The Cyber Toolchain — issue -015, April 30, 2025

cariddi v1.4.1 adds OpenAI API key detection to its secret-scanning engine.

$ git clone --branch v1.4.1 https://github.com/edoardottt/cariddi.git
# already have the repo? check out this version:
$ git checkout v1.4.1

1 detail in Everything

$ git clone --branch v1.4.0 https://github.com/edoardottt/cariddi.git
# already have the repo? check out this version:
$ git checkout v1.4.0

$ echo 'https://example.com' | cariddi -md 3 -s

$ echo 'https://example.com' | cariddi -ie 'png,jpg,gif,svg,bmp,ttf,woff' -s

$ git clone --branch v1.3.6 https://github.com/edoardottt/cariddi.git
# already have the repo? check out this version:
$ git checkout v1.3.6

cloudlist v1.2.2 adds DNSSimple provider and optional Azure subscription auto-discovery

$ git clone --branch v1.2.2 https://github.com/projectdiscovery/cloudlist.git
# already have the repo? check out this version:
$ git checkout v1.2.2

2 details in Everything

theHarvester 4.7.1 adds WhoisXML subdomain discovery, Venacus data-leak search, and Python 3.10+ support.

$ git clone --branch 4.7.1 https://github.com/laramies/theHarvester.git
# already have the repo? check out this version:
$ git checkout 4.7.1

4 details in Everything

xnLinkFinder v6.15 extracts potential links from S3 bucket file listings via <Key> XML tags.

$ git clone --branch v6.15 https://github.com/xnl-h4ck3r/xnLinkFinder.git
# already have the repo? check out this version:
$ git checkout v6.15

$ git clone --branch v6.14 https://github.com/xnl-h4ck3r/xnLinkFinder.git
# already have the repo? check out this version:
$ git checkout v6.14

The httpx-toolkit probes HTTP services in parallel to identify live hosts, technologies, status codes, titles, and other web metadata.

httpx v1.7.0 adds -no-screenshot-full-page flag to disable full-page screenshot capture.

$ git clone --branch v1.7.0 https://github.com/projectdiscovery/httpx.git
# already have the repo? check out this version:
$ git checkout v1.7.0

$ httpx -l targets.txt -screenshot -no-screenshot-full-page -o results.json

ldeep 1.0.85 adds LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet. readers enumeration to its Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. reconnaissance toolkit.

$ git clone --branch 1.0.85 https://github.com/franc-pentest/ldeep.git
# already have the repo? check out this version:
$ git checkout 1.0.85

1 detail in Everything

BloodHound v7.3.0 adds NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. relay attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., GPOLocalGroup ingestion, new tiering selectors, and a list-kinds API endpoint.

$ git clone --branch v7.3.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:
$ git checkout v7.3.0

12 details in Everything

$ git clone --branch v7.2.1 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:
$ git checkout v7.2.1

dploot 3.1.2 adds bypass for STATUS_SHARING_VIOLATION errors during DPAPIDPAPIA Windows OS cryptographic API that encrypts and decrypts secrets tied to a user or machine identity, so applications can store credentials without managing raw keys themselves. looting.

$ git clone --branch 3.1.2 https://github.com/zblurx/dploot.git
# already have the repo? check out this version:
$ git checkout 3.1.2

1 detail in Everything

Peirates v1.1.26 adds detection of microk8s kubelet kubeconfig location.

$ git clone --branch v1.1.26 https://github.com/inguardians/peirates.git
# already have the repo? check out this version:
$ git checkout v1.1.26

1 detail in Everything

Ligolo-ng v0.8 adds a multiplayer web UI, REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., daemon mode, auto-bind, autoroute, and remote agent kill across all platforms.

$ git clone --branch v0.8 https://github.com/nicocha30/ligolo-ng.git
# already have the repo? check out this version:
$ git checkout v0.8

6 details in Everything

A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32.

ESP32 Marauder v1.4.6 adds CYD 2432S024 support and evil portal AP name exposure

$ git clone --branch v1.4.6 https://github.com/justcallmekoko/ESP32Marauder.git
# already have the repo? check out this version:
$ git checkout v1.4.6

1 detail in Everything

$ git clone --branch v1.4.5 https://github.com/justcallmekoko/ESP32Marauder.git
# already have the repo? check out this version:
$ git checkout v1.4.5

$ git clone --branch v1.4.3 https://github.com/justcallmekoko/ESP32Marauder.git
# already have the repo? check out this version:
$ git checkout v1.4.3

A portable multi-tool for pentesters and geeks; this is its official firmware.

Flipper Zero 1.3.4 adds application chaining, new JS destructuring, and BadUSB arbitrary key combinations

$ git clone --branch 1.3.4 https://github.com/flipperdevices/flipperzero-firmware.git
# already have the repo? check out this version:
$ git checkout 1.3.4

5 details in Everything

A tool that detects cell site simulators (IMSI catchers) on a cheap mobile hotspot.

Rayhunter v0.2.8 adds TP-Link device support and web UI recording deletion

$ git clone --branch v0.2.8 https://github.com/EFForg/rayhunter.git
# already have the repo? check out this version:
$ git checkout v0.2.8

3 details in Everything

Flipper Zero Unleashed Firmware, an unlocked alternative firmware.

Unleashed Firmware unlshd-081 adds Feron/Prastel protocols, CLI autocomplete, BadUSB mouse/key combos, and new settings

$ git clone --branch unlshd-081 https://github.com/DarkFlippers/unleashed-firmware.git
# already have the repo? check out this version:
$ git checkout unlshd-081

18 details in Everything

The open-source wireless research platform for ESP32.

GhostESP v1.4.9 adds scanall, congestion command, built-in HTML, and SD card pin configuration

$ git clone --branch v1.4.9 https://github.com/GhostESP-Revival/GhostESP.git
# already have the repo? check out this version:
$ git checkout v1.4.9

$ scanall

$ congestion

$ scanap 10

7 details in Everything

Feature-rich, stable and customizable Flipper Zero firmware.

Momentum Firmware mntm-010 adds multiple new RF protocols (ReversRB2/RB2M, Feron), NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. plugins (Passport, APDU Runner), and JS API updates.

$ git clone --branch mntm-010 https://github.com/Next-Flip/Momentum-Firmware.git
# already have the repo? check out this version:
$ git checkout mntm-010

19 details in Everything

PowerShell Empire 6.0.3 adds literal interpretation for shell commands in the IronPython agent.

$ git clone --branch v6.0.3 https://github.com/BC-SECURITY/Empire.git
# already have the repo? check out this version:
$ git checkout v6.0.3

SecLists 2025.2 adds two 10M+ subdomain fuzzing wordlists and expands credential, DNS, and content-type lists.

$ git clone --branch 2025.2 https://github.com/danielmiessler/SecLists.git
# already have the repo? check out this version:
$ git checkout 2025.2

7 details in Everything

Codacy Self-hosted v15.0.0 adds Kubernetes 1.30 support

1 detail in Everything

REST Issues API adds File Path, Code Region, Commit ID, Key Asset and Description information for issue triage

5 details in Everything

$ snyk mcp --experimental

Veracode DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. adds AI-assisted login to replace recorded scripts for complex authentication.

1 detail in Everything

Mend SAST is a static application security testing service that scans source code for vulnerabilities and helps teams prioritize remediation.

Mend SAST 25.4.1 adds support for scanning Python files with BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. encoding and optimizes incremental dump storage.

1 detail in Everything

Adds Fastify detector and router-based route handling for Express and Restify in noir v0.21.0

$ git clone --branch v0.21.0 https://github.com/owasp-noir/noir.git
# already have the repo? check out this version:
$ git checkout v0.21.0

1 detail in Everything

pip-audit v2.9.0 adds PEP 751PEP 751A draft Python packaging standard that defines a lock file format for recording exact dependency versions, giving cyber tools a reproducible, machine-readable way to pin their dependency trees. lockfile support via --locked in project mode.

$ git clone --branch v2.9.0 https://github.com/pypa/pip-audit.git
# already have the repo? check out this version:
$ git checkout v2.9.0

$ pip-audit --locked

DeepSource announces general availability of its Software Composition Analysis feature for Cloud workspaces and introduces a paid subscription tier.

GitLab 17.11 adds protected container/Maven tags, static reachability for Python, CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. exports, and new Duo AI models/features.

DAST_FF_XSS_ATTACK: false

29 details in Everything

Mend SCA v25.4.1 adds HeroDevs commercial mitigation paths, C# transitive fix recommendations, and a Top 10 libraries widget.

4 details in Everything

KICS v2.1.7 adds support for nested HCL identifier parsing in Terraform queries.

$ git clone --branch v2.1.7 https://github.com/Checkmarx/kics.git
# already have the repo? check out this version:
$ git checkout v2.1.7

Checkov 3.2.411 adds Git history secrets scanning and expands CKV2_AWS_5 coverage

$ git clone --branch 3.2.411 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:
$ git checkout 3.2.411

2 details in Everything

$ git clone --branch 3.2.408 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:
$ git checkout 3.2.408

checkov -d ./terraform --check CKV_AWS_123

Nexus 3.79.0 adds Malware Defense Evaluation and Firewall REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services., plus AWS S3 pre-signed URL support for Pro users.

3 details in Everything

syft v1.23.0 adds Chrome binary detection, libman JS assets, R cataloger in dir scans, and undeclared Python license file detection.

$ git clone --branch v1.23.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:
$ git checkout v1.23.0

6 details in Everything

$ git clone --branch v1.22.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:
$ git checkout v1.22.0

Socket introduces socket fix CLI for automated, safe dependency upgrades with --test and --autopilot modes

$ socket fix --test

3 details in Everything

Apiiro maps an application's architecture and risk graph and runs AI-SAST, SCA, secrets, API and threat-modeling checks on AI- and human-written code.

Apiiro vIntroducing adds the Custom Reports workspace with query builder, multi-filter selection, and saved personal collections

3 details in Everything

Dependency Track 4.13 introduces collection projects, batchDelete API, scheduled notifications, and Snyk v2024-10-15 support

$ git clone --branch 4.13.0 https://github.com/DependencyTrack/dependency-track.git
# already have the repo? check out this version:
$ git checkout 4.13.0

9 details in Everything

cosign v2.5.0 adds new bundle format for OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. attestations and TSA certificate flags for cosign attest.

$ git clone --branch v2.5.0 https://github.com/sigstore/cosign.git
# already have the repo? check out this version:
$ git checkout v2.5.0

$ cosign attest --new-bundle-format --predicate predicate.json --type slsaprovenance <image>

3 details in Everything

Xygeni v5.11 adds new static analysis capabilities, improved security controls enforcement, and expanded language support.

2 details in Everything

Chalk v0.5.6 adds VCS_MISSING_FILES env var to detect uncommitted artifacts

$ git clone --branch v0.5.6 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.5.6

1 detail in Everything

$ git clone --branch v0.5.5 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:
$ git checkout v0.5.5

TruffleHog finds, verifies, and analyzes leaked credentials across Git, chat, wikis, cloud storage, and more

TruffleHog v3.88.26 adds five new secret detectors (DockerHub OATs, Azure CosmosDB, Netlify v2, Harness, Langfuse) and a --no-color flag.

$ git clone --branch v3.88.26 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:
$ git checkout v3.88.26

$ trufflehog git https://github.com/org/repo --no-color 2>&1 | tee scan.log

6 details in Everything

$ git clone --branch v3.88.25 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:
$ git checkout v3.88.25

$ git clone --branch v3.88.24 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:
$ git checkout v3.88.24

$ git clone --branch v3.88.21 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:
$ git checkout v3.88.21

Infisical adds strict find filter and TeamCity sync improvements in v0.125.2

$ git clone --branch infisical/v0.125.2-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:
$ git checkout infisical/v0.125.2-postgres

infisical find --strict

2 details in Everything

$ git clone --branch infisical/v0.125.1-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:
$ git checkout infisical/v0.125.1-postgres

$ git clone --branch infisical/v0.125.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:
$ git checkout infisical/v0.125.0-postgres

infisical auth get-token

$ git clone --branch infisical-cli/v0.40.1 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:
$ git checkout infisical-cli/v0.40.1

$ infisical user get-token --user-id <USER_ID>

$ infisical ssh connect --non-interactive

$ git clone --branch infisical/v0.124.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:
$ git checkout infisical/v0.124.0-postgres

$ git clone --branch infisical/v0.123.2-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:
$ git checkout infisical/v0.123.2-postgres

$ git clone --branch infisical/v0.123.1-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:
$ git checkout infisical/v0.123.1-postgres

$ git clone --branch infisical/v0.123.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:
$ git checkout infisical/v0.123.0-postgres

$ git clone --branch infisical-cli/v0.40.0 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:
$ git checkout infisical-cli/v0.40.0

$ git clone --branch infisical/v0.122.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:
$ git checkout infisical/v0.122.0-postgres

curl https://app.infisical.com/api/projects/<project_id>/identities/membershipId/<membership_id> -H 'Authorization: Bearer $INFISICAL_TOKEN'

$ git clone --branch infisical/v0.121.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:
$ git checkout infisical/v0.121.0-postgres

curl -H "Authorization: Bearer $TOKEN" "https://infisical.example.com/api/orgs/$ORG_ID/identities?role=admin"

$ git clone --branch infisical/v0.120.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:
$ git checkout infisical/v0.120.0-postgres

curl https://<infisical-host>/api/audit-logs?secretKey=my-secret-key

Gitleaks v8.25.0 adds multi-global-allowlist support, Perplexity AI and ClickHouse secret detection, and higher GCP entropy rules.

$ git clone --branch v8.25.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.25.0

# .gitleaks.toml
[[allowlists]]
description = "team-a allowlist"
regexes = ["SAFE_TOKEN_A"]

[[allowlists]]
description = "team-b allowlist"
paths = ["tests/fixtures/.*"]

5 details in Everything

$ git clone --branch v8.24.3 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:
$ git checkout v8.24.3

$ export GITLEAKS_CONFIG_TOML="$(cat .gitleaks.toml)"
gitleaks detect --source .

Detection Engine v2.136+2.137 adds detectors for Perplexity AI, Anthropic, and Azure services.

5 details in Everything

GitGuardian adds a Public API GET endpoint for retrieving invitation details.

SPIKE v0.4.0 adds cache invalidation headers to all API responses, symbol stripping at build, and mlock memory protection for Nexus and Keepers.

$ git clone --branch v0.4.0 https://github.com/spiffe/spike.git
# already have the repo? check out this version:
$ git checkout v0.4.0

4 details in Everything

GitGuardian Self-Hosted 2025.4 adds NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems., custom tags, secrets scope enrichment, and log collector integration.

6 details in Everything

Fastly adds four new Bot signals for identifying AI crawlers and fetchers

4 details in Everything

c/side launches Channel Partner Program with multi-tenant dashboard and 3-tier identity model for managing client projects.

3 details in Everything

Nuclei v3.4.2 adds bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. authentication support for Jira reporting in self-hosted environments.

$ git clone --branch v3.4.2 https://github.com/projectdiscovery/nuclei.git
# already have the repo? check out this version:
$ git checkout v3.4.2

humble 1.48 adds 4 new insecure checks, 11 new fingerprint headers, and significantly improved CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. nonce and Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. analysis.

$ git clone --branch 1.48 https://github.com/rfc-st/humble.git
# already have the repo? check out this version:
$ git checkout 1.48

4 details in Everything

WCVS 1.4.0 adds parameter pollution detection, hardcoded default wordlists, and new --skipwordlistcachbuster / --nolog flags.

$ git clone --branch 1.4.0 https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner.git
# already have the repo? check out this version:
$ git checkout 1.4.0

$ wcvs -u https://example.com/page --nolog --skipwordlistcachbuster

5 details in Everything

Dalfox is an XSS scanner that automates parameter analysis, reflected/stored/DOM-based XSS detection, and WAF fingerprinting for web apps.

Dalfox v2.11.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server mode, JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output format, and XDG_CONFIG_HOME support.

$ git clone --branch v2.11.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.11.0

$ dalfox url https://example.com/search?q=test --format=jsonl | jq '.type'

$ dalfox server --type=mcp

3 details in Everything

Juice Shop v17.3.0 adds a searchable language selector and upgrades to Angular 19 and Debian 12.

$ git clone --branch v17.3.0 https://github.com/juice-shop/juice-shop.git
# already have the repo? check out this version:
$ git checkout v17.3.0

3 details in Everything

Hayabusa v3.2.0 adds uptime/timezone to computer-metrics and first/last timestamps to default output.

$ git clone --branch v3.2.0 https://github.com/Yamato-Security/hayabusa.git
# already have the repo? check out this version:
$ git checkout v3.2.0

3 details in Everything

osdfir-infrastructure 2.2.7 lets Timesketch and OpenRelik mount pre-existing Kubernetes PVCs.

$ git clone --branch osdfir-infrastructure-2.2.7 https://github.com/google/osdfir-infrastructure.git
# already have the repo? check out this version:
$ git checkout osdfir-infrastructure-2.2.7

1 detail in Everything

$ git clone --branch osdfir-infrastructure-2.2.2 https://github.com/google/osdfir-infrastructure.git
# already have the repo? check out this version:
$ git checkout osdfir-infrastructure-2.2.2

Timesketch 20250408 adds LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-powered NL-to-query and summarization, Ollama support, Celery task management in tsctl, and expanded client API.

$ git clone --branch 20250408 https://github.com/google/timesketch.git
# already have the repo? check out this version:
$ git checkout 20250408

$ tsctl timesketch-status

12 details in Everything

iLEAPP v2.1.3 adds a new storeUser parser and enhances Voicemail, Discord, and WithingsHealthMate modules.

$ git clone --branch v2.1.3 https://github.com/abrignoni/iLEAPP.git
# already have the repo? check out this version:
$ git checkout v2.1.3

3 details in Everything

$ git clone --branch v2.1.2 https://github.com/abrignoni/iLEAPP.git
# already have the repo? check out this version:
$ git checkout v2.1.2

Sleuth Kit 4.14.0 adds Windows BitLockerBitLockerA full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints. support to the CLI

$ git clone --branch sleuthkit-4.14.0 https://github.com/sleuthkit/sleuthkit.git
# already have the repo? check out this version:
$ git checkout sleuthkit-4.14.0

3 details in Everything

Adds a Google Cloud Storage (GCS) output plugin for exporting artifacts from the GRR server.

$ git clone --branch v3.4.9.1-release https://github.com/google/grr.git
# already have the repo? check out this version:
$ git checkout v3.4.9.1-release

Cortex Analyzers 3.5.11 adds the LupovisProwl integration for threat intelligence enrichment.

$ git clone --branch 3.5.11 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:
$ git checkout 3.5.11

IPED 4.2.1 improves MP4, HEIC, and OFX detection and adds Spanish, Italian, German, and French UI translations.

$ git clone --branch 4.2.1 https://github.com/sepinf-inc/IPED.git
# already have the repo? check out this version:
$ git checkout 4.2.1

4 details in Everything

ALEAPP v3.4.0 adds LAVA output format support, OneDrive Metadata parsing, and FairMail App module.

$ git clone --branch v3.4.0 https://github.com/abrignoni/ALEAPP.git
# already have the repo? check out this version:
$ git checkout v3.4.0

3 details in Everything

Elcomsoft System Recovery 8.34 adds BitLockerBitLockerA full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints. AD key extraction, Win11 hidden volume support, and 800+ new artifacts.

5 details in Everything

RT 5.0.8 adds dashboard portlets, shredder plugins, REST2 privilege endpoints, and configurable SMIME ciphers.

6 details in Everything

Corellium 7.3 adds iOS Camera Passthrough, iPadOS 16-18 support, MATRIX compliance mapping, and Split APK scanning.

3 details in Everything

HRTNG v2.5.41 adds recursive decompiling, virtual call auto-scanning, and merged IDB type support.

$ git clone --branch v2.5.41 https://github.com/kasperskylab/hrtng.git
# already have the repo? check out this version:
$ git checkout v2.5.41

4 details in Everything

HyperDbg v0.13.1 adds transparency methods for hiding nested virtualization

$ git clone --branch v0.13.1 https://github.com/HyperDbg/HyperDbg.git
# already have the repo? check out this version:
$ git checkout v0.13.1

Capstone 6.0.0-Alpha4 adds MIPSMIPSA RISC processor architecture originally developed at Stanford and commercialized by MIPS Technologies, widely used in embedded and network devices; cyber tools target it to analyze or exploit routers, cameras, and similar hardware. alias mapping, TMS320C64x little-endian support, PPC BH field decoding, and call-group tagging for AArch64AArch64The 64-bit execution state of the ARM architecture, defined by Arm Ltd., offering a wider register file and cleaner instruction set than 32-bit ARM; cyber tools target it to run natively on ARM-based servers, phones, and embedded devices. system calls.

$ git clone --branch 6.0.0-Alpha4 https://github.com/aquynh/capstone.git
# already have the repo? check out this version:
$ git checkout 6.0.0-Alpha4

6 details in Everything

pwndbg adds libcinfo command, breakpoint markers in disasm, improved tls/attachp commands, and LoongArch64/Apple Silicon portable builds.

$ git clone --branch 2025.04.18 https://github.com/pwndbg/pwndbg.git
# already have the repo? check out this version:
$ git checkout 2025.04.18

$ libcinfo

$ tls -a

$ attachp --exact

9 details in Everything

$ git clone --branch 2025.04.13 https://github.com/pwndbg/pwndbg.git
# already have the repo? check out this version:
$ git checkout 2025.04.13

$ libcinfo

$ tls -a

$ attachp --exact

Bytecode Viewer v2.13.1 adds resource reload confirmation toggle and removes java/javax package filtering

$ git clone --branch v2.13.1 https://github.com/Konloch/bytecode-viewer.git
# already have the repo? check out this version:
$ git checkout v2.13.1

4 details in Everything

Refinery 0.8.15 adds configurable rounds to tea/xtea and input control to couple unit

$ git clone --branch 0.8.15 https://github.com/binref/refinery.git
# already have the repo? check out this version:
$ git checkout 0.8.15

refinery xtea --rounds 10 input.bin

refinery couple --noinput input.bin

3 details in Everything

$ git clone --branch 0.8.14 https://github.com/binref/refinery.git
# already have the repo? check out this version:
$ git checkout 0.8.14

$ refinery csb <input> --stripspace

ILSpy 9.1 adds Roslyn 4.13 pattern detection, custom attribute sorting, variable scope improvements, and smooth-scroll toggle.

$ git clone --branch v9.1 https://github.com/icsharpcode/ILSpy.git
# already have the repo? check out this version:
$ git checkout v9.1

11 details in Everything

Binary Ninja 5.0.7290 adds Kernel Cache and Firmware Ninja support, SVD/IHEX loaders, C-Sky/MIPS3 architectures, array/struct propagation, and render layers.

11 details in Everything

rz-ghidra v0.8.0 adds PIC microcontroller and TriCore architecture support for embedded firmware analysis.

$ git clone --branch v0.8.0 https://github.com/rizinorg/rz-ghidra.git
# already have the repo? check out this version:
$ git checkout v0.8.0

2 details in Everything

Adds initial support for image diffing to malcontent v1.10.0

$ git clone --branch v1.10.0 https://github.com/chainguard-dev/malcontent.git
# already have the repo? check out this version:
$ git checkout v1.10.0

YaraHunter v2.5.7 extends YARA scanning to non-executable files.

$ git clone --branch v2.5.7 https://github.com/deepfence/YaraHunter.git
# already have the repo? check out this version:
$ git checkout v2.5.7

1 detail in Everything

APKiD v3.0.0 adds DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls., Dart, and resource file-type detection plus expanded rules across 37 Android packers and protectors.

$ git clone --branch v3.0.0 https://github.com/rednaga/APKiD.git
# already have the repo? check out this version:
$ git checkout v3.0.0

6 details in Everything

Aviatrix CoPilot 4.19.0 adds Controller IP Access UI, SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. toggle for DCF rules, and Equinix/Megaport gateway updates

6 details in Everything

Cortex Analytics 2025.04.16 adds detections for cloud exfiltration and public exposure.

14 details in Everything

Sophos DNS Protection 2025.14 adds auto-detected public IP suggestions during location setup

1 detail in Everything

Sophos Central Firewall 2025.14 adds MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. monthly license conversion for term-licensed firewalls.

1 detail in Everything

AP6 access points add optional low-RSSI logging and improved captive portal/enterprise roaming logs

4 details in Everything

Abnormal AI launches AI Phishing Coach module, AI Data Analyst agent, and platform upgrades for quarantine viewing, remediation customization, and URL rewriting.

5 details in Everything

Suricata 8.0.0-beta1 adds new protocol parsers (DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring., POP3), Lua sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls., and detection keywords.

$ git clone --branch 8.0.0-beta1 https://github.com/OISF/suricata.git
# already have the repo? check out this version:
$ git checkout 8.0.0-beta1

15 details in Everything

Snort 3.7.3.0 adds TSVTSVA plain-text format storing tabular data with fields separated by tab characters, making it easy for cyber tools to parse and exchange structured records without a CSV parser's quoting complexity. output, configurable CSV delimiters, extended DNS logging, and a new HTTP/2HTTP/2The second major version of the HTTP protocol, standardized by the IETF, adding multiplexed streams, header compression, and binary framing over a single TCP connection to cut latency and reduce overhead. frame-size rule.

$ git clone --branch 3.7.3.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:
$ git checkout 3.7.3.0

{
  extractor =
  {
    format = "tsv"
  }
}

{
  extractor =
  {
    format = "csv",
    delimiter = "|"
  }
}

{
  http2_inspect =
  {
    settings_max_frame_size = 16384
  }
}

7 details in Everything

nfdump 1.7.6 adds TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. filters, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. tunnel support, gzip pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. reading, custom aggregation formats, and %idt token output.

$ git clone --branch v1.7.6 https://github.com/phaag/nfdump.git
# already have the repo? check out this version:
$ git checkout v1.7.6

4 details in Everything

Zeek v7.2.0 adds a new Storage framework (SQLite/Redis), Cluster WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. API, Geneve tunnel extraction, and expanded Broker metrics.

$ git clone --branch v7.2.0 https://github.com/zeek/zeek.git
# already have the repo? check out this version:
$ git checkout v7.2.0

$ zeek -C -r trace.pcap @load protocols/conn/failed-service-logging

20 details in Everything

Malcolm v25.04.0 adds external NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. support, new Kubernetes deployment flags, and expanded OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions./NetBox config keys.

$ git clone --branch v25.04.0 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:
$ git checkout v25.04.0

# in config/netbox-common.env
NETBOX_MODE=external
NETBOX_URL=https://netbox.corp.example.com

# in config/netbox-secret.env
NETBOX_TOKEN=<your-netbox-api-token>

$ python3 control.py start --namespace malcolm --no-capture-pods --inject-resources --image-source ghcr.io/idaholab/malcolm --image-tag 25.04.0

# in config/opensearch.env
MALCOLM_NETWORK_INDEX_DEFAULT_PIPELINE=my-network-pipeline
MALCOLM_NETWORK_INDEX_LIFECYCLE_NAME=my-network-policy
MALCOLM_NETWORK_INDEX_LIFECYCLE_ROLLOVER_ALIAS=malcolm-network
MALCOLM_OTHER_INDEX_DEFAULT_PIPELINE=my-other-pipeline
MALCOLM_OTHER_INDEX_LIFECYCLE_NAME=my-other-policy
MALCOLM_OTHER_INDEX_LIFECYCLE_ROLLOVER_ALIAS=malcolm-other

13 details in Everything

Grype v0.91.1 adds timing info to log output

$ git clone --branch v0.91.1 https://github.com/anchore/grype.git
# already have the repo? check out this version:
$ git checkout v0.91.1

$ grype --log-level info <image> | grep "timing"

$ git clone --branch v0.91.0 https://github.com/anchore/grype.git
# already have the repo? check out this version:
$ git checkout v0.91.0

cilium-cli v0.18.3 adds kernel profiling during perf tests, standalone perf testing, and IPSec key rotation validation.

$ git clone --branch v0.18.3 https://github.com/cilium/cilium-cli.git
# already have the repo? check out this version:
$ git checkout v0.18.3

4 details in Everything

Inspektor Gadget v0.39.0 adds user stacks to audit_seccomp and trace_open, converts traceloop to image-based gadget, and expands inspect capabilities.

$ git clone --branch v0.39.0 https://github.com/inspektor-gadget/inspektor-gadget.git
# already have the repo? check out this version:
$ git checkout v0.39.0

$ ig run audit_seccomp --collect-ustack=true

11 details in Everything

security-profiles-operator v0.9.1 ships spoc CLI and adds ppc64le support with controller disable flags

$ git clone --branch v0.9.1 https://github.com/kubernetes-sigs/security-profiles-operator.git
# already have the repo? check out this version:
$ git checkout v0.9.1

3 details in Everything

Gatekeeper v3.19.0 adds OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic. Rego v1 syntax support, a generalized export mechanism for violations, and a new --deny-only flag for gator test.

$ git clone --branch v3.19.0 https://github.com/open-policy-agent/gatekeeper.git
# already have the repo? check out this version:
$ git checkout v3.19.0

$ gator test --deny-only -f <path-to-suite>

3 details in Everything

Docker Compose v2.35.0 adds external services for Model Runner, build --print bakefile dump, image-type volumes, and new run quiet flags.

$ git clone --branch v2.35.0 https://github.com/docker/compose.git
# already have the repo? check out this version:
$ git checkout v2.35.0

$ docker compose build --print

$ docker compose config --no-env-resolution

$ docker compose run --quiet --quiet-build myservice python manage.py migrate

6 details in Everything

Buildah v1.40.0 adds --parents for COPY, --inherit-labels for build, cache-mount ownership distinctions, and containers.conf hostname support.

$ git clone --branch v1.40.0 https://github.com/containers/buildah.git
# already have the repo? check out this version:
$ git checkout v1.40.0

$ buildah build --inherit-labels -t myimage:latest .

6 details in Everything

The cri-tools project provides command-line and validation tools for the Kubelet Container Runtime Interface (CRI).

crictl v1.33.0 adds metric descriptors, OOMOOMAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process. score tuning, runtime features info, and per-stream log filtering.

$ git clone --branch v1.33.0 https://github.com/kubernetes-sigs/cri-tools.git
# already have the repo? check out this version:
$ git checkout v1.33.0

$ crictl metricdescs

$ crictl update --oom-score-adj 500 <container-id>

$ crictl logs --stream stderr <container-id>

4 details in Everything

Kata Containers 3.16 adds TDXTDXIntel Trust Domain Extensions, a CPU feature that creates hardware-isolated virtual machines whose memory is encrypted and inaccessible even to the hypervisor, letting tools run workloads in a confidential computing environment. QGS via Unix sockets, initdata for bare-metal/QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware., and BUILD_TYPE=debug for genpolicy

$ git clone --branch 3.16.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:
$ git checkout 3.16.0

$ BUILD_TYPE=debug make genpolicy

5 details in Everything

Trivy is a comprehensive security scanner that finds vulnerabilities, misconfigurations, secrets, and SBOM in containers, Kubernetes, code repositories, and clouds

Trivy 0.62 adds layer metadata to image reports, custom Rego for misconfig scanning, and improved yarn/cargo workspace support

$ git clone --branch 0.62.0 https://github.com/aquasecurity/trivy.git
# already have the repo? check out this version:
$ git checkout 0.62.0

6 details in Everything

eksctl v0.207.0 adds a force parameter for cluster version upgrades and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. cluster support with pod identities.

$ git clone --branch v0.207.0 https://github.com/weaveworks/eksctl.git
# already have the repo? check out this version:
$ git checkout v0.207.0

$ eksctl upgrade cluster --name <cluster-name> --version <new-version> --force --approve

3 details in Everything

Prowler 5.5.0 adds Google/GitHub social login, 17 new M365 Entra checks, NHN Cloud support, and 4 new compliance frameworks.

$ git clone --branch 5.5.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.5.0

12 details in Everything

AzureHound v2.4.1 adds new graph kinds for ingesting PIMPIMProtocol Independent Multicast, an IETF routing protocol that distributes IP multicast traffic across networks without depending on a specific unicast routing protocol, letting tools monitor or manipulate multicast group traffic. (Privileged Identity Management) role data.

$ git clone --branch v2.4.1 https://github.com/SpecterOps/AzureHound.git
# already have the repo? check out this version:
$ git checkout v2.4.1

$ git clone --branch v2.4.0 https://github.com/SpecterOps/AzureHound.git
# already have the repo? check out this version:
$ git checkout v2.4.0

Cloud Custodian 0.9.44.0 adds 20+ new AWS/Azure resources, WAFv2 rule inspection, EFS cross-account detection, and Shield Protection tagging.

$ git clone --branch 0.9.44.0 https://github.com/cloud-custodian/cloud-custodian.git
# already have the repo? check out this version:
$ git checkout 0.9.44.0