler Outbound Email DLP for mapping email addresses to ZIA login names
%s{sender} field available in Feed Output Format for NSS or Cloud NSS feed configuration of Email DLP logs
File Type Control and DLP now supports .appinstaller file type in the Other Documents category
File Type Control rules can now be configured based on Password-Protected criteria for PDF, Encrypted Office Docs, ZIP, RAR, 7-Zip, ZIP w/Suspicious Script, and Zipx formats
Isolation profiles now support microphone and camera functionality if Turbo Mode is enabled
SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Data at Rest Scanning DLP policies can be created without content matching
SaaS Application Tenants manages SharePoint Sites and Site Groups; Data at Rest Scanning DLP supports Sites (up to 1,024) or Site Groups (include/exclude up to 256)
ZIA adds Zoom controls via Tenant Profiles and Instance Discovery Report enhancements for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. visibility.
Adds support for Zoom in Tenant Profiles to control actions like file transfer and recording
Adds Domain, Tenant, Site, and Workspace levels to the Instance Discovery Report
ZPA adds privileged credentials analytics and approval request management in the Admin Portal.
Adds Credentials Diagnostics page to view analytics for privileged remote access (PRA) including total credentials, active usage, and breakdown by protocol type
Adds ability to approve or reject PRA approval requests directly from the ZPA Admin Portal without switching to the PRA Portal
Updates page name from Requests Diagnostics to Approval Requests Diagnostics for PRA workflows
Enables Markdown format support when creating Acceptable Use Policies (AUP)
Zscaler Client Connector Portal 4.4.1 adds Device Events dashboard, Linux App Profile telemetry, and an API export endpoint for Disable Reasons.
Adds a Device Events dashboard that displays ZIA and ZPA service status and statistics about users turning off the services via passwords
Adds the Zscaler Client Connector Telemetry option in App Profiles for Linux
Supports a new endpoint in the Zscaler Client Connector API to download or export the Disable Reasons report under enrolled devices
Adds a Device Upgrade Status section to the Zscaler Client Connector Registered Device Details window that displays the status of an in-progress upgrade
Updates the Zscaler Client Connector Portal to support using device groups with app profiles for Authentication Service users
ZIA adds HTTP Header Control profiles, DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. for .appinstaller/password-protected files, Site Group support in SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security, and extensive Cloud Service API endpoints.
Adds passwordProtected criterion to the /fileTypeRules API endpoint for File Type Control and DLP
Adds GET /alertSubscriptions, POST /alertSubscriptions, PUT /alertSubscriptions/{alertSubscriptionId} endpoints for managing alert subscriptions via Cloud Service API
Adds POST /cloudApplicationInstances, PUT /cloudApplicationInstances/{instanceId}, DELETE /cloudApplicationInstances/{instanceId} endpoints for cloud application instance management
Adds HTTP Header Profile and HTTP Header Insertion Profile in the ZIA Admin Portal for URL filtering based on HTTP headers
Adds Site Group management in SaaS Application Tenants with bulk upload via CSV and support for up to 10,000 sites per group
+5 moreshow less
Adds DLP policy rules without content inspection for SaaS Security Data at Rest Scanning
Expands File Type Control and DLP to support .appinstaller file types in the Other Documents category
Adds GET /users rate limit of 10 calls/minute and 40 calls/hour in the Cloud Service API
Deprecates Trigger Multi-Factor Authentication action in UEBA Alert rules, leaving only Trigger an Alert or Place user in group options
Adds passwordProtected field support for PDF, Encrypted Office Documents, ZIP, RAR, 7-Zip, ZIP w/Suspicious Script, and Zipx formats in File Type Control
New ZPA Cloud Service API endpoints for admin, role, client settings, app provisioning, and cert generation
Adds GET /mgmtconfig/v1/admin/customers/{customerId}/administrators/{adminId} and related admin CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. endpoints to the ZPA cloud service API.
Adds POST /mgmtconfig/v1/admin/customers/{customerId}/roles, PUT .../roles/{roleId}, and DELETE .../roles/{roleId} for programmatic role management.
Adds POST /mgmtconfig/v1/admin/customers/{customerId}/clientSetting and related endpoints for managing client settings via API.
Adds POST /mgmtconfig/v1/admin/customers/{customerId}/application/provision to provision applications with all related objects.
Adds POST /mgmtconfig/v1/admin/customers/{customerId}/enrollmentCert/selfsigned/generate and POST .../enrollmentCert/csr/generate for certificate generation.
ZPA updates OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. predefined controls to support version OWASP_CRS/4.8.0
Adds support for OWASP_CRS/4.8.0 in OWASP predefined controls, becoming the default on the OWASP Predefined Controls page and AppProtection Profiles page
Raises event priority to High for Last Component Disconnected events for App Connectors and ZPA Private Service Edges
ZIA adds C2 traffic alerts, WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output.DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. protocol support, cloud application instance API endpoints, and granular admin role permissions.
Adds POST /cloudApplicationInstances, PUT /cloudApplicationInstances/{instanceId}, and DELETE /cloudApplicationInstances/{instanceId} endpoints for programmatic management of cloud app instances
Enables alerts for unknown or suspicious C2 traffic, available by default in Advanced Threat Protection Policy configuration
Adds passwordProtected criterion to /fileTypeRules API and File Type Control UI for handling encrypted PDF, Office, ZIP, RAR, 7-Zip, and Zipx files
Adds WebSocket and WebSocket SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS as selectable protocol types in DLP rules, specifically supporting Microsoft Copilot application monitoring
Extends Admin Role Management to allow field-wise permissions (Full, View Only, None) for individual ZIA features across Admin Portal and API roles
+2 moreshow less
Enables microphone and camera functionality in Isolation Profiles when Turbo Mode is enabled
Adds Instance Discovery Report visibility for Domain, Tenant, Site, and Workspace instance types across Google Drive, Gmail, Box, OneDrive, Microsoft Outlook, Microsoft Teams, Salesforce, ServiceNow, SharePoint, Slack, and GCP
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The Trigger Multi-Factor Authentication action under Adding Alert Rule for UEBA Alert is deprecated and alert triggers with Multi-Factor Authentication are no longer supported
DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Incident filters now support case-insensitive matching, hostnames for URL fields, and multi-string AND logic.
Referrer URL and URL incident filters now accept complete host names (e.g., www.jumpshare.com) in addition to full URLs.
EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. introduces automatic Approved status for verified assets discovered during onboarding.
Automatically updates asset status from Candidate to Approved upon successful verification
Zscaler DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds AWS subset onboarding, GCP VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules.embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG., unmanaged DB access tabs, AI service scanning, and custom predicates.
AWS Services selection during onboarding allows monitoring only specified services (e.g., Storage bucket) with minimal permissions
GCP account onboarding now accepts Custom Network Settings for orchestrator and scanner services to embed them in existing networks
Compliance Dashboard now displays counts of failed policies and resources per control category for each framework
Dashboard includes AI Services Widget monitoring AWS Bedrock Knowledge Bases and Agents, and an AI Models tab
Access Tab added to Data Inventory for unmanaged databases (e.g., MSSQL, PostgreSQL) showing privileges, users, and roles
+5 moreshow less
Data Inventory now displays graph for AWS Bedrock Knowledge Base linking sensitive data stores to agents on the Risk Explorer tab
18 new Data Posture Policies for AWS, Azure, and GCP (e.g., unmanaged SQL audit logging, Bedrock guardrails, Cloud SQL deletion protection)
Support for scanning GCP Compute Engines including disks, posture, and access checks on Dashboard and Data Inventory
On-Premises Database Scanning enabled for MSSQL via remote agentless scans in private/public data centers
New predicates: Can be accessed by (unmanaged PostgreSQL), Has Entitlement, Has Access to (GCP Compute VM), Exposed to AI service
ZDX Module 4.4 for macOS adds PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. handling, Z-Tunnel DNAT support, and improved Cloud Path logic.
Adds handling of personally identifiable information (PII) for new features
Adds support in Cloud Path where the traffic is sent through the tunnel and bypassed through the Application Profile PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration.
Supports Destination Network Address Translation (DNAT) topology in Zscaler Internet Access (ZIA) Z-Tunnel 1.0 mode
DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds AWS Bedrock/Agents monitoring, unmanaged DB access analysis, GCP Compute scanning, and new policy predicates
Adds AWS Bedrock Knowledge Bases and AWS Bedrock Agents as monitored primary data stores with dedicated AI Services Widget, Data Inventory, Risk Explorer graph, and policy checks.
Adds AI Models tab on the DSPM dashboard to summarize models in use across AI services and detect risky/un-sanctioned models.
Adds Access tab for unmanaged databases (MSSQL, PostgreSQL) in Data Inventory showing privilege aggregation, privileged users, and potential security issues.
Adds support for scanning GCP Compute Engines (VM disks) with classification, misconfiguration, vulnerability, access, and entitlement checks via custom policies and investigation queries.
Adds on-premises database scanning support for MSSQL using agentless remote scans against private/public data center objects.
+6 moreshow less
Adds cloud account onboarding enhancements allowing selective AWS service subsets during onboarding to enforce minimal permissions.
Adds GCP account onboarding option to embed orchestrator and scanner services in existing network settings instead of automatic defaults.
Compliance Dashboard now shows the number of failed policies and resources per control category for each compliance framework.
New data posture policies added for AWS (e.g., Unmanaged AWS Microsoft SQL server does not have audit logging, S3 bucket containing sensitive data is encrypted with a KMS key that does not belong to AWS organization), Azure AI Foundry Hub, and GCP Cloud SQL.
Adds relationship predicates for investigation/policy queries: Can be accessed by for unmanaged PostgreSQL; Has Entitlement, Has Access to, Can be accessed by for GCP Compute VM.
Adds Exposed to AI service predicate to check storage accounts containing sensitive data exposed to AI services.
ZIA adds granular admin role permissions, instance discovery levels, and extensive new Cloud Service API endpoints
Admins can assign field-wise permissions (Full, View Only, None) via Administration > Role Management for ZIA features, SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. partner roles, and API roles
Instance Discovery Report now supports Google Drive, Gmail, Box, OneDrive, Microsoft Outlook, Microsoft Teams, Salesforce, ServiceNow (Level 1), SharePoint, Slack (Level 2), and GCP (Level 3) with Domain, Tenant, Site, and Workspace instance types
New Cloud Service API endpoints for cloud application instances: POST /cloudApplicationInstances, PUT /cloudApplicationInstances/{instanceId}, DELETE /cloudApplicationInstances/{instanceId}
GET /users rate limit updated to 10 calls/minute and 40 calls/hour
New Cloud Service API categories and endpoints added for Alerts, Bandwidth Control & Classes, Cloud Nanolog Streaming Service, Forwarding Control Policy, FTP Control Policy, Mobile Malware Protection Policy, Time Intervals, Admin & Role Management, Cloud Applications, NAT Control Policy, Firewall Policies, and Cloud App Control Policies
+1 moreshow less
New Virtual Service Edge cluster endpoints: GET /virtualZenClusters, POST /virtualZenClusters, GET /virtualZenClusters/{virtualZenClusterId}, PUT /virtualZenClusters/{virtualZenClusterId}, DELETE /virtualZenClusters/{virtualZenClusterId}
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The Sandbox Scanning Portal URL changed to HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. at https://filecheck.zscaler.com/; previous bookmarks no longer work
Breach Predictor adds company logos to findings/events UI and expands policy recommendations to File Type Control and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection.
Adds company logos to the Findings page (Attack Path tab) and Events page in the Zscaler Breach Predictor Portal to identify log sources for threat data
Expands Policy Recommendations on the Threat page to include File Type Control and SSL Inspection policies alongside Sandbox and URL Filtering
EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. adds an asset discovery chain on the Asset Details page to trace asset connections and attestation.
Validate a policy file for v2 compliance before pushing it live, catching load-time errors (such as missing @ in usernames) without disrupting a running instance.
$ headscale policy check --file policy.json
New headscale nodes list-routes command shows approved, available, and serving (primary) routes per node.
New headscale nodes approve-routes --identifier <id> --routes <cidrs> command replaces the old dedicated route API/CLI for managing node routes.
New headscale policy check --file <file> command validates a policy file for errors before loading it.
Routes are now managed via the Node API; route state is kept in-memory rather than a dedicated database table.
Expanded /debug endpoint now exposes running goroutines, CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./memory profiles, config, policy, per-node SSH policy and filter, connected nodes, and DERPmap.
+3 moreshow less
OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. integration now fetches UserInfo to populate email_verified, name, email, and username when the ID token omits them.
Restores support for Override local DNS behaviour.
Performance improvement: node update queries now fetch only nodes relevant to the requesting node.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!The dedicated Route API and Route CLI (headscale routes …) have been removed; route management now goes through headscale nodes list-routes and headscale nodes approve-routes.
!Policy v2 is now the default: all usernames in policy rules must contain an @ character (e.g. john must be written as john@); policies that previously loaded but failed at runtime will now fail at load time.
!The oidc.map_legacy_users and oidc.strip_email_domain config keys have been removed.
!server_url and base_domain are no longer allowed to be equal.
!The pre-auth key API/CLI now uses the numeric ID instead of username to identify keys.
!The pre-auth key API now returns a full user object instead of a username string.
!Node FQDNs in the netmap now include a trailing dot (.), aligning with tailscale.com behaviour — clients that parse FQDNs without expecting a trailing dot may break.
VNS3 6.7.4 adds API for clientpack Extra Config, system variables in firewall rules, and session auth for downloads
Adds clientpack_extra_config to the Cohesive API and terraform provider to get/edit clientpack Extra Config data
Adds new system variables for the controller's overlay IP and the topology's VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. address in Firewall Sets and Firewall Rules
Supports abbreviated format -j TTL and -j TCPMSS firewall rule targets without requiring -m module information
Allows snapshot and Plugin Image downloads to use current session credentials via API and Web UI
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The word custom is now a reserved word and cannot be used in the name of custom variables
Quarantine Bay now displays all versions of quarantined files with metadata.
The Federated Search and Sensitive Data Governance Quarantine Bay page now lists all the versions of the quarantined file, including last modified date, time, and size.
Druva Enterprise Workloads now supports selecting Azure or AWS Cloud Storage as a target for protecting Azure SQL, VMware, Nutanix AHVAHVAcropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license., File Servers, NAS, SAP HANA, and Oracl
Allows selection of preferred Cloud Storage (Azure or AWS) for protecting Azure SQL, VMware, Nutanix AHV, File Servers, NAS, SAP HANA, and Oracle DTC workloads in addition to AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. and Azure VMs
Adds support for the Windows Server 2025 operating system for Hyper-V backups
Druva MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. adds data protection support for Azure SQL Server, Managed Instances, and Azure SQL Database.
Druva releases eDiscoveryeDiscoveryA legal process for identifying, collecting, and producing electronically stored information in response to litigation or investigation; cyber tools integrate with it to extract and preserve forensic evidence in legally defensible formats. Download Client v2.1.0 with minor enhancements.
Druva has released an updated eDiscoveryeDiscoveryA legal process for identifying, collecting, and producing electronically stored information in response to litigation or investigation; cyber tools integrate with it to extract and preserve forensic evidence in legally defensible formats. Download Client (v2.1.0) for endpoints, requiring users to upgrade if disconnected and whitelist download URLs.
Veeam Kasten is a Kubernetes-native platform for backing up, restoring, and migrating containerized applications and their persistent data.
Kasten K10 8.0 adds KubeVirtKubeVirtA Kubernetes extension, maintained by the KubeVirt open-source community, that lets virtual machines run as native Kubernetes workloads alongside containers, giving cyber tools a single orchestration layer for both VMs and pods. dashboards, multi-passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. encryption rotation, ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware./POWER support, and self-service cluster migrations via admission policies.
└──▷ TRY IT
Enable the Validating Admission Policy at install time so non-admin users can only create policies within their permitted scope.
Adds a Helm flag to enable installation of Validating Admission Policy, enforcing permissions during Kasten policy creation for non-admin users.
Adds serviceAccount.name Helm value support, with per-microservice ServiceAccounts replacing the shared k10-k10 service account to minimize attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
Adds support for Import actions for application-scoped policies created by non-admin users, enabling self-service cluster migrations.
Adds support for multiple simultaneous active passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. to enable encryption key rotation for exported data.
Adds a new Virtual Machines dashboard page for visibility into KubeVirt-based workloads and dependent resources across the cluster.
+5 moreshow less
Adds a new Restore Point dashboard page to simplify management of available restore points and initiate restore operations.
Redesigns the Policies dashboard with a table-based view, expanded search and filtering, and a new per-policy detail view.
Expands VBR (Veeam Backup & Replication) repository export support to all clusters where storage provisioners support block mode export, including KubeVirt volumes.
Adds support for OpenShift 4.18.
Adds multi-architecture support for 64-bit ARM and POWER CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. architectures in addition to existing x86_64.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!Kasten now uses deployment-specific ServiceAccounts instead of the shared k10-k10 service account. Customers who configured Vault Kubernetes Auth with k10-k10 must re-configure Vault to use the crypto-svc service account before upgrading.
!After upgrading to 8.0.0, installations with KDR enabled that do not explicitly set kastenDisasterRecovery.quickMode.enabled=false will default to Quick DR with local catalog snapshot. A KDR backup is recommended before upgrading.
!The k10restore Helm chart is deprecated and will be removed in a future release; alternate KDR recovery options must be adopted.
!Environments using the kubernetes.io/portworx-volume in-tree Portworx storage provisioner do not support the new default KDR Quick DR mode; explicitly disable it with kastenDisasterRecovery.quickMode.enabled=false before upgrading.
Kopia is an open-source backup tool for Windows, macOS, and Linux with incremental snapshots, client-side end-to-end encryption, compression, and deduplication, with both a CLI and a GUI.
Kopia v0.20.0 adds diff stats, S3 role assumption, Azure cert auth, and per-host/per-user policy creation in the UI.
└──▷ GET THIS VERSION
$ git clone --branch v0.20.0 https://github.com/kopia/kopia.git
# already have the repo? check out this version:$ git checkout v0.20.0
└──▷ TRY IT
Compare two snapshots and print only the summary statistics — useful in CI or alerting scripts where you want counts of changed files without the full diff output.
Adds --stats-only flag to the kopia diff command to output only aggregate statistics without a full file listing.
Adds helper functions to retrieve preceding snapshots automatically for use with kopia diff, reducing manual snapshot ID lookup.
Adds snapshot.FindPreviousManifests() to the Go library for programmatic retrieval of prior snapshot manifests.
Adds a flag for rclone's startup timeout when using rclone-backed repositories.
Adds role assumption support for S3 storage backends.
+4 moreshow less
Adds Azure Blob client certificate authentication for the Azure storage provider.
Adds a max file size field to the policy editor in the web UI.
Adds the ability to create per-host, per-user, and foreign policies directly from the web UI policy editor.
Allows SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. email notifications without requiring login and password (plain SMTP without forced upgrade to SMTPS) in the web UI.
Adds CrowdStrike SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Log Streams and an Agent Proxy environment variable for process-based Client Workload identification.
Adds Log Streams for CrowdStrike Next-Gen SIEM to stream Access Authorization Events, Audit Logs, and Workload Events via HTTP Event Collector (HECHECAn HTTP API endpoint provided by Splunk that lets applications stream JSON-formatted events directly into a Splunk index without a forwarder agent, reducing pipeline complexity for log-shipping tools.)
Adds AEMBIT_CLIENT_WORKLOAD_PROCESS_IDENTIFICATION_ENABLED environment variable to Agent Proxy to enable Process Name Client Workload identification
New Global Policy Compliance engine, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. ID Token Credential Provider, and Splunk HECSplunk HECAn HTTP endpoint built into Splunk that accepts JSON-formatted log and event data pushed directly from applications or agents over HTTPS, letting cyber tools ship telemetry to Splunk without requiring a forwarder agent on the sending host. log integration.
Adds Lambda Layer support for zip-based AWS Lambda Functions
Introduces Global Policy Compliance for centralized security enforcement with Required, Recommended, and Optional tiers via color-coded status icons
Adds OIDC ID Token Credential Provider supporting RS256/ES256ES256An ECDSA digital signature algorithm using a P-256 elliptic curve and SHA-256 hash, defined in RFC 7518. Cyber tools use it to sign and verify JWTs with smaller keys than RSA while keeping strong integrity guarantees. signing and integration with AWS STSAWS STSAWS Security Token Service, an Amazon Web service that issues short-lived credentials for IAM roles, letting tools authenticate to AWS APIs without storing long-term secrets., GCP WIFWIFWorkload Identity Federation is a Google Cloud mechanism that lets external workloads authenticate to Google APIs using short-lived tokens from a trusted identity provider, eliminating the need to manage long-lived service account keys., Azure WIF, and HashiCorp Vault
Enables Log Stream for Splunk SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. using HTTP Event Collector (HECHECAn HTTP API endpoint provided by Splunk that lets applications stream JSON-formatted events directly into a Splunk index without a forwarder agent, reducing pipeline complexity for log-shipping tools.) protocol
SPIRE v1.12.1 adds Unix socket support for trust bundle URLs and renames the SQL transaction timeout config key.
└──▷ GET THIS VERSION
$ git clone --branch v1.12.1 https://github.com/spiffe/spire.git
# already have the repo? check out this version:$ git checkout v1.12.1
Supports Unix sockets in trust bundle URLs, enabling local socket-based bundle federation.
Improves events-based cache performance via batch fetching of updated entries (experimental).
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The sql_transaction_timeout config key is replaced by event_timeout and its default value is reduced to 15 minutes — existing configurations using sql_transaction_timeout will break on upgrade.
Netskope Virtual Appliance 124.0.0.125 adds time-based policies, password age query, and Ubuntu 22.04 support
Enables time-based policies for traffic policy enforcement on DPoPDPoPAn IETF standard that binds an OAuth access token to a specific client's cryptographic key pair, so a stolen token cannot be replayed by an attacker who lacks the matching private key. appliances using UTC timezone
Supports Ubuntu 22.04 as the guest operating system for the Virtual Appliance
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Appliance password policy now requires password changes every 90 days from installation or upgrade date
3 more releases in this issue
· 2025-05-12 → 2025-05-27
Netskope 126 adds HTML smuggling detection, API Data Protection REST v2 endpoints, and MacOS Enterprise Browser
Adds AI-based real-time detection and blocking for HTML smuggling malware with alert name Gen.DetectBy.NetskopeAI.HTML_Smuggling.
Adds REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. v2 endpoints for Next Generation API Data Protection domain profiles: GET/POST /api/v2/profiles/domains, GET/PUT/DELETE /api/v2/profiles/domains/{id}, PATCH /api/v2/profiles/domains/{id}/data, and POST /api/v2/profiles/domains/deploy.
Adds MacOS support for the Netskope Enterprise Browser application.
Netskope Adapter 213.252.10.11 adds Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. V2 OU/Group include filters and custom attribute mapping.
groups filter now supports Only Include in Active Directory V2 mode
ou filter now supports Only Include in Active Directory V2 mode
Custom attribute mapping for user enterprise_accounts.upn, _id (E-Mail) and group canonical name _id allows changing default bindings
Automated host OS upgrade to Ubuntu 22 LTS and ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. image fallback for Netskope Private Access Publisher v126
Adds automated host OS upgrade to Ubuntu 22.04 LTS when upgrading from Publisher R125 in version 126.0.0.9487
Enables publishers to download images from ECR as a fallback when Docker Hub rate limiting is encountered
Adds skip.authors and include.labels to .hacktron/config.yaml to control which pull requests get scanned; adds FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. support for teleport-update
└──▷ GET THIS VERSION
$ git clone --branch v15.5.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v15.5.1
Expose the Teleport service cache health via Prometheus metrics.
Added full support for FIPS agent installations to teleport-update.
Teleport v16.5.9 adds binary_path/binary_hash to Unix workload attestor and full FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. agent install support in Teleport-update.
└──▷ GET THIS VERSION
$ git clone --branch v16.5.9 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v16.5.9
Adds binary_path and binary_hash fields to the attributes returned by the Unix workload attestor for Workload ID
Enables Teleport-update to fully support FIPS agent installations
Includes templating and rule evaluation attributes in the audit log event for workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. credential issuance
Secureframe May 2025 adds AI Evidence Validation, FedRAMP 20xFedRAMP 20xA GSA-led overhaul of the FedRAMP cloud-authorization program aimed at cutting compliance burden through continuous, automated evidence collection rather than point-in-time audits, letting vendors reach federal markets faster. support, Vercel/Supabase integrations, and email logs.
AI Evidence Validation analyzes uploaded files in real time to check control correctness and timestamp validity
FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one.20x KSI framework support with pre-built controls and tests for FedRAMP Low KSI requirements
New OneSchema-powered device upload experience with smart template validation for admins
Centralized searchable Email Log for outbound communications sent on or after March 17, 2025
Revamped Access Table in User Access Review (UAR) with new filtering and search capabilities
+2 moreshow less
GCC HighGCC HighA Microsoft 365 cloud environment restricted to US government contractors handling controlled unclassified information, meeting compliance requirements like ITAR and DFARS that standard commercial tenants cannot satisfy. environment support for Intune and Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. integrations
New integrations with Vercel and Supabase for scanning cloud resources and surfacing compliance evidence
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. column has been removed from the Access table
!The Privileged column has been temporarily removed from the Access table
Trust Vault adds Markdown formatting support and increases description field limits to 10,000 characters
Trust Vault now supports Markdown formatting in the About section, Frameworks, FAQs, and Updates fields, with a character limit increased to 10,000 characters
1 detail in Everything
17 more releases in this issue
· 2025-05-01 → 2025-05-08
Adds CSV/XLSX vendor access data import with field mapping to Access Review module (up to 100 MB)
Directly import vendor access data from CSV or Excel files (up to 100 MB) into the Access Review module
Use a field-mapping interface with dropdowns to align key fields like Account Identifier and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. without manual reformatting
Scrut adds four-stage automated reminders for policy reviews and vendor reassessments
When review reminders and multi-level reminders are enabled in Settings > Notifications, sends reminders 30, 15 and 7 days before and on the due date for policy reviews, evidence updates and vendor reassessments.
Enables embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. custom external videos into training campaigns via embed codes
Adds ability to embed custom, externally hosted training videos in Campaigns using Embed Code option
Trust Vault document preview now supports spreadsheets, emails, videos and zoom.
Adds support for viewing .xlsx.xlsxThe file format used by Microsoft Excel for spreadsheets, based on the Open XML standard. Cyber tools use it to ingest or export structured tabular data in a format analysts already work with., .xls, .csv spreadsheets directly in the Trust Vault document preview modal
Adds support for viewing .eml email files directly in the Trust Vault document preview modal
Adds support for viewing .mp4 video files directly in the Trust Vault document preview modal
Adds zoom controls including mouse trackpad gestures to the PDF preview
Enables single-click opening of file attachments within the preview modal
Drata adds Darwinbox and Lattice HRISHRISHuman Resources Information System — software that centralises employee records, payroll, and org data. Cyber tools integrate with it to tie identities and access rights to authoritative HR records. integrations for compliance automation
Adds Darwinbox as a new HRIS connection option within Drata.
Adds Lattice as a new HRIS connection option within Drata.
New comments/tagging on risks/controls, risk filter UI overhaul, personnel task filtering, QAuto verbosity settings, and Vanta AI link evidence for TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data.
Adds the ability to comment on and tag teammates directly in Controls and Risks sections
Updates the Risk Register and Action Tracker with a new filter overflow pattern and default key filters
Adds filtering of the personnel table by individual security tasks and customizable column views for task progress
Enables manual adjustment of QAuto answer verbosity (Concise, Standard, Extensive, or AI-recommended) at the answer level
Allows Vanta AI to auto-populate vendor security questionnaires by accepting a link as evidence input
5 details in Everything
1 more release in this issue
· 2025-05-04 → 2025-05-31
Q1'25 release adds Executive Report Customization with widget mixing/export and a new Criterion Summary Widget for Live Dashboards.
└──▷ HOW TO FIND IT
Monitor unresolved third-party compliance issues directly on a dashboard using the new Criterion Summary widget.
📍In Live Dashboards, click + Add Widget and search for Criterion Summary to display on your main view
Adds customizable executive reports allowing users to mix and match widgets and export them via a newly enhanced interface
Adds the Criterion Summary widget to Live Dashboards, providing consolidated views of unresolved criteria including criticality, sources, and affected third parties
CISO Assistant v2.5.8 introduces Personal Access Tokens, Enterprise audit logs UI, and a Data Wizard.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.8 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.5.8
└──▷ HOW TO FIND IT
Navigate the UI to access the new audit logs page for tracking user activity.
📍In the Enterprise Edition console, go to Administration › Audit Logs.
Personal access tokensPersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. (PATsPATsA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) allow authenticating to the API without a user session.
Audit logs UI in the Enterprise Edition provides visibility into system actions.
Data wizard in Enterprise Edition simplifies initial data population.
NIST SP-800-66 Rev.2 framework structure is updated for compliance mapping.
4 details in Everything
7 more releases in this issue
· 2025-05-03 → 2025-05-23
Adds ETA/due dates to findings, typical evidence in table mode, and external links to incidents
└──▷ GET THIS VERSION
$ git clone --branch v2.5.7 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.5.7
Includes eta and due date fields on findings to track remediation timelines
Displays typical evidence as additional information when viewing controls in table mode
Enables adding an external link to an incident record
Adds reporting timestamp and detection channel fields to incidents; improves BunkerWeb integration.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.6 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.5.6
└──▷ HOW TO FIND IT
Configure BunkerWeb deployment settings via the UI.
📍Navigate to Deployment › BunkerWeb in the settings panel.
Adds reporting_timestamp and detection_channel fields to incident records
CISO Assistant v2.5.5 adds ANSSI framework pack and persistent filter UI state
└──▷ GET THIS VERSION
$ git clone --branch v2.5.5 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.5.5
└──▷ HOW TO FIND IT
Include ANSSI guidelines in your compliance scope for a new assessment
📍In the Frameworks section, select ANSSI from the available packs to add it to your organization's library
Keep complex filter settings (e.g., status or owner) when navigating pagination in audits
📍Apply filters on an audit list view; refresh the page to confirm your selections remain active without re-entering them
packs/annsi: new framework pack for ANSSI standards
UI filters now persist their state across page loads
CISO Assistant v2.5.4 adds incidents table filtering, a 5-level security objective scale, and new Excel export formatting.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.4 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.5.4
Adds filter capabilities to the incidents table for targeted viewing
Introduces a 5-level scale for defining security objectives
Enables a new Excel format for data exports via updated lib tooling
CISO Assistant v2.5.3 adds asset class support and qualification on BIA thresholds
└──▷ GET THIS VERSION
$ git clone --branch v2.5.3 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.5.3
Adds support for asset classes to organize and categorize assets within the platform
Enables qualification (tags/labels) on Business Impact Analysis (BIA) thresholds to better contextualize risk scores
CISO Assistant v2.5.2 adds users list import via the data wizard
└──▷ GET THIS VERSION
$ git clone --branch v2.5.2 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.5.2
└──▷ HOW TO FIND IT
Bulk upload a CSV or Excel file containing user data (username, email, role) to provision accounts in CISO Assistant.
📍In the web UI, go to Data › Data Wizard and select Users as the entity type to import
CISO Assistant v2.4.6 adds pivot capability to risk matrices and syncs requirement assessment status.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.6 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.4.6
Adds pivot functionality to risk matrices for dynamic data analysis
Adds automatic sync between requirement assessment and applied controls status
Portkey Data Service 1.2.2 adds Prometheus counters for batch processing metrics.
Adds Prometheus metric support for batch processing visibility with eight new counters (batch_count, batch_cost, batch_input_tokens, batch_total_tokens, batch_process_time, batch_success_row_count, batch_failure_row_count, batch_row_count) and provider/type labels.
1 detail in Everything
3 more releases in this issue
· 2025-05-08 → 2025-05-31
Adds mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. support for Gateway-to-internal-service communication in Enterprise Gateway 1.11.0.
Adds mTLS support for Gateway to internal services in air-gapped deployments
Portkey Enterprise Gateway 1.10.23 adds dimensions param for Vertex multi-modalmulti-modalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats.embeddingsembeddingsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. and JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. plugin auth
Adds dimensions parameter support in multi-modal embeddings for Vertex provider
Adds JWT authentication capability to the Plugins module for runtime validation
Portkey Enterprise Gateway 1.10.22 adds Anthropic PDF file support, new env vars for OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. config, and three new AI providers.
Adds file_url and mime_type parameters to request payloads for OpenAI-spec-compatible file content parts in Anthropic-based models
Adds OTEL_SERVICE_NAME and OTEL_RESOURCE_ATTRIBUTES environment variables for OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. resource configuration
Adds Ncompass, Lepton, and Snowflake Cortex as supported providers for chat completions and other endpoints
microsandbox v0.2.5 updates Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) to version 2024-11-05
└──▷ GET THIS VERSION
$ git clone --branch microsandbox-v0.2.5 https://github.com/superradcompany/microsandbox.git
# already have the repo? check out this version:$ git checkout microsandbox-v0.2.5
4 more releases in this issue
· 2025-05-20 → 2025-05-27
microsandbox v0.2.4 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. protocol 2025-03-26 support and smart authentication middleware.
└──▷ GET THIS VERSION
$ git clone --branch microsandbox-v0.2.4 https://github.com/superradcompany/microsandbox.git
# already have the repo? check out this version:$ git checkout microsandbox-v0.2.4
Updates MCP protocol version to 2025-03-26
Adds smart authentication middleware for MCP requests that handles protocol vs tool methods differently
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The JSON-RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. request/response ID field is now optional to support notifications, which may affect clients expecting mandatory IDs.
!Error response handling is modified to support optional request IDs.
microsandbox v0.2.3 adds Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) support via /mcp endpoint with built-in sandbox management tools and prompts.
└──▷ GET THIS VERSION
$ git clone --branch microsandbox-v0.2.3 https://github.com/superradcompany/microsandbox.git
# already have the repo? check out this version:$ git checkout microsandbox-v0.2.3
Adds /mcp endpoint to microsandbox-server for handling MCP requests
Supports MCP initialize, tools/list, tools/call, prompts/list, and prompts/get methods
microsandbox v0.2.2 adds a new Rust SDK and renames internal configuration keys for sandbox commands and metrics.
└──▷ GET THIS VERSION
$ git clone --branch microsandbox-v0.2.2 https://github.com/superradcompany/microsandbox.git
# already have the repo? check out this version:$ git checkout microsandbox-v0.2.2
Adds a comprehensive Rust SDK with examples to the microsandbox library
Renames the sandbox.command.execute configuration key to sandbox.command.run
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The sandbox.command.execute configuration key is renamed to sandbox.command.run; existing configs using the old key will fail to load correctly.
!The sandbox.getStatus API/method is renamed to sandbox.metrics.get.
First release of Microsandbox provides VM-level isolated sandboxes for AI agents via CLI and Python SDK.
└──▷ GET THIS VERSION
$ git clone --branch microsandbox-v0.1.0 https://github.com/superradcompany/microsandbox.git
# already have the repo? check out this version:$ git checkout microsandbox-v0.1.0
└──▷ TRY IT
Start the server and generate an API key for immediate use.
$ msb server start
msb server keygen
Install the SDK to begin writing code that interacts with sandboxes.
$ pip install microsandbox
Introduces msb server start command to launch the self-hosted sandbox server
Adds msb server keygen subcommand for generating API keys for controlled access
Provides a Python SDK installable via pip install microsandbox for programmatic interaction
Adds target-port support to the ToolHive Kubernetes Operator for precise port mapping
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.4 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.4
Adds target-port field to the ToolHive Operator CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. spec to specify the container port
1 detail in Everything
14 more releases in this issue
· 2025-05-01 → 2025-05-31
ToolHive Operator 0.0.7 adds registry URL management, Cline auto-discovery, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. inspector, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. validation, and log pruning
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.0.7 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.0.7
└──▷ TRY IT
Inspect the capabilities of a specific MCP server by spawning an isolated inspector container.
$ thv inspector <mcp_server_name>
Manage custom tool registries directly from the CLI.
$ thv registry add https://example.com/registry
Clean up orphaned log files to reclaim disk space.
$ thv logs prune
TOOLHIVE_DEV environment variable can now be set to enable developer mode in the root command.
New registry add, registry get, and registry unset commands manage tool registry URLs.
Cline auto-discovery support allows automatic detection of Cline tools.
New thv inspector subcommand spawns an MCP/inspector container for a specified MCP server.
thv logs prune subcommand cleans up orphaned log files.
+1 moreshow less
OIDC discovery support is added for JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. validation.
ToolHive v0.0.38 adds Terraform MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, CA cert support, and local path handling in go:// protocol
└──▷ GET THIS VERSION
$ git clone --branch v0.0.38 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.0.38
└──▷ USE IT
Reference a tool located on the local filesystem rather than a remote registry using the new go:// URI scheme.
shell
toolhive run go:///home/user/my-tools/custom-tool
Configure ToolHive to trust internal corporate CA certificates when connecting to restricted MCP servers.
Adds CA certificate support and anonymous/local auth middleware to the ToolHive Operator
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.0.6 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.0.6
Adds insecure_allow_all config option to control the Terraform MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server's authentication settings
Adds CA certificate support for corporate environments via new configuration paths
Implements anonymous/local authentication middleware and authorization-based filtering for MCP list operations
ToolHive v0.0.37 adds remote registry loading and operator-spawned proxy pod binding to 0.0.0.0
└──▷ GET THIS VERSION
$ git clone --branch v0.0.37 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.0.37
Adds --remote-registry-url flag to load tool definitions from a remote registry.
Makes operator-spawned proxy pods bind to 0.0.0.0 instead of localhost.
Removes the target_port field from k8s, osv, and oci MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server entries in the registry.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The target_port field is no longer supported in registry entries for k8s, osv, and oci MCP servers.
ToolHive Operator v0.0.5 adds Helm chart for deployment, remote registry loading, and host binding for proxy pods
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.0.5 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.0.5
Adds logic and configuration keys for loading tools from a remote registry via pull request #423
Makes operator-spawned proxy pods bind to host 0.0.0.0 for external access
ToolHive v0.0.35 adds UNIX socket binding, Sigstore provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. verification, and the ocireg-mcp registry.
└──▷ GET THIS VERSION
$ git clone --branch v0.0.35 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.0.35
└──▷ USE IT
Run the ToolHive server so that it listens on a local Unix socket instead of TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it., bypassing port conflicts.
shell
thv serve --socket-path /tmp/toolhive.sock
Adds support for binding the thv server to a UNIX socket via the --socket-path flag, enabling Unix-domain communication without TCP ports
Introduces provenance verification using Sigstore and Attestations, with visual indicators in security logs during installation or update operations
Adds the ocireg-mcp tool to the registry, allowing cyber tooling to interface with OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. container registries
ToolHive v0.0.34 adds an API server with endpoints to start, restart, list, get, and delete MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers.
└──▷ GET THIS VERSION
$ git clone --branch v0.0.34 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.0.34
└──▷ TRY IT
Bind the ToolHive API server to a public interface (e.g., for remote access or tunneling)
$ toolhive run --host 0.0.0.0
Manage an MCP server via the new API endpoints
$ # Start a new server
curl -X POST http://localhost:8080/api/v1/mcp/servers
# List running servers
curl http://localhost:8080/api/v1/mcp/servers
# Stop a specific server
curl -X DELETE http://localhost:8080/api/v1/mcp/servers/<server-id>
Install the ToolHive Operator in a Kubernetes cluster using the new Helm charts
$ # Add the Helm repository
helm repo add toolhive https://stacklok.github.io/toolhive/
# Install the operator
curl -L-o toolhive-operator.tar.gz https://github.com/stacklok/toolhive/releases/download/v0.0.34/toolhive-operator-v0.0.34.tgz
tar -xzf toolhive-operator.tar.gz
cd toolhive-operator
helm install toolhive .
# Note: The release notes mention the chart exists; verify specific repo URL/chart name in docs
--host flag for the CLI and API server to bind to a specific network interface
Initial API server implementation exposing lifecycle endpoints for MCP servers
Support for custom container socket paths via the Docker client
Operator Helm chart (toolhive-operator) and CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. chart added to the distribution
Adds ToolHive Operator CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. Helm chart and initial API server endpoints for managing MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.3 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.3
Add Helm chart for installing the ToolHive Operator CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. into Kubernetes (toolhive-operator-crds)
Add support for --host flag to bind the CLI/API to a specific interface
Implement REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints for starting MCP servers, listing, getting, deleting, and stopping them
ToolHive Operator adds Helm chart deployment and API endpoints for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server lifecycle management
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.0.3 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.0.3
Adds the toolhive-operator Helm chart for deploying the operator into Kubernetes
Introduces a new API server with endpoints for listing, getting, stopping, deleting, and restarting tools
Supports specifying custom container socket paths via the Docker client
ToolHive v0.0.31 adds custom CA cert support for container builds and 1Password secret integration
└──▷ GET THIS VERSION
$ git clone --branch v0.0.31 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.0.31
feat adds --ca-cert flag (and associated environment variable) to allow passing custom CA certificates for container image builds, enabling use behind air-gapped or corporate proxy environments.
feat adds 1Password (op) secret integration, allowing ToolHive to fetch secrets directly from a 1Password vault during container build workflows without writing them to local files.
ToolHive v0.0.28 introduces JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. middleware for token validation to secure tool endpoints
└──▷ GET THIS VERSION
$ git clone --branch v0.0.28 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.0.28
ToolHive v0.0.26 adds pod template spec to MCPServer CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. for Kubernetes customization
└──▷ GET THIS VERSION
$ git clone --branch v0.0.26 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.0.26
Adds podTemplateSpec field to the MCPServerCustom Resource DefinitionCustom Resource DefinitionA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. (CRD) to allow configuring the underlying Kubernetes Pod.
Adds documentation for setting up ToolHive with Kind.
Pangea GA releases AI Guard/Prompt Guard, new Multipass integrations, ABACABACAttribute-based access control, where rules evaluate facts about the user, resource and request. Access can depend on conditions such as department, data sensitivity or device status./Expiring Tuples in AuthZ, and Groups/OAuth scopes in AuthN.
Open-sources a test harness for Prompt Guard supporting JSON, CSV, and text inputs to evaluate detection accuracy metrics.
Releases AI Guard and Prompt Guard as Generally Available (GA) services for securing AI applications against malicious content and injection attacks.
Adds Pangea Multipass support for Google Drive, Confluence, Slack, and Github to normalize authorization interfaces across systems.
Introduces ABAC capabilities in AuthZ, enabling fine-grained access policies based on user, resource, and environment attributes evaluated at runtime.
Enables inheritance of parent resource permissions to child resources in AuthZ to reduce permission management overhead.
+5 moreshow less
Adds expires_at property support in AuthZ for expiring tuples, allowing time-limited actor access to resources.
Integrates Groups into AuthN to allow managing user permissions collectively at the authentication layer.
Allows creation of custom OAuth scopes and claims in AuthN clients for specific permission grants.
Adds impossible travel settings in AuthN to block logins from physically distant locations within short timeframes.
Releases an early-access alpha of Pangea Private Cloud for hosting control and data planes within customer environments.
Zenity discovers, secures and governs enterprise AI agents from buildtime to runtime across SaaS, endpoint and cloud.
Zenity extends Microsoft Copilot Studio integration to provide runtime AISPM and AIDR for AI Agents
Adds AISPM (AI Security Posture Management) capabilities for agents built in Microsoft Copilot Studio
Adds AIDR (AI Detection & Response) for real-time threat detection including prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. and data leakage during agent runtime
Extends Zenity integration with Microsoft Copilot Studio to provide continuous visibility into agent activity, usage, and access
DeepTeam tests and red-teams LLM applications by simulating attacks and evaluating security vulnerabilities.
First release of DeepTeam for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. red teaming with adversarial attack strategies and automated test case generation.
└──▷ GET THIS VERSION
$ git clone --branch v0.1.4 https://github.com/confident-ai/deepteam.git
# already have the repo? check out this version:$ git checkout v0.1.4
Adds built-in adversarial attack strategies including jailbreaks, refusal bypasses, and prompt injections
Adds automatic generation of adversarial test cases
Adds multi-metric evaluation capability for pass/fail, toxicity, relevance, etc.
Adds seamless integration hooks for LLM apps and testing pipelines
Garak scans language models and applications for vulnerabilities including prompt injection and data leakage.
garak v0.11.0 adds SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. and Mistral probes, -no-cnv flag for GGML generators, and new reporting options including --report-aggregation=min.
└──▷ GET THIS VERSION
$ git clone --branch v0.11.0 https://github.com/NVIDIA/garak.git
# already have the repo? check out this version:$ git checkout v0.11.0
Adds mistral generator support to integrate with Mistral AI models in garak scans
Adds -no-cnv CLI flag to disable CUDACUDANVIDIA's platform and programming interface for running general computation on its GPUs. Nearly every AI training and inference stack is built on it first. neural network optimization in GGML-based generators
Adds --report-aggregation=min reporting option to aggregate probe scores using the minimum value instead of the previous default
Adds --no-group-score reporting flag to suppress group-level score aggregation in output reports
Updates promptinject detector to accept multiple triggers for broader injection pattern coverage
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The --report-aggregation default behavior changed from the previous logic (likely max/mean) to a new aggregation method, potentially altering reported scores in scripts relying on the old default.
goshs v1.0.7 adds SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. protocol support and zeroconf mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing. broadcasting for HTTP, WebDAV, and SFTP.
└──▷ GET THIS VERSION
$ git clone --branch v1.0.7 https://github.com/patrickhener/goshs.git
# already have the repo? check out this version:$ git checkout v1.0.7
Adds SFTP as a supported transfer protocol alongside HTTP and WebDAV.
Broadcasts HTTP, WebDAV, and SFTP services via zeroconf mDNS, making instances discoverable on the local network (e.g., http://<hostname>.local:8000).
2 details in Everything
1 more release in this issue
· 2025-05-02 → 2025-05-19
The code-oss project is an open-source code editor combining editing, debugging, and extensibility for developers across Windows, macOS, and Linux.
VS Code 1.100 adds custom chat instructions, GitHub/extension/notebook tools, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication., and staged-change diff decorations.
└──▷ GET THIS VERSION
$ git clone --branch 1.100.0 https://github.com/microsoft/vscode.git
# already have the repo? check out this version:$ git checkout 1.100.0
Adds custom instructions and reusable prompt files for Chat, enabling repeatable, shareable AI workflows.
Adds built-in Chat tools for searching GitHub repository code, querying extensions, and working with notebooks.
Adds MCP support for Streamable HTTP transport and image content in Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. sessions.
Introduces conversation summary and prompt caching to deliver faster responses on repeat Chat requests.
Speeds up agent mode edits for quicker AI-driven code changes.
+2 moreshow less
Improves multi-window support with floating window modes for Chat and editors.
Adds Quick Diff decorations for staged changes, making staged hunks visually distinct in the editor gutter.
Helm v3.18.0 adds JSON Schema 2020 support, CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./memory profiling, hook log streaming, HTTP fallback for OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant., and multi-platform plugin hooks.
└──▷ GET THIS VERSION
$ git clone --branch v3.18.0 https://github.com/helm/helm.git
# already have the repo? check out this version:$ git checkout v3.18.0
└──▷ TRY IT
Capture a CPU profile while running a heavyweight install to diagnose slow deployments.
$ HELM_PPROF=cpu helm install myrelease ./mychart
Surface hook pod logs directly in the terminal when a hook fails, without having to kubectl logs separately.
$ # In your hook manifest, add the annotation:
# helm.sh/hook-output-log-policy: hook-failed
helm upgrade myrelease ./mychart
Supports JSON Schema 2020 for chart value validation.
Enables CPU and memory profiling via HELM_PPROF environment variable and new profiling flags.
Adds hook annotations to stream pod logs to the client on hook error (and success).
Automatic HTTP fallback for OCI registries when HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. is unavailable.
Adds multi-platform plugin hook support.
+1 moreshow less
Reports time spent waiting for resources as a debug log.
GitHub CLI v2.74.0 introduces gh preview prompter, adds --compact flag to gh run watch, and updates attestation retry logic.
└──▷ GET THIS VERSION
$ git clone --branch v2.74.0 https://github.com/cli/cli.git
# already have the repo? check out this version:$ git checkout v2.74.0
└──▷ TRY IT
Initialize a new workflow setup via an interactive TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. wizard instead of manually editing YAML.
$ gh preview prompter
Stream GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. runs in a compact terminal window or SSH session without verbose JSON/detailed logs.
$ gh run watch --compact
Introduces the preview prompter subcommand for interactive workflow configuration
Adds --compact flag to gh run watch to produce terse, line-drawing output suitable for constrained terminals
Enhances gh attestation commands with retry logic when fetching Trusted Uniform Format (TUF) content to improve reliability
3 details in Everything
1 more release in this issue
· 2025-05-19 → 2025-05-29
GitHub CLI v2.73.0 adds @copilot assignee support and last comment deletion for issues/PRs
└──▷ GET THIS VERSION
$ git clone --branch v2.73.0 https://github.com/cli/cli.git
# already have the repo? check out this version:$ git checkout v2.73.0
└──▷ TRY IT
Assign the Copilot coding agent to issue #42 using gh issue edit.
$ gh issue edit 42 --add-assignee @copilot
Assign the Copilot coding agent to pull request #10 using gh pr edit.
$ gh pr edit 10 --add-assignee @copilot
gh issue edit supports --add-assignee @copilot to assign the GitHub Copilot coding agent to an issue.
gh pr edit supports --add-assignee @copilot to assign the GitHub Copilot coding agent to a pull request.
gh issue comment delete and gh pr comment delete support deleting the last comment (identified via a special flag or default behavior implied by last comment delete).
JSON output from gh issue view now includes the closedByPullRequestsReferences field.
curl 8.14.0 adds QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking./HTTP3 improvements, new --ip-tos flag, and expands ECH support.
└──▷ GET THIS VERSION
$ git clone --branch curl-8_14_0 https://github.com/curl/curl.git
# already have the repo? check out this version:$ git checkout curl-8_14_0
└──▷ TRY IT
Set QoS/traffic class on outgoing packets — useful when testing priority-sensitive network paths.
$ curl --ip-tos lowdelay https://example.com
Capture QUIC qlog traces for HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer. connection debugging.
Tune TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. keepalive probe count to detect dead connections faster without changing the interval.
New Gateway Analytics dashboards in the Cloudflare One Dashboard provide visibility into DNS, HTTP, and Network sessions.
Adds a new Analytics section to the Cloudflare Zero Trust dashboard side navigation for visualizing Gateway traffic patterns, top users, security actions, and geographic regions.
Playwright MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server gains compatibility with Browser Rendering for automated browser tasks
Adds createMcpAgent function to @cloudflare/playwright-mcp that accepts env.BROWSER to enable Browser Rendering integration
Enables AI-driven browser automation (screenshots, form filling, scraping) via the Playwright MCP server on Cloudflare Workers
Cloudflare raises custom hostname and Secrets Store limits for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. and Pay-as-you-go plans
Cloudflare adds in-browser GraphQL Analytics API Explorer and MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. for natural language query generation
Adds the GraphQL API Explorer, a browser-based interface for building and running GraphQL Analytics queries with OAuth authentication
Adds the GraphQL MCP Server to enable natural language interaction with the GraphQL Analytics API
Email attachments can now be viewed safely in a remote browser via the new Attachments section in Zero Trust
Adds an Attachments section to email messages displaying classifications like Malicious, Suspicious, Encrypted and a Browser Isolation icon for clientless viewing
Requires enabling 'Allow users to open a remote browser without the device client' in Zero Trust settings and assigning Browser Isolation (BISO) seats
Remote Browser Isolation adds SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. HTTP-POST binding support for improved IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. compatibility
Adds SAML HTTP-POST bindings support for Remote Browser Isolation to enable seamless authentication for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.-enabled applications.
Improves compatibility with multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. (MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.) flows and major Identity Providers like Okta and Azure AD within RBI sessions.
Cloudflare DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. custom word lists gain case sensitivity support.
Snippets and Cloud Connector now match on Custom Lists (IP/AS/Hostname), Bot Score, and WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. Attack Score.
Custom lists matching – Snippets and Cloud Connector now support user-created IP, AS, and Hostname lists via dashboard or Lists API. Great for shared logic across zones.
Bot Score and WAF Attack Score – Use Cloudflare’s intelligent traffic signals to detect bots or attacks and take advanced, tailored actions with just a few lines of code.
Cloudflare Workers adds FinalizationRegistry via enable_weak_ref compat flag to reduce WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. memory leaks.
Adds enable_weak_ref compatibility flag to opt-in to the new FinalizationRegistry API for WebAssemblyWebAssemblyA binary instruction format that runs in browsers and server runtimes at near-native speed, letting developers compile C, Rust, or other languages into a portable, sandboxed module any compliant host can execute.-based Workers (including Python and Rust).
Enables automatic freeing of WebAssembly heap allocations via toolchains such as Emscripten and wasm-bindgen, helping resolve Exceeded Memory errors.
WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. Payload Logging adds targeted request portions, UI highlighting, and enhanced context for Enterprise customers.
Payload logs now capture only specific portions of requests that triggered WAF rules instead of entire request segments
Matched content is visually highlighted in the WAF UI for faster identification
Logs include surrounding context to make diagnostics more effective
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The structure of the encrypted_matched_data field in Logpush has changed from Map<Field, Value> to Map<Field, {Before: bytes, Content: Value, After: bytes}>; existing Logpush processing logic will break unless updated.
Allow sending DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. forensic copies to storage for any HTTP policy without requiring a DLP profile.
Enables DLP Forensic Copy jobs to trigger on Allow or Block HTTP policies without a DLP profile attached, increasing flexibility for data handling and forensic investigation.
Cloudflare Load Balancing adds UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. and ICMP health monitors for private endpoints
Adds support for ICMP (Layer 3) health monitors to check reachability of private endpoints
Adds support for UDP (Layer 4) health monitors for lightweight checks on non-TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. workloads like DNS or VoIP
THE CYBER TOOLCHAIN