The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
ldeep 1.0.82 adds Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. schema partition dumping.
└──▷ GET THIS VERSION
$ git clone --branch 1.0.82 https://github.com/franc-pentest/ldeep.git
# already have the repo? check out this version:$ git checkout 1.0.82
Adds schema partition dump capability to enumerate the AD schema partition.
sara v1.1 shifts to live SSH analysis via Netmiko and adds CVE scanning, compromise artifact detection, and scheduler analysis for RouterOS.
└──▷ GET THIS VERSION
$ git clone --branch v1.1 https://github.com/caster0x00/sara.git
# already have the repo? check out this version:$ git checkout v1.1
Migrates analysis engine to live SSH sessions via Netmiko, removing dependency on .rsc configuration file imports.
Adds CVE-based vulnerability scanning that maps findings to known issues by RouterOS version.
Adds compromise artifact detection covering suspicious static DNS records, proxy settings, and exposed services.
Adds scheduler analysis to surface potentially malicious scheduled tasks and hidden configuration overwrites.
Extends RouterOS version support to cover newer releases.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The tool no longer operates on .rsc configuration files; existing workflows that pass .rsc files as input will break — a live SSH-accessible device is now required.
$ git clone --branch v6.1 https://github.com/xnl-h4ck3r/waymore.git
# already have the repo? check out this version:$ git checkout v6.1
Adds retrieval of archived responses from URLScan (via https://urlscan.io/dom/{UUID}) in addition to the Wayback Machine, with the same link-extraction processing applied.
Includes the waymore version in the User-Agent header when making requests to URLScan.
Renames the output index file from index.txt to waymore_index.txt to allow xnLinKFinder to better identify a waymore response directory.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The output index file is renamed from index.txt to waymore_index.txt; any scripts or tools that reference index.txt by name will no longer find it.
1 more release in this issue
· 2025-03-04 → 2025-03-20
SharpHound v2.6.0 adds NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. authentication support, Registry collection, and reworked Owns/Owner relationship enumeration.
└──▷ GET THIS VERSION
$ git clone --branch v2.6.0 https://github.com/SpecterOps/SharpHound.git
# already have the repo? check out this version:$ git checkout v2.6.0
Adds NTLM authentication support for LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. collection, enabling enumeration in environments where KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. is unavailable or restricted.
New Registry collection capability expands the data SharpHound can gather from domain-joined hosts.
Reworked Owns/Owner relationship collection improves accuracy of object ownership edges in BloodHound graphs.
xnLinkFinder v6.9 auto-detects URL lists vs. raw file content when using -i/--input.
└──▷ GET THIS VERSION
$ git clone --branch v6.9 https://github.com/xnl-h4ck3r/xnLinkFinder.git
# already have the repo? check out this version:$ git checkout v6.9
Adds auto-detection for -i/--input files: if the first line starts with // or http, the file is processed as a URL list; otherwise its content is searched for links (Burp/Zap/Caido files remain handled as before).
Crawl a target but exclude known third-party or CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. URLs so results stay focused on first-party endpoints.
Stop a running queue mid-crawl, e.g. after a match condition is met during OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. collection.
go
q, _ := queue.New(4, &queue.InMemoryQueueStorage{MaxSize: 10000})
// ... add URLs ...
go func() {
time.Sleep(5 * time.Second)
q.Stop()
}()
q.Run(c)
Adds context.Context support to collectors, enabling cancellation and deadline propagation across scraping requests.
Supports Stop() in the queue, allowing graceful halt of queued crawl jobs.
Adds MaxRequests parameter to cap the total number of requests a collector will make.
Adds Host and custom header support, giving finer control over outbound request headers.
Implements content sniffing for HTML parsing, improving handling of responses with missing or incorrect Content-Type headers.
+1 moreshow less
Applies URL filters (checkFilters) consistently on redirects, not just initial requests.
netdiscover 0.11 adds -R flag to skip root/capability checks and refreshes the OUI vendor table.
└──▷ GET THIS VERSION
$ git clone --branch 0.11 https://github.com/netdiscover-scanner/netdiscover.git
# already have the repo? check out this version:$ git checkout 0.11
└──▷ TRY IT
Run a passive ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. scan inside a Docker container where CAP_NET_RAW is granted but root checks would otherwise fail.
$ netdiscover -R-p-r 192.168.1.0/24
New -R flag skips root/capability checks, letting privileged containers or capability-granted users run netdiscover without the pre-flight verification overhead.
Updated OUI table for more accurate vendor identification of discovered hosts.
Bruce 1.9 adds Kaseikyo IR support, BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems./WiFi settings, NRF24 and CC1101 SPISPISerial Peripheral Interface, a synchronous communication bus standard used to connect microcontrollers to sensors, flash memory, and other peripherals at short range; cyber tools use it to read or write firmware on embedded devices. config, and WebUI startup option
└──▷ GET THIS VERSION
$ git clone --branch 1.9 https://github.com/BruceDevices/firmware.git
# already have the repo? check out this version:$ git checkout 1.9
Adds Kaseikyo Protocol (Custom IR) support for transmission
Add BLE Name & WiFi AP Credentials Settings to allow device configuration via the UI
Allow WebUI as a startup app to boot directly into the web interface
Add NRF24 support for T-Display S3 board for wireless communication
Customizable SPI bus pins for CC1101, SDCard and NRF24 via configuration
+1 moreshow less
Add IR Tx Repeats support to control signal repetition length
Proxmark3 v4.20142 adds Hitag µ/8265 support, HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral. SAM SEOS, iClass tear-off attacks, ST25TN, and new UL AES auth.
└──▷ GET THIS VERSION
$ git clone --branch v4.20142 https://github.com/RfidResearchGroup/proxmark3.git
# already have the repo? check out this version:$ git checkout v4.20142
└──▷ TRY IT
Perform a tear-off attack on an iClass tag to probe write-protection behavior.
$ pm3 -- hf iclass trbl
Adds des_talk.py script for easier MIFARE DESFire handling.
Adds lf em 410x clone --htu to clone EM410x IDs to Hitag µ/8265 tags.
Adds lf hitag htu command for Hitag µ/8265 support.
Adds hf mfu aesauth command for MIFARE Ultralight AES authentication.
Adds hf seos sam command for HID SAM SEOS communications support.
Adds hf iclass trbl command to perform tear-off attacks on iClass.
Adds initial support for ST25TN tags including signature verification.
Adds Be-Tech and Texecom vendor identification.
Adds new Wiegand formats: 56-bit sample format and H800002.
Adds option in hf mf autopwn to use SPISPISerial Peripheral Interface, a synchronous communication bus standard used to connect microcontrollers to sensors, flash memory, and other peripherals at short range; cyber tools use it to read or write firmware on embedded devices. flash dictionary for key attacks.
Adds option in hf mf autopwn to set a custom output filename suffix.
Adds detection of static encrypted nonces in hf mf autopwn.
Adds special iClass legacy config cards support in hf iclass configcard.
Adds simulation function to hf iclass legrec.
Adds option in hf_mf_ultimatecard script to get/set maximum read/write block number.
Adds make commands target to regenerate command documentation and autocompletion data independently of make style.
Extends SPI flash key dictionary to hold up to 4095 Mifare keys.
Migrates flash-stored key dictionaries (Mifare, iClass, T55XX) and T55XX configs to SPIFFS files.
Adds support for Docker environment connection to host device.
Updates hf 14a info to identify MIFARE Duox chips.
Updates hf mf info to differentiate between full USCUID and cut-down ZUID chips.
Updates hf 15 info to show all type matches and check ST25TVxC signatures.
New RFID commands for Hitag µ/8265, HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral. SAM SEOS, iClass tear-off, and SPISPISerial Peripheral Interface, a synchronous communication bus standard used to connect microcontrollers to sensors, flash memory, and other peripherals at short range; cyber tools use it to read or write firmware on embedded devices. flash dictionary support in proxmark3 Blue Ice.4.20142
└──▷ USE IT
Clone an EM410x card ID onto a Hitag µ/8265 device for testing or cloning purposes.
shell
lf em 410x clone --htu <id>
Initiate communication with a HID SAM (Secure Access Module) using SEOS protocol for secure access scenarios.
shell
hf seos sam
Perform a tear-off attack on an iClass card to extract data or simulate the card.
shell
hf iclass trbl
Added lf hitag htu subcommand for Hitag µ/8265 protocol support
Added lf em 410x clone --htu to clone EM410x IDs to Hitag µ/8265 devices
Added hf seos sam command for HID SAM SEOS communications
Added hf iclass trbl command to perform tear-off attacks on iClass
Added hf mfu aesauth based on existing UL AES support
+5 moreshow less
Added hf 15 slixprotectpage command
Added des_talk.py script for easier MIFARE DESFire handling
Added support for connection to host device in all Docker envs
Changed lf em 4x70 internals on ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. side; Enabling improved debugging and reliability
Changed flash-stored key dictionaries (Mifare, iClass, T55XX) and T55XX configurations to SPIFFS files
A tool that detects cell site simulators (IMSI catchers) on a cheap mobile hotspot.
Rayhunter v0.2.6 adds macOS Intel artifacts, PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. metadata injection, and fixes serial command on macOS
└──▷ GET THIS VERSION
$ git clone --branch v0.2.6 https://github.com/EFForg/rayhunter.git
# already have the repo? check out this version:$ git checkout v0.2.6
Builds macOS Intel release artifacts alongside Apple Silicon builds
A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32.
Adds Channel Analyzer and BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems. Analyzer for non-touch hardware in v1.3.0
└──▷ GET THIS VERSION
$ git clone --branch v1.3.0 https://github.com/justcallmekoko/ESP32Marauder.git
# already have the repo? check out this version:$ git checkout v1.3.0
BloodHound v7.2.0 adds deep linking across all search modes, new ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise./NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. relay attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., and bidirectional shortest-path for PostgreSQL.
└──▷ GET THIS VERSION
$ git clone --branch v7.2.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v7.2.0
Adds deep linking for node search, pathfinding search, Cypher search, composition/relationship queries, and node context menu — shareable URLs now encode full graph exploration state.
Supports selectedItem and expandedPanelSections URL query parameters so specific nodes and open panel sections are preserved in shared links.
Supports deep linking for the selected environment, keeping domain/tenant context in the URL.
Supports Export Graph data functionality via deep linking.
Adds back_button_support feature flag, letting users enable or disable browser back-button navigation within the graph UI.
+5 moreshow less
Adds plumbing for CA Enrollment Endpoints (CoerceToADCS) attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. edges.
Adds CoerceAndRelayNTLMToSMB composition-to-relay-targets attack path, showing SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. relay chains in pathfinding.
Adds LimitedRights edges to the pathfinding filter options.
Implements bidirectional BFS for shortest-path (SP/ASP) queries on PostgreSQL backends, improving performance for large environments.
Removes self-relay from SMB and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory.(S) relay attack path logic, reducing false-positive paths.
10 details in Everything
1 more release in this issue
· 2025-03-07 → 2025-03-25
BloodHound v7.1.0 adds NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. relay attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., reworked Owns/WriteOwner edges, and new ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. coercion post-processing.
└──▷ GET THIS VERSION
$ git clone --branch v7.1.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v7.1.0
Adds post-processing for CoerceAndRelayNTLMtoADCS attack paths, surfacing NTLM relay routes to AD CS targets.
Adds post-processing for CoerceAndRelayNTLMToLDAP(S) attack paths, with abuse details and relay-target composition.
Adds pre-built saved queries for NTLM relay attack paths.
Reworks Owns/WriteOwner edge logic (BED-4965), replacing OwnsRaw and WriteOwnerRaw with updated ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. relationship model.
Adds ingestion support for NTLM relay data to populate new NTLM relay edges.
+6 moreshow less
Adds the back_button_support feature flag for browser back-button navigation within the UI.
Adds the tier_management_engine feature flag gating the new tier management engine.
Enforces SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. role-provisioning changes on every login, not just the first.
Enables recreating the default admin user via environment variable.
Adds client-side UI controls disabling for read-only users.
Includes the Direct Access Users group in collection and post-processing.
11 details in Everything
└──▷ BREAKING ON UPGRADE
!The highvalue property is removed from the graph schema; any queries or workflows relying on the highvalue field will break.
!OwnsRaw and WriteOwnerRaw are removed from ACLRelationships; tooling or queries referencing these relationship types will break.
$ git clone --branch v11.41 https://github.com/v1s1t0r1sh3r3/airgeddon.git
# already have the repo? check out this version:$ git checkout v11.41
New enterprise identities capture feature for attacking WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes.-Enterprise networks
Adds a flag to distinguish and validate personal vs. enterprise networks before launching attacks
Implements guardrails preventing enterprise attacks from running against personal networks and vice versa
Adds a helper function to simplify hooking language strings from plugins
Starkiller v3.0.0-rc1 adds a plugin marketplace, terminal autocomplete, and a reorganized navbar with sub-menus.
└──▷ GET THIS VERSION
$ git clone --branch v3.0.0-rc1 https://github.com/BC-SECURITY/Starkiller.git
# already have the repo? check out this version:$ git checkout v3.0.0-rc1
Adds a plugin marketplace for discovering and installing plugins directly from the UI.
Adds a plugin detail page and plugin settings page for managing individual plugins.
Adds autocomplete to the terminal for listeners, suggested values, and bypasses.
Adds dynamic options for form fields.
Adds an autorun tab to the listeners page.
+2 moreshow less
Enables file browser support for IronPython.
Reorganizes the navbar with a default mini mode and sub-menus.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!Light mode has been removed; only the dark theme is maintained going forward.
!The import script button has been removed from the agent page.
!The script command checkbox has been removed from the agent page.
Empire v6.0.0 adds Go agents, a Plugin Marketplace, a new Empire Compiler for C#, and expanded IP allow/deny list support.
└──▷ GET THIS VERSION
$ git clone --branch v6.0.0 https://github.com/BC-SECURITY/Empire.git
# already have the repo? check out this version:$ git checkout v6.0.0
└──▷ TRY IT
Run a remote PowerShell script on an agent using the new invoke-script module.
$ usemodule code_execution/invoke-script
set Agent <agent_name>
set ScriptPath <path_to_ps1>
execute
Run a remote Python script on a Python agent using the new python invoke-script module.
$ usemodule python/code_execution/invoke-script
set Agent <agent_name>
set ScriptPath <path_to_py>
execute
Adds Go agents with a new multi_go_exe stager type and Go as an option for multi_launcher.
Introduces a Plugin Marketplace via Starkiller 3.0 with support for plugin registries and installing plugins via the API.
Replaces the old C# compilation approach with a new Empire-Compiler that auto-downloads pre-compiled binaries, eliminating dotnet as an OS dependency.
Adds new allow/deny list implementation with proper support for IPv4, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only., ranges, and CIDRs.
Adds API endpoints for managing autorun commands on agent check-in.
+10 moreshow less
Adds api.ip and api.secure as server config options.
Adds dynamic options to modules.
Adds module code_execution/invoke-script for remote PowerShell script execution.
Adds module python/code_execution/invoke-script for remote Python script execution.
Adds SharpHound ingestor for Community Edition and tags legacy BloodHound.
Adds language compatibility check so modules only run on agents that support the required language.
Adds -f flag to the install script to force installation as root.
Swaps C# module RunOF for COFFLoader.
Updates BOFBOFA Buffer Overflow exploit technique where attacker-controlled input overwrites adjacent memory to hijack program execution; cyber tools use it to develop and deliver shellcode-based exploits against vulnerable binaries. parsing to use bof_pack formatting.
Updates Starkiller to v3.0.0, now served at {api_url}/.
15 details in Everything
└──▷ BREAKING ON UPGRADE
!The command line client has been removed; use Starkiller instead.
!--restip and --restport command-line options are removed; use the config file instead.
!socketport config option on the client is removed.
!All config properties in client and server configs are renamed to snake_case.
!ip_whitelist and ip_blacklist are renamed to ip_allow_list and ip_deny_list and are now lists instead of comma-separated strings.
!Starkiller is now accessed at {api_url}/ instead of {api_url}/index.html.
!The Agents class is moved to AgentCommunicationService with refactored function and parameter names.
!The Stagers class is moved to StagerGenerationService with refactored function and parameter names.
!Plugin Task handling is moved from PluginService to PluginTaskService.
!Socks management is moved to AgentSocksService with socks properties renamed to use plural naming.
!The update_lastseen parameter is removed from handle_agent_request.
!module_service.execute_module now returns a pydantic model.
!agent_task_service functions now take a user model instead of a user ID.
!All writable data is moved out of the install path into ~/.local/share/empire.
!The Listeners class is removed.
!The Credentials class is removed.
!Functions from the Agents class deprecated in 5.x are removed.
!Script and module upload to memory is removed in favor of modules with the same functionality.
!The reverseshellserver plugin is removed.
!empire_config.directories.module_source and empire_config.directories.obfuscated_module_source config keys are removed.
!The csharpserver plugin is replaced by the DotnetCompiler class in empire.server.common.
!The nim stager is removed from Empire and the install script.
!Minimum Python version raised to 3.13.
!Removed listeners: HTTP COM, OneDrive, and Dropbox.
Noir v0.20.0 adds AI provider flags, local LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. support (Ollama/vLLM), and .http file analysis.
└──▷ GET THIS VERSION
$ git clone --branch v0.20.0 https://github.com/owasp-noir/noir.git
# already have the repo? check out this version:$ git checkout v0.20.0
Adds --ai-provider, --ai-model, and --ai-key CLI flags to control AI integration sources and credentials
Enables local LLM support for Ollama, LM Studio, and vLLM as AI providers
Mend Platform introduces Mend AI for AI inventory visibility and Mend AI Premium for behavioral risk detection.
Introducing Mend AI to detect AI components (models, frameworks, inference providers) and identify Shadow AI.
Adding Mend AI Premium for AI Component Risk Insights including licensing and vulnerability risks.
Adding AI Behavioral Risks (Red-teaming) capability with prebuilt customizable tests for prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools., context leakage, and data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..
Enabling Proactive Policies and Governance for AI components through policy engine automation workflows.
March 27, 20257 releases · 2025-03-04 → 2025-03-27Stable
DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Enterprise mode enables authenticated app/API scanning with ISM for internal targets.
└──▷ HOW TO FIND IT
Scan an API using Scriptable Request Modifications for custom auth flows.
📍Configure SRM in the DAST Enterprise policy to handle unique header requirements.
Scan internal applications behind a firewall using Internal Scanning Management.
📍Enable ISM in the DAST Enterprise mode settings to reach targets behind the corporate firewall.
DAST Enterprise mode is now available for enhanced web application and API security testing
Adds support for login scripts, scanner variables, and client certificates in DAST Enterprise authentication configuration
Adds Scriptable Request Modifications (SRM) for API scanning in DAST Enterprise
Allows uploading or dynamically referencing API specifications in DAST Enterprise
Enables scanning of web applications and APIs hosted behind a corporate firewall via Internal Scanning Management (ISM)
5 details in Everything
6 more releases in this issue
· 2025-03-04 → 2025-03-27
Veracode DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Enterprise mode adds login scripts, API specs upload, and ISM for firewall-hosted apps
Adds DAST Enterprise mode to enhance policy enforcement and analytics for web applications and APIs.
Adds support for login scripts, scanner variables, client certificates, and Scriptable Request Modifications (SRM) in DAST Enterprise mode.
Enables uploading or dynamically referencing API specifications within DAST Enterprise mode.
Introduces Internal Scanning Management (ISM) in DAST Enterprise mode to scan apps behind corporate firewalls.
Allows mapping multiple domains to a single identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. for SP-initiatedSP-initiatedA SAML or OAuth/OIDC login flow where the Service Provider redirects the user to an Identity Provider to authenticate, rather than the IdP pushing an assertion unprompted; tools use it to trigger SSO from their own login page.SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management..
Customizable PDFs now display SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. Component License Risk policy compliance status
Early Access PR summary and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. inline comments for GitLab and Azure Repos are available through self-opt-in
In Early Access, opt-in PR Issue Summary Comments report security, license and code check counts by severity for GitLab and Azure Repos.
In Early Access, opt-in SAST High-Context Inline Comments show findings with CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances., priority score and Snyk Learn links in the SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. interface.
Enterprise customers gain Early Access reports for CI/CD repository testing and PCI-DSSPCI-DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. readiness
Snyk Visual Studio v2.1.1 adds project.assets.json path to OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. file tree nodes
Plans expanded gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. taint-flow analysis in Snyk Code starting April 3, 2025
Planned rollout starting April 3, 2025: taint flow analysis now includes gRPC data sources to uncover more security issues in gRPC-based applications
Plans new Snyk Code issue columns in Reports and Snowflake Data Share for Enterprise customers on March 19
Available to Enterprise customers March 19: adds File Path column to Snyk Code Issues in Reports for enterprise customers on March 19th, allowing users to trace all issues within a specific file.
Available to Enterprise customers March 19: adds Code Region column to Snyk Code Issues in Reports identifying the specific line and column numbers where an issue was found.
Available to Enterprise customers March 19: adds Commit ID column to correlate Snyk Code issues with their associated code version in reports and Snowflake Data Share.
Available to Enterprise customers March 19: adds Asset Finding ID column to uniquely identify issues within a repository, helping dedupe issues found across multiple targets.
Plans Group by Library for Open Source vulnerability views, progressively rolling out from March 17
Progressive rollout starting March 17: adds a Group by Library option to the Open Source project's vulnerability dashboard that organizes issues by the responsible library
Plans Poetry 2 support in Snyk Open Source CLI and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations from March 26
Planned support from March 26; SCM repositories require re-import and CLI users must upgrade: adds detection of Poetry 2 pyproject.toml manifests declaring dependencies via the PEP 621 format in both CLI and SCM integrations
Mend SCA v25.2.2 adds Bower, Poetry, Packrat, SBTSBTA build tool for Scala and Java projects, maintained by the open-source community, that handles compilation, dependency resolution, and packaging using an incremental build model to speed up iterative development., Cocoapods to CLI; extends Reachability to Lerna, pnpm, Conda, NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code..
Adds Bower (JavaScript) package manager support in the Mend CLI
Adds Poetry (Python) and Conda (Python) package manager support in the Mend CLI
Adds Cocoapods (Swift & Objective C) package manager support in the Mend CLI
Extends Reachability Analysis to Lerna and pnpm for JavaScript
Extends Reachability Analysis to Conda and Poetry for Python
+1 moreshow less
Extends Reachability Analysis to NuGet (C#) package manager
Mend SAST is a static application security testing service that scans source code for vulnerabilities and helps teams prioritize remediation.
New .ws configuration key enables suppressing GitHub/SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. findings from code repos
Adds suppression capability in classic GitHub.com and GitHub Enterprise integrations, allowing developers to suppress findings directly in the repository without logging into Mend.
Adds new configuration option in the .ws file to disable the developer suppression feature for restricted autonomy.
Improves accuracy of CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-918 (SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly.) detections for JavaScript and Python.
Expands CWE-22 (Path Traversal) detection in Python to include Zip Slip Attacks.
Adds support for registration-based entry points for C#.
5 details in Everything
3 more releases in this issue
· 2025-03-10 → 2025-03-24
Mend SAST 25.3.1 adds in-repo finding suppression for GitHub integrations with .ws config control
Adds suppress_in_repo configuration option to .ws files to enable developers to suppress findings directly in GitHub without logging into Mend
Improved detection accuracy for CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-918 (SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly.) in JavaScript and Python engines
Extended CWE-22 (Path Traversal) detection in Python to cover Zip Slip Attacks
Added support for registration-based entry points in C# analysis
Automated remediation suggestions for Code findings are now available for Bitbucket Cloud on the Developer Platform
└──▷ HOW TO FIND IT
Review and accept code fix suggestions directly within Bitbucket Cloud pull requests or issues.
📍Steps: Go to your Bitbucket Cloud repository, open a Pull Request containing code findings from Mend SAST. Look for the Remediation Suggestions panel in the Developer Platform integration tab. Click Accept on the suggested fix to auto-apply the patch.
Azure backend gains ADO Pipelines OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. token refresh support via new ado_pipeline_service_connection_id setting.
└──▷ GET THIS VERSION
$ git clone --branch v1.11.2 https://github.com/hashicorp/terraform.git
# already have the repo? check out this version:$ git checkout v1.11.2
└──▷ USE IT
Authenticate Terraform's Azure backend with an Azure DevOps Pipeline OIDC token that auto-refreshes during long runs.
Add project-level secrets management, default API keys for on-prem LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-as-judge, and OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. tracing support
Support project-level secrets stored and referenced directly from the Platform UI/API
GitLab 17.10 adds Duo Code Review beta, GLQL views, vulnerability severity changes, and new APIs for token management.
└──▷ HOW TO FIND IT
Trigger AI-powered code review on a merge request using the new beta capability.
📍@GitLabDuo
@GitLabDuo mentioned as a reviewer or in comments to trigger Duo Code Review beta on merge requests (Ultimate tier)
Create GLQL views by embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. live data queries in Markdown code blocks across Wiki pages, epics, and issues
Manually change vulnerability severity (Critical/High/Medium/Low/Info/Unknown) for individual or bulk occurrences in the vulnerability report
id_token_expiration config attribute to configure duration of ID tokens when GitLab acts as an OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. provider
Webhook triggers 60 and 30 days before access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. expiry via extended webhook settings
+5 moreshow less
/api/v4/token-information API endpoint for unified identification and revocation of all token types by administrators
Set a default compliance framework from the dropdown list on the Frameworks page in the compliance center for top-level groups
Toggle blame view to show or hide revisions listed in .git-blame-ignore-revs via the Blame preferences dropdown
Configure path exclusions in CODEOWNERS files to ignore specific paths requiring Code Owner approval
Configurable squash settings for each protected branch through branch rules
10 details in Everything
└──▷ BREAKING ON UPGRADE
!The Default project creation protection dropdown is renamed to Minimum role required for project creation
!The Developers + Maintainers dropdown option for project creation permissions is renamed to Developers
Apiiro GA adds native Software Supply Chain Security with new dashboard and risk detection for CI/CD pipelines and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. repos
Adds Supply Chain Security Dashboard and Supply Chain Security Risks pages to view supply chain coverage and risks in the context of application risk landscape.
Enables detection of risks in GitHub & GitLab, including weak branch protection rules and permissions.
Detects pipeline misconfigurations and dependency vulnerabilities within CI/CD pipelines and SCM repositories.
Adds workflow triggers for SSCS risks, abnormal commit activity, and pipeline config file changes.
Adds fixable query param and alert.fix property to the Socket.dev bulk packages API
Adds fixable=true query option to the batch PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. endpoint to retrieve only fixable artifact alerts.
Adds alert.fix object with type (cve | upgrade) and description fields to alert responses.
2 details in Everything
2 more releases in this issue
· 2025-03-03 → 2025-03-11
Full Scan Diff API now uses Full Scan IDs for diff_report_url
diff_report_url field in the Full Scan Diff Endpoint now returns URLs generated using Full Scan IDs instead of SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. IDs.
Response body of the Full Scan Diff Endpoint now includes repo and org slugs.
Sonatype Nexus Repository 3.78.0 introduces ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. Docker images, Spring Boot migration, npm Firewall integration, and removes legacy components
ARM Docker images now available for deployment on ARM infrastructure alongside existing x86_64 versions
npm Audit security enhanced with full Sonatype Repository Firewall integration for npm versions 7 and 8
Nexus Repository migrates to Spring Boot architecture packaged as a single uber-jar, dropping Apache Karaf/OSGi support
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Custom OSGi bundle deployment is no longer supported due to the migration from Apache Karaf to Spring Framework
!The jetty-rewrite module is removed during the upgrade to Jetty 12, invalidating any customizations in jetty config files
!The Log4J Visualizer feature has been removed and is no longer available
!The Bower format has been officially sunset and is no longer supported
LavaMoat webpack plugin v0.9.0-beta.0 adds scuttling support to harden global object access in bundled apps.
└──▷ GET THIS VERSION
$ git clone --branch webpack-v0.9.0-beta.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout webpack-v0.9.0-beta.0
Adds scuttling support to the webpack plugin, restricting untrusted modules from accessing or tampering with privileged globals at runtime.
Adds .zip domain detection to the shadylinks heuristic, catching packages that link to the deceptive .zipTLDTLDThe rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type..
Enables the verify command in the GuardDog GitHub Action, allowing signature verification to run in CI pipelines.
syft v1.21.0 adds GraalVM Native Image symbol extraction and fluent-bit 1.7.0 dev/rc support
└──▷ GET THIS VERSION
$ git clone --branch v1.21.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.21.0
Extracts symbols from the .dynsym section of GraalVM Native Image binaries for richer SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. component data.
Supports fluent-bit 1.7.0 development and release-candidate package versions in SBOM generation.
Xygeni 5.9 adds JUnit XMLJUnit XMLA widely adopted test-report file format, originally from the Java JUnit framework, that records test suite results as XML; cyber tools emit it so their output plugs into CI systems like Jenkins or GitLab without custom parsers. reporting and improved navigation for SDLCSDLCThe Software Development Life Cycle: a structured process covering planning, design, coding, testing, and deployment. Cyber tools integrate into it to catch vulnerabilities before code ships rather than after. risk assessment
└──▷ USE IT
Integrate Xygeni's SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. results into CI/CD pipelines that consume JUnit XML for reporting.
shell
xyg --report-type junit-xml
Adds JUnit XML report output to provide detailed findings data.
Adds secrets set --file support for CLI bulk loading and custom HTTP headers via new CLI flag.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.119.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.119.0-postgres
--headers flag added to CLI commands to allow sending custom HTTP headers
infisical secrets set now accepts a --file argument for bulk key-value loading from text files
2 details in Everything
11 more releases in this issue
· 2025-03-03 → 2025-03-31
CLI adds --custom-headers flag and secrets set gains file input support.
└──▷ GET THIS VERSION
$ git clone --branch infisical-cli/v0.36.22 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical-cli/v0.36.22
└──▷ USE IT
Read secret values from a file instead of passing them inline
shell
infisical secrets set key=mysecret --input-file ./secrets.txt
Adds --custom-headers flag to CLI commands for injecting arbitrary HTTP headers
Adds --input-file (or -i) option to secrets set key=value command for reading values from a file
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The customHeaders config field in the SDK now expects a different format than previous versions
Adds ability to prevent reviewers from approving their own project approval requests; improves machine identity login performance.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.118.1-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.118.1-postgres
└──▷ HOW TO FIND IT
Enforce separation of duties so a developer cannot approve their own secret request.
📍In the project settings, navigate to the Approval Workflow configuration and disable the option allowing reviewers to self-approve.
Allow project approval workflows to set if a reviewer can or can not review their own requests
feat: client secret compare optimization in machine identity login
Adds recursive folder retrieval, file-based secret imports, dynamic secrets modal, and k8s short-lived JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. support
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.118.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.118.0-postgres
└──▷ TRY IT
Retrieve all nested folders under a specific path without pagination loops
infisical-cli/v0.36.19 adds --file import for secret set and CLI environment variable support.
└──▷ GET THIS VERSION
$ git clone --branch infisical-cli/v0.36.19 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical-cli/v0.36.19
└──▷ USE IT
Import a set of secrets defined in a .env file directly into an Infisical project using the CLI.
shell
infisical secret set --file path/to/secrets.env
Adds --file flag to the secret set command to load secrets from .env or .yaml files instead of manual arguments.
Enables environment variable configuration for all other CLI flags, allowing flag values to be sourced from the environment.
Adds Kubernetes ConfigMap support, Humanitec secret sync integration, and share to anyone capability.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.117.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.117.0-postgres
Adds configmap support for Infisical data in Kubernetes environments
Adds Humanitec secret sync integration for automated secret distribution
Adds --skip-env-check flag and improved environment validation in infisical run.
└──▷ GET THIS VERSION
$ git clone --branch infisical-cli/v0.36.17 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical-cli/v0.36.17
Improves infisical run by adding explicit validation that ensures a project contains the requested environment before fetching secrets; if missing, the command fails with a clear error instead of silently proceeding or crashing.
Adds admin console view for machine identities and a Role Access Tree UI component
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.116.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.116.0-postgres
infisical-cli adds install subcommand for systemd gateway management
└──▷ GET THIS VERSION
$ git clone --branch infisical-cli/v0.36.16 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical-cli/v0.36.16
└──▷ USE IT
Install the Infisical Gateway via CLI for later service management, useful in automated deployment scripts.
Infisical v0.115.0 adds actor tracking in secret history, new get by ID API endpoint, and webhook triggers for reminders
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.115.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.115.0-postgres
Adds GET /api/secrets/:id API endpoint to retrieve a specific secret directly by its ID
Includes the actor (user) who performed an action in the secret version history view
Adds the secret name to Slack notifications for alerts and reminders
Adds new webhook trigger capability for secret reminder events
Secret requests workflow, QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. gateway support, and admin delegation capabilities
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.114.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.114.0-postgres
└──▷ HOW TO FIND IT
Review and approve secret sharing requests via the new workflow feature.
📍In the Infisical console, navigate to the Secret Requests section to review incoming secret-sharing proposals.
Adds secret-sharing feature to enable secret requests for review.
Adds Save Secret Reminder from the modal UI to schedule reminders.
Adds Add descriptions to secret folders capability allowing metadata on folder structure.
Adds QUIC protocol support to the gateway for improved transport performance.
Enables server admins to grant server admin access to other users.
Infisical adds auto-redeploy for Kubernetes deployments and dev migration commands
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.113.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.113.0-postgres
Adds --auto-redeploy flag to automatically trigger redeployment of DaemonSet and StatefulSet resources upon secret changes
SPIKE Nexus gains configurable Shamir keeper count and share threshold, plus a Dockerfile for containerization.
└──▷ GET THIS VERSION
$ git clone --branch v0.3.1 https://github.com/spiffe/spike.git
# already have the repo? check out this version:$ git checkout v0.3.1
Adds environment-driven configuration for the number of SPIKE Keepers and Shamir share threshold (defaults to 3 keepers, minimum 2-of-3 shares to recreate the root key).
Adds a Dockerfile for containerized SPIKE deployments (multi-stage build; work in progress).
Securely erases old root key and shards from memory after use, following NIST recommendations, instead of relying on garbage collection.
TruffleHog finds, verifies, and analyzes leaked credentials across Git, chat, wikis, cloud storage, and more
TruffleHog v3.88.19 adds Azure SAS Token and Sentry org token detectors, plus a Bitbucket autodetection bypass option.
└──▷ GET THIS VERSION
$ git clone --branch v3.88.19 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.19
New detector for Azure SAS Tokens enables scanning for leaked Azure Shared Access Signatures.
New Sentry org token detector expands coverage of Sentry credential types beyond standard API keys.
Adds tenant_id to the MS Teams source configuration, enabling tenant-scoped scanning.
Adds option to bypass Bitbucket installation type autodetection for environments where detection is unreliable.
4 details in Everything
3 more releases in this issue
· 2025-03-05 → 2025-03-27
TruffleHog v3.88.17 adds detection and analysis of Anthropic admin keys.
└──▷ GET THIS VERSION
$ git clone --branch v3.88.17 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.17
Detects Anthropic admin keys in addition to previously supported Anthropic key types.
Analyzes Anthropic admin keys via the Anthropic analyzer for deeper secret inspection.
TruffleHog v3.88.16 adds Groq and LaunchDarkly analyzers, terminal analyze output, and Postman rate limiting.
└──▷ GET THIS VERSION
$ git clone --branch v3.88.16 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.16
Adds terminal output for the analyze command when the detector supports it, surfacing results directly in the CLI.
New Groq analyzer enables credential analysis for Groq API keys.
New LaunchDarkly Token analyzer enables credential analysis for LaunchDarkly tokens.
Adds rate limiting across all Postman client GET requests to prevent enumeration throttling issues.
TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. now handles relative paths.
TruffleHog v3.88.15 adds PlanetScale and Airtable analyzers for deeper credential exposure analysis.
└──▷ GET THIS VERSION
$ git clone --branch v3.88.15 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.15
New PlanetScale Analyzer to assess exposure of discovered PlanetScale credentials.
New Airtable Analyzer for Personal Access Tokens to assess exposure of discovered Airtable credentials.
Enumeration jobs no longer consume concurrency slots, improving scan throughput under load.
Re-activates the Plaid key detector for detecting Plaid API credentials.
GitGuardian SaaS adds hardcoded secret detection for Azure ACR, Amazon ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure., Google Artifact Registry, JFrog, and DockerHub container images.
Adds --input-type option to the filestatus subcommand for specifying file type when checking encryption status
Introduces SOPS_EDITOR environment variable, consulted before EDITOR, for editor selection
Allows disabling the version check via environment variable
Adds --same-process option for exec-env subcommand to run commands in the same process
Adds --idempotent flag to the set subcommand to skip writing the file when no change occurred
+15 moreshow less
Supports encryption and decryption of time.Time objects in YAML/JSON files
Adds SSH key support for age encryption
Adds support for age identities protected with a passphrase
Adds age plugin support, enabling external age key management plugins
Supports encrypting and decrypting directly from stdin
Adds SOPS_AGE_KEY_CMD option to retrieve the age key via an external command
Adds a way to set the sops config file location via an environment variable
Supports --config option in the publish subcommand
Adds support for oauth2.TokenSource in GCP KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. integration
Supports GOOGLE_OAUTH_ACCESS_TOKEN for Google Cloud Platform authentication
Adds duplicate section support to the INI store
Adds a trailing newline at the end of JSON output files
Adds Windows ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. binary releases and multiarch Windows release binaries
Warns when a .sops.yml file is found while searching for .sops.yaml
Adds option to explicitly check for the latest version on demand
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. agent 4.64.0 adds AWS Lambda support for editing application response headers and improves several detection engines
Improves CMDEXE detection capabilities in the Next-Gen WAF agent.
Improves SQLI detection capabilities in the Next-Gen WAF agent.
Improves TRAVERSAL detection capabilities in the Next-Gen WAF agent.
Improves XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. detection capabilities in the Next-Gen WAF agent.
4 details in Everything
3 more releases in this issue
· 2025-03-04 → 2025-03-13
Fastly Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. for Java 2.8.0 adds threadPrefix config option
Adds threadPrefix configuration option for custom thread prefixes
v1.6.2-rc1 adds configurable SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. cipher levels, Antibot filter options, and Infomaniak DNS provider to letsencrypt plugin.
└──▷ GET THIS VERSION
$ git clone --branch 1.6.2-rc1 https://github.com/bunkerity/bunkerweb.git
# already have the repo? check out this version:$ git checkout 1.6.2-rc1
Adds modern, intermediate, and old cipher level options to the SSL plugin configuration for granular control over TLS settings
Adds custom cipher list support in the SSL plugin configuration via a new field (implied by ability to set)
Adds configuration options in the Antibot plugin to ignore specific request attributes: URI, IP, reverse DNS, ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses., and User-Agent
Allows configuration of the algorithm used for generating self-signed certificates in the Self-signed certificate plugin (default: ec-prime256v1)
Adds Infomaniak as a supported DNS provider option within the letsencrypt plugin
humble 1.47 adds Content Security PolicyContent Security PolicyA browser security mechanism, standardized by the W3C, that lets a web server declare via HTTP headers which sources of scripts, styles, and other resources a page is allowed to load, blocking unauthorized content injection. analysis, 13 new fingerprint headers, and 3 new insecure checks.
└──▷ GET THIS VERSION
$ git clone --branch 1.47 https://github.com/rfc-st/humble.git
# already have the repo? check out this version:$ git checkout 1.47
└──▷ TRY IT
Analyze a saved response file and confirm the filename is echoed back — useful when batch-processing multiple sites in scripts.
Adds 13 new fingerprint headers to detection coverage.
Adds 3 new insecure header checks.
Improves OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against.Secure Headers Project Best Practices analysis.
Prints input filename when -if parameter is used.
+1 moreshow less
Adds User-Agent and Kali Linux setup guidance.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Python 3.9 is now the minimum required version; installations running an older Python will break on upgrade.
Adds new _Memory Bomb_ challenge for advanced CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. and training scenarios.
Upgrades frontend to Angular 17.x and Angular Material 17.x.
Adds blueSkyUrl and mastodonUrl fields to the social section of the configuration.
Adds BlueSky and Mastodon profile links to the About Us screen.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The _Cross-Site Imaging_ challenge now uses http://placecats.com instead of http://placekitten.com — canned CTF setups or solution guides relying on the old endpoint will break.
Caido v0.47.0 adds Invisible Proxying, DNS overriding, redesigned Match & Replace with workflow support, and backend log visibility.
└──▷ GET THIS VERSION
$ git clone --branch v0.47.0 https://github.com/caido/caido.git
# already have the repo? check out this version:$ git checkout v0.47.0
Adds Invisible Proxying to intercept traffic from non-proxy-aware clients without manual proxy configuration.
Adds DNS Entry Overriding to resolve domain names to a specific IP or DNS server on demand.
Exposes backend logs directly in the UI bottom panel for real-time debugging.
Extends Replay in Browser and View Response in Browser to all request/response panes.
Redesigns Match & Replace with a simplified Add Header action and support for workflows as dynamic replacements.
+2 moreshow less
Adds a Reload Window command to the command palette for recovering from UI issues.
Adds Plugin SDK WorkflowSDK with sdk.workflows.getWorkflows(), onCreatedWorkflow(), onUpdatedWorkflow(), and onDeletedWorkflow() for workflow interaction.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The MatchReplaceSDK (Frontend Plugin SDK) has been updated to fit the new Match & Replace redesign — existing plugins using MatchReplaceSDK will break and require updates.
Dalfox is an XSS scanner that automates parameter analysis, reflected/stored/DOM-based XSS detection, and WAF fingerprinting for web apps.
Dalfox v2.10.0 adds BAV opt-in flag, skip-discovery, result limits, force headless verification, and new XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. payload patterns.
└──▷ GET THIS VERSION
$ git clone --branch v2.10.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:$ git checkout v2.10.0
└──▷ TRY IT
Re-enable BAV scanning on a target after upgrading, since it is now off by default.
Adds --use-bav flag to explicitly opt into BAV (Blind-XSS Assisted Verification) scanning, which is now disabled by default.
Adds option to skip the discovery phase, letting practitioners scan known endpoints without reconnaissance overhead.
Adds result limit option for file and pipe commands to cap output volume.
Adds force headless verification option to drive Chrome-based payload confirmation on demand.
Adds custom transport support for HTTP-level customization of scan requests.
+1 moreshow less
Adds new XSS payload and comment patterns, expanding detection coverage.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!BAV (Blind-XSS Assisted Verification) is now disabled by default; existing workflows that relied on BAV being active must add --use-bav to restore previous behavior.
ZAP 2.16.1 adds TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. credential support, plugable Authn/API for session mgmt, and AJAX scope filtering.
Adds TOTP support to authentication credentials.
Exposes API endpoints to access dynamically added Authentication and Session Management method types
AJAX Spider now excludes URLs that are out of scope from its URL count
v0.14.0 adds Mach-O chained fixups, 32-bit support, multi-line regex anchors, vt module OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees., and tag linter
└──▷ GET THIS VERSION
$ git clone --branch v0.14.0 https://github.com/VirusTotal/yara-x.git
# already have the repo? check out this version:$ git checkout v0.14.0
Adds support for parsing LC_DYLD_EXPORTS_TRIE in Mach-O files
Adds parsing for LC_DYLD_CHAINED_FIXUPS (chained fixup imports) in Mach-O files
EMBA v1.5.2 adds CVE-bin-tool integration for SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. support via module f17
└──▷ GET THIS VERSION
$ git clone --branch v1.5.2-SBOM-next-generation-EMBA https://github.com/e-m-b-a/emba.git
# already have the repo? check out this version:$ git checkout v1.5.2-SBOM-next-generation-EMBA
SBOM VEX (Vulnerability Exploitability eXchangeVulnerability Exploitability eXchangeA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable.) support is available via f17, integrated into the main SBOM output or available as a separated file
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!The f20 module has been removed; users must migrate to f17 for CVE-bin-tool integration and SBOM generation
Frida 16.7.1 improves ARM32 Thumb code generation and scales to more ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control. devices.
Increases ADB message size limit in droidy to support more than ~8 connected devices
1 detail in Everything
1 more release in this issue
· 2025-03-13 → 2025-03-21
CHIPSEC 1.13.11 adds MC1 registers for Raptor Lake and an Arch Linux image.
└──▷ GET THIS VERSION
$ git clone --branch 1.13.11 https://github.com/chipsec/chipsec.git
# already have the repo? check out this version:$ git checkout 1.13.11
Adds MC1 registers to the Raptor Lake (RPL) platform definition, expanding hardware register coverage for that CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. family.
Adds Arch Linux Docker image generation for CHIPSEC, with reduced image size.
Access Windows Registry Capability Access Manager data using the new plugin path.
shell
dissect -f os.windows.regf.cam /path/to/target
Adds the target-diff tool to compare two targets
Adds the target-qfind tool to search for artifacts across targets
Adds a capability access manager (CAM) plugin accessible via -f os.windows.regf.cam
Adds Acquire MSSQL error log support
Adds Office add-ins plugin support
+2 moreshow less
Adds preliminary NFS support for acquisition
Introduces a new plugin directory structure allowing plugins to be organized in subdirectories accessed via dotted paths like -f path.to.plugin_dir.plugin_name
Sleuth Kit 4.13.0 adds BitLockerBitLockerA full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints. support and experimental btrfs/xfs parsing
└──▷ GET THIS VERSION
$ git clone --branch sleuthkit-4.13.0 https://github.com/sleuthkit/sleuthkit.git
# already have the repo? check out this version:$ git checkout sleuthkit-4.13.0
Added BitLocker support for Windows images, enabling the tool to read encrypted volumes.
Added support for btrfs (experimental) and xfs (experimental) file system parsing.
Updated logical folder caching to improve performance when traversing directory structures.
Cortex Analyzers 3.5.4 migrates container images to GHCRGHCRGitHub Container Registry, GitHub's hosted service for storing and distributing OCI-compatible container images, giving cyber tools a versioned, access-controlled image store tied directly to a GitHub repository..io and adds ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. platform support.
└──▷ GET THIS VERSION
$ git clone --branch 3.5.4 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.5.4
Publishes container images to GHCR.io (GitHub Container Registry) instead of the previous registry.
Adds ARM64 architecture support for analyzer container images.
2 details in Everything
2 more releases in this issue
· 2025-03-14 → 2025-03-28
Cortex Analyzers 3.5.3 adds SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hash support to IntezerCommunity and Unicode output to TestAnalyzer.
└──▷ GET THIS VERSION
$ git clone --branch 3.5.3 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.5.3
Adds sha256 hash type support to the IntezerCommunity analyzer.
Cortex Analyzers 3.5.2 adds ONYPHE Ctiscan and ActiveScan analyzer support.
└──▷ GET THIS VERSION
$ git clone --branch 3.5.2 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.5.2
UAC v3.1.0 adds rootkit detection via debugfs/xfs_db, an offline IR triage profile, OSQuery integration, and dozens of new Linux/BSD artifacts.
└──▷ GET THIS VERSION
$ git clone --branch v3.1.0 https://github.com/tclahr/uac.git
# already have the repo? check out this version:$ git checkout v3.1.0
Adds collection of hidden /etc/ld.so.preload using debugfs and xfs_db to surface stealthy Linux rootkit indicators.
Introduces offline_ir_triage profile for offline triage collections.
Adds OSQuery artifact collection via osqueryi binary placed in the bin directory (Linux).
Adds artifact to list immutable files on Linux systems (live_response/system/immutable_files.yaml).
Adds live_response/packages/package_owns_file.yaml to determine which installed package owns a specific file or command (disabled by default).
+18 moreshow less
Adds live_response/system/getcap.yaml to collect files with associated process capabilities (Linux).
Adds live_response/system/group_name_unknown_files.yaml and user_name_unknown_files.yaml to list files with unknown GID/UID across all major platforms.
Adds no_group and no_user artifact properties to search for files whose GID or UID no longer exists on the system.
Adds redirect_stderr_to_stdout artifact property to redirect stderr to stdout for complete log capture.
Adds JSON output support for findmnt and lsblk storage artifacts (Linux).
Adds live_response/system/coredump.yaml and memory_dump/coredump.yaml for core dump, ABRT, Apport, and kdump file collection.
Adds live_response/system/journalctl.yaml boot time period listings.
Adds live_response/system/sudo_lectured.yaml to collect timestamps of users who saw the sudo lecture message.
Adds live_response/system/ulimit.yaml to collect all resource limits information.
Adds AWS SSMAWS SSMAWS Systems Manager, an Amazon service that lets operators manage EC2 instances and on-premises servers without opening inbound ports, replacing SSH with API-driven session and command execution. Agent and Azure Linux VM Agent log/config collection artifacts.
Adds numerous recently-accessed-file artifacts for KDE and GNOME applications (Ark, Dolphin, Dragon Player, Geany, Gedit, GNOME Text Editor, Kate/KWrite, KDE MRU, Okular, Konqueror) on BSD and Linux.
Adds history file collection for atftp, nano, and PHP on all platforms.
Adds NetworkManager connection info via nmcli (Linux).
Adds package manager artifacts for 0install, apk, cargo, guix, Conary, KISS, npm, Paludis, Portage, Slackpkg, Soar, and Tazpkg.
Adds files/system/upstart.yaml and files/system/xdg_autostart.yaml for persistence collection on Linux.
Adds files/system/gvfs_metadata.yaml and live_response/system/kactivitymanagerd.yaml for user activity tracking on BSD/Linux.
Updates dpkg.yaml to validate installed packages by comparing files against dpkg database metadata.
Updates live_response/process/ps.yaml to capture system date before process snapshot including elapsed time.
23 details in Everything
└──▷ BREAKING ON UPGRADE
!The memory_dump/avml.yaml output file name is renamed from avml.raw to avml.lime; any downstream pipeline expecting avml.raw will break.
AVML v0.15.0 adds arm64 build support for Linux memory acquisition on ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.-based systems.
└──▷ GET THIS VERSION
$ git clone --branch v0.15.0 https://github.com/microsoft/avml.git
# already have the repo? check out this version:$ git checkout v0.15.0
Only run the collection if sufficient disk space is available
shell
WolfLauncher.exe ... /archive:"diskfree: 10GB"
Adds physicalmemory condition to WolfLauncher archive configuration
Adds diskfree configurable requirement to WolfLauncher archive configuration
Enables ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. support for extension libraries
3 details in Everything
└──▷ BREAKING ON UPGRADE
!WolfLauncher outcome command field type is renamed to source
macos-unifiedlogs v0.2.0 adds StateDump Protobuf parsing and reduces memory usage via UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. string caching.
└──▷ GET THIS VERSION
$ git clone --branch v0.2.0 https://github.com/mandiant/macos-unifiedlogs.git
# already have the repo? check out this version:$ git checkout v0.2.0
Adds support for parsing StateDump Protobuf data from macOS Unified Logs.
Reduces memory usage significantly by keeping only a small cache of UUID strings instead of retaining all strings.
Improves handling of log number data marked as private.
Makes log_type and event_type enums for stronger typing.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!log_type and event_type are now enums — code that previously treated these as their underlying types (e.g. integer or string) will need to be updated to use the enum variants.
!UUIDText and dsc parsing now use HashMap instead of Vec — any code relying on ordered/index-based access to these structures will break.
Prisma Cloud Compute 34.00 adds agentless custom AMI env vars, CaaS API filters, ACI discovery, and Jira API token auth
AGENTLESS_USE_CUSTOM_AMI and AGENTLESS_CUSTOM_AMI_PER_REGION environment variables now enable on-prem users to supply custom Amazon Machine Images instead of the default scanner image.
hasCAASSpecReferences query parameter is available in Get Registry Scan Results, Download Registry Scan Results, and Get Registry Image Names APIs to filter registry images deployed as part of CaaS specifications.
images query parameter added to Get Discovered Cloud Entities API for filtering by container image names defined in CaaS specs; service parameter added to the same API response for GCP Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity. service name.
Cloud Discovery now includes data for all containers in Azure Container Instances (ACI) groups, not just the first one.
Account ID attribution is now displayed for app-embedded defenders installed on ACI containers.
Prisma Cloud March 2025 adds CaaS asset discovery, custom AMI env vars, API ingestion connectors, and Lightsail compliance policies.
Adds environment variables AGENTLESS_USE_CUSTOM_AMI and AGENTLESS_CUSTOM_AMI_PER_REGION to enable on-prem users to specify custom Amazon Machine Images for scanning
Introduces new API ingests for Amazon Cognito (aws-cognito-identity-pool-role), Amazon Connect (aws-connect-instance-user, aws-connect-instance-security-profile), and Amazon EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. Pipes (aws-event-bridge-pipe)
Adds new Amazon EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. API ingests for aws-ec2-instance-connect-endpoint, aws-ec2-image-block-public-access-state, and aws-ec2-snapshot-block-public-access-state
Adds new AWS Glue API ingests for blueprints (aws-glue-blueprint, aws-glue-blueprint-run) to discover blueprint configurations
Adds new Amazon RDS API ingests for proxies (aws-rds-db-proxy, aws-rds-db-proxy-target) and automated backups (aws-rds-db-instance-automated-backup)
+8 moreshow less
Adds S3 Storage Lens configuration ingest via aws-s3-storage-lens-configuration and SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. topic subscription ingest via aws-sns-subscriptions-by-topic
Adds SQS message move task ingest (aws-sqs-message-move-task) and Lambda event invoke config/concurrency/runtime management ingests to discover function settings
Supports the CaaS Specification References field via a new hasCAASSpecReferences query parameter on registry scan APIs
Supports container image filtering in cloud discovery via a new images query parameter on GET /api/v1/discovery/entities
Adds a service parameter to discovered GCP Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity. entities in the cloud discovery API response
Adds caasSpecReferencesTotal field across multiple APIs (host scans, image scans, vulnerability policies) to specify referenced CaaS specification counts
Extends shared.ScanResultType enum with aws-fargate-task-definition for new scan result types
Adds three new compliance policies for AWS Lightsail storage buckets: unmonitored access, public readability, and disabled object versioning
13 details in Everything
└──▷ BREAKING ON UPGRADE
!Support removed for Azure Kubernetes Service (AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations.) v1.27-v1.30, Elastic Container Service (ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping.) 1.86, Elastic Kubernetes Service (EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves.) v1.28-v1.30, Google Kubernetes Engine (GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.) v1.27-v1.30, Lightweight Kubernetes (k3s) v1.30, OpenShift 4.14, RKE v1.30-v1.31, and RKE2 v1.29 for x86 orchestrators
!Support removed for Talos OS versions 1.3 through 1.8.2 and VMware Tanzu Kubernetes Grid Integrated Edition (TKGI) v1.26-v1.28 for x86 operating systems
!Support removed for Elastic Container Service (ECS) 1.86, Elastic Kubernetes Service (EKS) v1.29-v1.30 ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware., Google Kubernetes Engine (GKE) v1.29-v1.30 ARM, and GKE autopilot on ARM v1.29-v1.30
!Support removed for Auto Defend (AWS) Node.js 16 and Python 3.8
!Support removed for Runtime Protection with Defender (AWS) Node.js 16 and Python 3.8
PCAPdroid v1.8.0 adds TLS decryption via Wireshark, country/CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. firewall rules, and expanded Pcapng support
└──▷ GET THIS VERSION
$ git clone --branch v1.8.0 https://github.com/emanuele-f/PCAPdroid.git
# already have the repo? check out this version:$ git checkout v1.8.0
Enables TLS traffic decryption in captured PCAP/Pcapng files through Wireshark integration
Adds New UI filter to show connections bigger than a given bytes threshold
Security Onion 2.4.140 adds PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. import support for sensors in distributed grids and improves Zeek file extraction handling.
└──▷ GET THIS VERSION
$ git clone --branch 2.4.140-20250324 https://github.com/Security-Onion-Solutions/securityonion.git
# already have the repo? check out this version:$ git checkout 2.4.140-20250324
Supports PCAP imports for sensors in distributed grid deployments.
Adds Zeek file_extraction forcedType handling for single-line edge cases.
Includes observer.name in ldap_search results for richer event context.
Applies specified role when adding new users instead of defaulting.
4 details in Everything
1 more release in this issue
· 2025-03-11 → 2025-03-24
Security Onion 2.4.130 adds a Sankey chart to the Elastic Agent API dashboard, Zeek traceroute & NTP support, and upgrades Elasticsearch to 8.17.3.
└──▷ GET THIS VERSION
$ git clone --branch 2.4.130-20250311 https://github.com/Security-Onion-Solutions/securityonion.git
# already have the repo? check out this version:$ git checkout 2.4.130-20250311
Adds a Sankey chart to the Elastic Agent API dashboard visualizing the relationship between process.name and process.Ext.api.name.
Adds Zeek traceroute and NTP log integrations.
Adds TLSv1.3 support to the nginx configuration.
Enables installation of Elastic integrations that require an Elastic license.
Adds multiline input support for managed integration configuration fields.
Above v2.8 adds HSRPv2 detection, VRRPv2 plaintext password decoding, and MAC vendor identification.
└──▷ GET THIS VERSION
$ git clone --branch v2.8 https://github.com/caster0x00/Above.git
# already have the repo? check out this version:$ git checkout v2.8
Adds HSRPv2 protocol support for detecting first-hop redundancy attacks.
Adds decoding of plaintext passwords found in VRRPv2 packets.
Adds vendor detection by MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. to aid device fingerprinting during network reconnaissance.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. protocol support has been removed; setups relying on Above to detect RADIUS traffic will no longer capture it.
Rspamd 3.11.1 adds Ollama/LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. consensus, Redis caching framework, RBLRBLA DNS-based blocklist of IP addresses known to send spam or host malicious traffic, maintained by various operators, used by cyber tools to reject or flag connections from listed sources at lookup speed. disable-via-map, and expanded fake-reply detection.
└──▷ GET THIS VERSION
$ git clone --branch 3.11.1 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:$ git checkout 3.11.1
Adds Ollama support to the GPT plugin, enabling local LLM-based spam analysis without external APIs.
Supports LLM model consensus, allowing multiple LLM models to vote on a message classification.
Enables LLM usage for anonymization of message content before external analysis.
Adds optional suppression of response_format in the GPT plugin to support gpt4all and compatible local models.
Adds GPT plugin support for attaching model reasoning to scan results.
+10 moreshow less
Introduces a Redis caching framework for use across modules, with the GPT module as the first consumer.
Adds a noop Redis backend for running scripts without actual Redis I/O.
Allows RBL (real-time blocklist) rules to be disabled dynamically via a map.
Allows multiple Lua scripts to be loaded for fuzzy storage processing.
Expands detection of fake reply subjects to multiple languages.
Adds the ability to create timers from Lua scripts.
Allows shingles to be stored as opaque Lua data for custom processing.
Adds early map refresh logic when a map's expiry is unexpectedly long.
Adds images as a supported check type in RBL check_types configuration.
Respects per-map ipv4 and ipv6 configuration options for RBL resolve_ip.
Snort3 3.7.2.0 adds a unix domain connector, packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. limits, multiprocess databus framework, and AppID out-of-order packet inspection.
└──▷ GET THIS VERSION
$ git clone --branch 3.7.2.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.7.2.0
Adds flag to inspect out-of-order packets in AppID, improving detection coverage for reordered traffic.
New unix domain connector in the connectors module enables inter-process communicationinter-process communicationInter-process communication, ways for separate programs to exchange data or signals. Examples include pipes, sockets and shared memory. over local sockets.
Supports packet capture limit and location configuration in packet_capture, giving operators control over capture size and destination.
Introduces a basic multiprocess databus framework with skeleton APIs in pub_sub, laying the groundwork for multi-process event sharing.
Adds packet dump to unified2 events for reassembled UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. packets, enriching logged event data.
+3 moreshow less
Includes PID in dump_config output file names, making it easier to identify per-process config dumps.
Passes packet data in DnsResponseEvent, enabling richer DNS event handling in pub/sub consumers.
Initializes OpenSSL at startup in the main process, ensuring TLS-related capabilities are available from launch.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!stream_tcp: OS policy names are renamed to prevent conflict with existing macros — configurations referencing old policy names will break.
1 more release in this issue
· 2025-03-12 → 2025-03-31
Detects domain fronting events and shadow traffic evasive VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. & multihop proxy techniques via AppID.
Adds general AppID support for encrypted DNS traffic.
Adds DNS support to the extractor module for richer log output.
Adds configurable time formatting in extractor loggers.
Adds tenant ID as a common field across extractor output.
+10 moreshow less
Adds file name and MIME type fields to extractor output.
Adds partial download information to FileInfo via file_api and http_inspect.
Generates file events for asymmetric flows in file_api.
Allows toggling generation of instance_map output from the main module.
Adds an option for setting NUMA memory policy in thread configuration.
Renames the kaizen network inspector to snort_ml, now building models into a BinaryClassifierSet.
Adds IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. rule events for the extractor via pub_sub.
Adds a numactl version check to the build system.
15 details in Everything
└──▷ BREAKING ON UPGRADE
!The kaizen network inspector is renamed to snort_ml; any configuration referencing kaizen will break on upgrade.
CrowdSec v1.6.6 adds centralized allowlists, JA4H fingerprinting, mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with./custom CA for databases, and new AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. expr helpers.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.6 https://github.com/crowdsecurity/crowdsec.git
# already have the repo? check out this version:$ git checkout v1.6.6
└──▷ HOW TO FIND IT
Enable centralized allowlists from the CrowdSec console so a trusted IP is exempted across all LAPI-connected agents without touching individual machines.
📍In the console, go to Allowlists and create a new allowlist entry (IP, range, or country). It will be automatically pulled by LAPI and applied to local decisions, AppSec rules, and blocklists.
Add mTLS and a custom CA for a PostgreSQL database connection to harden LAPI-to-database communication.
Adds centralized allowlists managed via LAPI or the console, automatically applied to local decisions, AppSec rules, and blocklists without per-machine deployment.
Adds JA4H expression helper for AppSec to compute JA4H fingerprint hashes for HTTP requests.
Adds custom CA and mTLS authentication support for PostgreSQL and MySQL database connections via new SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. options in db configuration.
Adds ExtractQueryParam expression helper (alongside relocated ParseQuery) for use in AppSec and parsing rules.
Adds enable/disable options for console enrollment; makes alert context a default enrollment option.
+2 moreshow less
Adds option to disable magic syslog RFC parsers.
Adds parallel hubtest execution for faster hub testing workflows.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!capi_whitelists_path is deprecated; users should migrate to centralized allowlists.
$ git clone --branch v25.03.1 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v25.03.1
└──▷ USE IT
Restrict Keycloak-authenticated logins to users belonging to a specific group and role, preventing access by users who authenticate but lack the required membership.
Adds NGINX_REQUIRE_GROUP and NGINX_REQUIRE_ROLE to auth-common.env to enforce Keycloak group or role membership restrictions on login.
Incorporates new S7comm device identification log, s7comm_known_devices.log, for OT/ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. device tracking.
Displays current PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic., Zeek, and Suricata capture results in Hedgehog Linux Kiosk mode.
Marks newly-discovered and uninventoried devices in logs during NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. enrichment.
Adds 'Apply recommended system tweaks automatically without asking for confirmation?' prompt to install.py, enabling unattended acceptance of sysctl.conf and grub kernel parameter changes.
5 details in Everything
1 more release in this issue
· 2025-03-18 → 2025-03-28
Malcolm v25.03.0 adds Keycloak SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management./IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. authentication alongside existing local and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. auth methods.
└──▷ GET THIS VERSION
$ git clone --branch v25.03.0 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v25.03.0
└──▷ TRY IT
Back up the NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. database before upgrading to v25.03.0 to protect inventory data during the PostgreSQL migration.
$ ./scripts/netbox-backup
Adds NGINX_AUTH_MODE (replacing NGINX_BASIC_AUTH) in auth-commmon.env to select the authentication mode, with backwards-compatible handling of previously-accepted values.
Adds keycloak.env to configure Keycloak authentication for Malcolm.
Renames nginx-postgres to postgres.env and overhauls its variables to support the now-independent PostgreSQL container.
Adds new environment variables to nginx.env to support Keycloak/OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. integration.
Removes NETBOX_POSTGRES_DISABLED from netbox-common.env as PostgreSQL is now a standalone service.
+4 moreshow less
Adds Keycloak as a supported authentication provider, enabling SSO and IAM-backed access via an existing or embedded Keycloak instance.
Decouples the postgres container from NetBox so it runs as an independent service, now also backing the embedded Keycloak instance.
Replaces the internal NGINX web server with OpenResty (NGINX extended with Lua) to support the lua-resty-openidcOpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Connect library.
Changes ./wipe behavior so it no longer deletes PostgreSQL data (NetBox inventory and embedded Keycloak data).
9 details in Everything
└──▷ BREAKING ON UPGRADE
!NGINX_BASIC_AUTH is renamed to NGINX_AUTH_MODE in auth-commmon.env; automatic migration via config/env-var-actions.yml is provided but must be triggered by running ./scripts/status before starting Malcolm.
!nginx-postgres.env is renamed to postgres.env and its variables are completely overhauled; automatic migration is provided but manual NetBox database backup via ./scripts/netbox-backup is strongly recommended before upgrading.
!NETBOX_POSTGRES_DISABLED is removed from netbox-common.env; any configuration referencing this variable will silently have no effect after upgrade.
Inspektor Gadget v0.38.0 adds user stack traces, a qdisc latency profiler, DNS-over-TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. tracing, and a new env-var field operator.
└──▷ GET THIS VERSION
$ git clone --branch v0.38.0 https://github.com/inspektor-gadget/inspektor-gadget.git
# already have the repo? check out this version:$ git checkout v0.38.0
└──▷ TRY IT
Profile queueing discipline latency on a node to diagnose network throughput bottlenecks in containerised workloads.
$ ig run ghcr.io/inspektor-gadget/gadget/profile_qdisc_latency:latest
Adds initial support for user-space stack traces in eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. gadgets.
New qdisc_latency tracer gadget profiles network queuing discipline latency.
Supports DNS tracing over TCP (without packet reassembly) in trace_dns.
New env operator enables creating new data fields from environment variables in gadget pipelines.
Adds getSyscallID()WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. host function to look up a syscall ID by name from guest gadgets.
+4 moreshow less
Expands trace_capabilities gadget support to Linux kernels older than 6.1.
Allows overriding OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. export key/name via the otel operator.
Warns the user when a gadget is run against a mismatched Inspektor Gadget version.
Displays fsnotify external API masks as human-readable strings instead of raw integers.
Trivy is a comprehensive security scanner that finds vulnerabilities, misconfigurations, secrets, and SBOM in containers, Kubernetes, code repositories, and clouds
Trivy 0.61.0 adds k8s controller scanning, aws_ami misconf support, and WebAssemblyWebAssemblyA binary instruction format that runs in browsers and server runtimes at near-native speed, letting developers compile C, Rust, or other languages into a portable, sandboxed module any compliant host can execute. rebuild.
└──▷ GET THIS VERSION
$ git clone --branch 0.61.0 https://github.com/aquasecurity/trivy.git
# already have the repo? check out this version:$ git checkout 0.61.0
k8s: add support for controllers
1 detail in Everything
1 more release in this issue
· 2025-03-05 → 2025-03-28
Trivy 0.60.0 adds --vuln-severity-source CLI flag and external VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. file loading for CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence.SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
└──▷ GET THIS VERSION
$ git clone --branch 0.60.0 https://github.com/aquasecurity/trivy.git
# already have the repo? check out this version:$ git checkout 0.60.0
Adds --vuln-severity-source flag to control which vulnerability severity source is used in scans
Add initial support for loading external VEX files from SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. references in CycloneDX reports
Grype v0.90.0 adds URL-based DB import, distro-name vulnerability matching, and DB URL in JSON output.
└──▷ GET THIS VERSION
$ git clone --branch v0.90.0 https://github.com/anchore/grype.git
# already have the repo? check out this version:$ git checkout v0.90.0
└──▷ TRY IT
Import the Grype vulnerability DB directly from a remote URL instead of a local file — useful in air-gapped pipelines where you host the DB on an internal server.
$ grype db import https://internal.example.com/grype-db.tar.gz
Matches vulnerabilities by distro name even when no distro version is specified.
Supports importing the vulnerability database directly from a URL via grype db import.
Adds the database URL to the JSON descriptor block in scan output.
3 details in Everything
1 more release in this issue
· 2025-03-05 → 2025-03-17
Grype v0.88.0 adds KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use./EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. data to v6 DB, a pretty output format, literal CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. input, and configurable Maven rate limiting.
└──▷ GET THIS VERSION
$ git clone --branch v0.88.0 https://github.com/anchore/grype.git
# already have the repo? check out this version:$ git checkout v0.88.0
└──▷ TRY IT
Find all vulnerabilities published or modified after a specific date, replacing the old grype db diff workflow.
$ grype db search --published-after 2025-01-01
Get a human-readable scan report instead of the default table output.
$ grype <image> -o pretty
Adds CISA Known Exploited VulnerabilitiesCISA Known Exploited VulnerabilitiesA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing CVEs confirmed to have been actively exploited in the wild, which cyber tools use as a high-signal prioritization feed for patching and scanning. (KEV) information to the v6 vulnerability database.
Adds KEV and EPSS fields to grype db search schema for richer vulnerability querying.
New pretty output format option for human-friendly scan results.
Allows specifying literal CPEs directly on the CLI as scan targets.
Adds configuration for Maven Central rate limit handling.
+3 moreshow less
Replaces grype db diff with grype db search --modified-after and --published-after flags for filtering vulnerability changes.
Migrates database listing URL from https://toolbox-data.anchore.io/grype/databases/listing.json to https://grype.anchore.io/databases/v6/latest.json.
Updates vulnerability matchers to use the v6 DB schema.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!grype db diff has been removed; use grype db search --modified-after and --published-after flags instead.
!DB schema v3 and v4 code has been removed; databases using those schemas are no longer supported.
!The database listing URL has migrated from https://toolbox-data.anchore.io/grype/databases/listing.json to https://grype.anchore.io/databases/v6/latest.json; any tooling or config hardcoding the old URL must be updated.
cilium-cli v0.18.1 adds a kubeconfig option to the GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. integration.
└──▷ GET THIS VERSION
$ git clone --branch v0.18.1 https://github.com/cilium/cilium-cli.git
# already have the repo? check out this version:$ git checkout v0.18.1
Adds --kubeconfig option to the gh command, enabling users to specify a custom kubeconfig path.
Publish a Compose stack as an OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. artifact to a registry for remote reuse.
kata-containers 3.15.0 adds guest swap support, IOMMUFD GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. enhancements, and genpolicy sysctl/Route rules
└──▷ GET THIS VERSION
$ git clone --branch 3.15.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:$ git checkout 3.15.0
Adds AddGuestSwap configuration option to confidential_guest.toml.in for enabling guest-side swap support
Adds UpdateRoutesRequest rules to genpolicy-settings allowing dynamic route updates inside the container policy
Adds UpdateInterfaceRequest rules to genpolicy-settings allowing dynamic interface updates inside the container policy
Enables IOMMUFD GPU support in QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. via experimental updates and module signing
Adds genpolicy support for reading sysctls from PodSpec and environment defaults
+3 moreshow less
Allows SNP_IDBlock configuration in runtime config to make Secure Nested Paging ID blocks adjustable
Enables Dragonball sandbox runtime exclusively on x86_64 and aarch64 architectures
Adds guest network route updates via new route flags support in the kernel agent
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Dragonball sandbox runtime is now restricted to x86_64 and aarch64 architectures only; other platforms will not build or run with it
!s390x conditional compilation has been removed from runtime-rs, changing build targets for that architecture
Adds 4 new Microsoft 365 SharePoint checks: sharepoint_external_sharing_managed, sharepoint_external_sharing_restricted, sharepoint_guest_sharing_restricted, and sharepoint_modern_authentication_required.
Adds new Entra check entra_policy_ensure_default_user_cannot_create_tenants for Microsoft 365.
Adds 6 new compliance frameworks: AWS ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001 2022, Azure PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. 4.0, Kubernetes PCI DSS 4.0, GCP PCI DSS 4.0, AWS PCI DSS 4.0, and AWS CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. 4.0.
API scan report system now generates compressed reports in OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work., CSV, and HTML formats for all API-launched scans.
Adds social login integration with Google and GitHub to the API.
+3 moreshow less
Adds configurable Sentry integration to the API.
New sidebar and layout in the UI, with real-time scan progress animation and Prowler version display.
Status extended field added to finding details in the UI.
cloud-nuke v0.40.0 adds IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. instance profile nuking and automatic deletion-protection bypass.
└──▷ GET THIS VERSION
$ git clone --branch v0.40.0 https://github.com/gruntwork-io/cloud-nuke.git
# already have the repo? check out this version:$ git checkout v0.40.0
└──▷ TRY IT
Nuke only IAM instance profiles in a sandbox account to clean up leftover EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. role associations.
Adds support for nuking AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. instance profiles as a targetable resource type.
Automatically disables deletion protection on supported resources before nuking, unblocking previously protected resources.
2 details in Everything
1 more release in this issue
· 2025-03-19 → 2025-03-29
eksctl v0.206.0 adds IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permission boundary support for Auto Mode Node Role and defaults to Kubernetes 1.32.
└──▷ GET THIS VERSION
$ git clone --branch v0.206.0 https://github.com/weaveworks/eksctl.git
# already have the repo? check out this version:$ git checkout v0.206.0
Supports specifying an IAM permission boundary for Auto Mode's Node Role in cluster config.
Defaults to the newest Kubernetes 1.32 version when creating clusters.
Adds support for EKS internal environments.
Adds support for the i8g.48xlarge EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instance type.
Tetragon is an eBPF-based security observability and runtime enforcement tool for Kubernetes and cloud-native environments.
Tetragon v1.4 adds ancestor tracking in process events, CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. filters, monitoring mode for tracing policies, and Windows build support.
└──▷ GET THIS VERSION
$ git clone --branch v1.4.0 https://github.com/cilium/tetragon.git
# already have the repo? check out this version:$ git checkout v1.4.0
└──▷ TRY IT
Run two Tetragon operator replicas with leader-election failover to reduce downtime during upgrades.
Adds ancestor process information to process events, giving full lineage context for every observed action.
Adds attribute resolution in tracing policies for richer event enrichment.
Adds a monitoring mode for tracing policies, allowing policies to observe without enforcing.
Adds CEL filter support to the tetra CLI for client-side event filtering.
Adds support for struct socket and struct sockaddr as argument types in tracing policies.
+7 moreshow less
Adds tetra policyfilter listpolicies command to list active policy filters.
Adds map_errors_update_total and map_errors_delete_total metrics replacing the former tetragon_map_errors_total.
Adds Helm values cri.enabled, cri.socketHostPath, and cgidmap.enabled for CRI socket configuration and cgroup-ID mapping, with accompanying metrics for cgidmap CRI resolution.
Supports running multiple Tetragon operator replicas simultaneously via tetragonOperator.replicas and tetragonOperator.failoverLease.enabled.
Removes the deprecated gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. sensors API.
Allows extending ClusterRoles and operator ConfigMap via Helm.
Begins Windows build support for Tetragon (Part -1).
12 details in Everything
└──▷ BREAKING ON UPGRADE
!The tetragon_map_errors_total metric is replaced by map_errors_update_total and map_errors_delete_total; any dashboards or alerts referencing the old metric name will break.
!The deprecated gRPC sensors API is now removed; any client code calling those endpoints will break.
!The default toleration (operator: Exists) for the operator Deployment has been removed; operator pods that relied on this toleration to schedule on tainted nodes will no longer do so automatically.
Firejail 0.9.74 adds Landlock support, QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking./HTTP3 nettrace, random sandbox hostnames, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. net.print, and aarch64 syscalls.
└──▷ GET THIS VERSION
$ git clone --branch 0.9.74 https://github.com/netblue30/firejail.git
# already have the repo? check out this version:$ git checkout 0.9.74
└──▷ TRY IT
Override the auto-assigned random sandbox hostname to a predictable name for scripted environments.
Adds QUIC (HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer.) protocol support in --nettrace for visibility into modern encrypted traffic.
Adds stats collection support to --nettrace.
Adds IPv6 support for the --net.print option.
Assigns a random hostname to each sandbox by default unless overridden with --hostname.
Adds new keep-shell-rc command and option to preserve shell RC files inside the sandbox.
+11 moreshow less
Adds seccomp filters for --restrict-namespaces to harden namespace restriction.
Adds doas support in firecfg and jailcheck alongside existing sudo support.
Adds firecfg.d drop-in directory and new ignore command to firecfg for modular configuration overrides.
Expands simple macro expansion to --chroot=, --netfilter=, --netfilter6=, and --trace= options.
Adds support for comm, coredump, and prctl process events in firemon.
Adds notpm command and keeps TPMTPMA dedicated hardware chip, standardized by the Trusted Computing Group, that stores cryptographic keys and measurements in tamper-resistant silicon, giving cyber tools a root of trust that software alone cannot fake. devices accessible in private-dev.
Adds keep-dev-ntsync command and blocks /dev/ntsync by default.
Adds aarch64 syscall definitions for seccomp filtering on ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead..
Adds --disable-sandbox-check configure flag to skip sandbox capability checks at build time.
Adds private-etc groups support and improves /etc/resolv.conf handling in private-etc.
Adds NixOS support for tc traffic shaping in fshaper.sh.
16 details in Everything
└──▷ BREAKING ON UPGRADE
!The --interface option is removed from firemon; use firejail --net.print= instead.
!Support for LTS and firetunnel is removed.
!private-lib is now disabled by default at configure time; re-enable with --enable-private-lib.
!Sandbox names (--name=) and hostnames (--hostname=) may no longer consist entirely of digits, and are now restricted to mostly ASCII letters and digits.
!Firejail no longer forwards its own -- double-dash to the shell.
ESET PROTECT 6.2 adds Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., critical asset management via wizard, incident export to CSV/Syslog, and pre-defined FDE passwords.
Adds single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. with domain credentials via Microsoft Entra ID for ESET PROTECT Hub accounts
Enables defining critical assets via the Set up protection wizard (ESET MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. customers)
Adds a new column in the Computers section to identify critical assets (ESET MDR customers)
Allows suppression of response actions on critical assets via the Set up protection wizard (ESET MDR customers)
Introduces new Status Overview dashboard widgets for active incidents and their impact
+3 moreshow less
Adds option to export incident lists to CSV (gradual release)
Adds option to export incident-related logs to Syslog (gradual release)
Supports setting a pre-defined password when deploying ESET Full Disk Encryption via Tasks
Template Scanner API adds direct .zip upload for Terraform HCL via cloudPosture/scanTemplateArchive
Adds the cloudPosture/scanTemplateArchive endpoint to POST a .zip archive of Terraform HCL templates directly, removing the need to generate intermediate JSON plan files.
Enables scanning of native Terraform .tf files contained within a .zip via the new API endpoint.
2 details in Everything
21 more releases in this issue
· 2025-03-03 → 2025-03-31
New Cyber Risk Exposure Management pricing tiers introducing core, essentials, and cloud assessment packages with specific capability sets
Introduces Cyber Risk Exposure Management - Core package providing 20 credits per assessed desktop or server to use Cyber Risk Overview, Attack Surface Discovery, Threat and Exposure Management, and Identity Security Posture without limitations
Adds Cyber Risk Exposure Management - Essentials package option with 50 credits per assessed desktop or server, unlocking Attack Path Prediction, Security Awareness Training, and Compliance Management
Enables cloud account assessment capability allowing inclusion of cloud assets in Cyber Risk Exposure Management via a consumption model of 1,000 credits per 500 cloud resources (max 8,000 credits)
Trend Vision One introduces Microsoft 365 data source and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management support with misconfiguration and compliance violation detections.
Adds collection of new data types for SaaS Security Posture Management features, including misconfigurations and compliance violations
Zero Trust Secure Access module for Windows 2.20.1043 adds ZTNP connector resilience, TrendAI integration, and PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. proxy support.
Supports ZTNP connector resilience
Supports displaying endpoint connector information in TrendAI Vision One™
Supports common proxy in the PAC file (using neither cloud gateway proxy or on-premises gateway proxy)
ZTSAZTSAZero Trust Security Architecture: a network access model where no user or device is trusted by default, requiring continuous verification before granting access, letting cyber tools enforce least-privilege policies across any environment. macOS v2.17.920 adds ZTNP resilience, TrendAI connector info display, and improved debug logs
Supports ZTNP connector resilience to maintain connectivity during disruptions.
Adds support for displaying endpoint connector information in TrendAI Vision One™.
Trend Vision One introduces AI Security Posture Management (AI-SPMAI-SPMAI Security Posture Management: a discipline for continuously discovering, assessing, and remediating risks across AI pipelines, models, and data, giving cyber tools a structured way to govern AI infrastructure the way CSPM governs cloud.) in preview.
Adds AI Security Posture Management (AI-SPM) as a new feature for proactive protection and comprehensive monitoring of AI infrastructure.
Rogue Apps GA enables detection and remediation of Traitorware and Stealthware in Microsoft tenants via a new dashboard.
Enables automatic disabling of Traitorware (frequently abused legitimate apps) and Stealthware (rare, high-permission unknown apps) in Microsoft tenants.
Adds detection and remediation logic that disables identities with permissions delegated to identified Rogue Apps.
2 details in Everything
1 more release in this issue
· 2025-03-14 → 2025-03-19
Partner account admins can now enable or disable Managed EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. and SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. products for individual organizations.
Exabeam March 2025 adds Mimecast/Sophos/STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form.-TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. collectors, Exabeam Nova AI, and Threat Center sorting/filtering.
Adds Mimecast Cloud Collector with support for Archive Search Logs, TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. Attachment Protection Logs, TTP Impersonation Protect Logs, TTP URL Logs, SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Logs, Archive Message View Logs, and Audit Events
Adds REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. Cloud Collector to facilitate data collection from REST API endpoints
Adds Sophos Cloud Collector for alerts and events data sources
Adds Event Exploration on Search via Cloud Collectors with an Open in Search option to view prepopulated queries
Adds Cloudflare, Google Workspace, LastPass, Vectra, STIX/TAXIISTIX/TAXIISTIX is an OASIS-maintained JSON schema for expressing threat intelligence objects; TAXII is the companion HTTP protocol for exchanging them, giving cyber tools a vendor-neutral way to share indicators and threat data., and Recorded Future Context Cloud Collectors in Early Access
+14 moreshow less
Adds STIX/TAXII Context Tables in Context Management for processing threat intelligence data
Adds a Scheduled Reports tab in the Dashboards application with Run Now, Edit, Duplicate, and Delete controls
Adds ability to add descriptive child names in the Multi-Org Console
Introduces Exabeam Nova, an agentic AI tool for automating investigative tasks
Adds Coverage Summaries with Use Case Coverage Score and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. Coverage Scores in Outcomes Navigator
Extends Data Insights availability to users with any Exabeam Security Operations licenses
Enhances Entity Search with support for full name or any username/email address and new tooltips
Adds Windows Server 2025 and Windows Server 2025 Core support for Agent Collectors
Enhances Threat Center with Exabeam Nova Analyst Assistant using the 50 most recently grouped detections
Adds Created, Queue, and Assignee columns to Threat Center cases
Adds sorting by Grouped By, Stage, Queue, and Assignee in Threat Center
Adds filtering capabilities for cases (priority, grouped by value, stage, queue, assignee) and alerts (priority, grouped by value)
Increases Notes character limit to 4,000 in Threat Center
Shows full name of the rule type in the Threat Timeline
Public Preview allows disabling legacy Hive metastoreHive metastoreA central metadata repository, part of the Apache Hive project, that stores schema and location information for distributed data sets so query engines can discover and read structured data without hardcoding paths. direct access to enforce Unity Catalog governance
Adds the ability to disable direct access to the legacy Hive metastore in a Databricks workspace as a Public Preview feature.
Enforces that all data access and governance for the workspace flows through Unity Catalog once the legacy metastore is disabled.
2 details in Everything
20 more releases in this issue
· 2025-03-04 → 2025-03-31
Databricks Apps audit logging now captures createApp, installTemplateApp, updateApp, startApp, stopApp, deployApp, and deleteApp events in Public Preview.
Adds CAN VIEW permission for SQL warehouses in public preview to allow monitoring without query execution.
Adds the CAN VIEW permission type for SQL warehouse access control lists, enabling users to monitor query history and profiles without executing queries.
Mosaic AI Gateway adds governance and monitoring features for pay-per-token endpoints.
Enables permission and rate limiting on Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves. pay-per-token endpoints
Adds payload logging via inference tables to monitor data sent to model APIs
Adds usage tracking via system tables to monitor operational usage and costs
OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. federation for Databricks-to-open Delta Sharing allows recipients to use their own IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.
Databricks GA adds Hive metastoreHive metastoreA central metadata repository, part of the Apache Hive project, that stores schema and location information for distributed data sets so query engines can discover and read structured data without hardcoding paths. federation with support for HMS 3.1, Postgres/SQL Server metadata stores, row/column masking, Delta shallow clones, and cross-workspace DBFS
Adds Hive metastore 3.1 as a supported version for Hive metastore federation
Adds Postgres and SQL Server as supported metadata stores for Hive metastore federation (in addition to MySQL)
Enables applying row filters and column-level masks to Hive tables accessed via Hive metastore federation
Adds preview support for reading Delta shallow clones defined in the Hive metastore
Adds private preview support for reading DBFS-mount-backed tables across workspaces
Genie Conversations API enters Public Preview, enabling question-asking and SQL generation via REST.
Genie Conversation API is now in Public Preview, allowing users to ask questions, retrieve generated SQL and query results, or get details associated with a Genie Space using the Databricks REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
Databricks JDBCJDBCA Java standard API for connecting applications to relational databases, maintained as part of the Java SE platform, letting tools query any compliant database through a single consistent interface. Driver v3 is generally available and will soon be open source
GA release of the new Databricks JDBC Driver version 3 via Maven Repository
Databricks Mosaic AI now supports batch inference via AI Functions (Public Preview), enabling deployment of pipelines and transformation of unstructured data.
Step Runner 25.03.6 adds CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./memory metrics in Docker diagnostics and optimized K8s pod deletion
Adds cpu and memory usage metrics to Docker diagnostics output for better monitoring
Optimizes Kubernetes pod deletion to remove pod collections without requiring an initial pod list
Shuffle 2.0.1 adds self-service region switching, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. credential hiding, and role assignment from SSO providers.
└──▷ GET THIS VERSION
$ git clone --branch v2.0.1 https://github.com/Shuffle/Shuffle.git
# already have the repo? check out this version:$ git checkout v2.0.1
└──▷ HOW TO FIND IT
Switch your cloud region without waiting for support — useful when moving tenants closer to your data residency requirements.
📍In the console, go to shuffler.io/admin and select your desired region under the region settings panel.
Enables self-service cloud region changes via the /admin panel — no support ticket required.
Adds credential hiding on the SSO page for Organizations.
Supports role assignment synced from SSO providers on login.
Improves control of Forms for Workflows.
4 details in Everything
1 more release in this issue
· 2025-03-03 → 2025-03-21
Open-sources the scale worker, making distributed execution infrastructure available for self-hosted deployments.
New UI with redesigned app page, workflow page, and discovery mechanisms.
Adds Sigma detection UI for managing and visualizing Sigma rules directly in the platform.
New API endpoint for hotloading specific applications without restarting the service.
+12 moreshow less
Adds auto-scale support for on-prem worker deployments.
Heavily improved observability across workflow executions.
Adds Datastore Categorization (indexing) for structured data organization.
Adds Forms and Publishing mechanisms for workflow interaction and distribution.
Docker Compose now uses Docker Swarm by default for on-prem deployments.
Adds official Shuffle Helm chart for Kubernetes deployments.
Mounts TLS certificates to each worker container automatically.
Adds window-swapping feature in the workflow editor UI.
Variable fields in action parameters now update dynamically in the workflow editor.
Adds branch direction flipping in the workflow canvas.
Adds UI tooltips across the workflow editor.
Syncs on-prem feature pages with cloud feature parity.
17 details in Everything
└──▷ BREAKING ON UPGRADE
!Docker Compose is now configured to use Docker Swarm by default, which may break existing non-Swarm on-prem deployments that rely on plain Compose orchestration.
Tines 30.0 introduces Workbench containers, gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. support, new formula functions, and scoped tags.
└──▷ HOW TO FIND IT
Send an HTTP request including the original URL's query parameters
📍HTTP Request Action with Query params option enabled
Adds GROUP_BY support for LAMBDA expressions in change control draft details
Adds configurable columns on the Stories table via UI preferences
Adds IN_CIDR function that now takes an array of addresses
Adds TO_SNAKE_CASE function supporting conversion from camel case
Adds IS_YAML strict mode for validation
+21 moreshow less
Adds support for gRPC requests in actions
Adds Records action with list mode
Adds CAMELIZE formula function
Adds Amazon Nova models availability in the AI action
Adds new Claude 3.7 Sonnet model powered by Workbench
Adds Team scoped tags for resource organization
Adds detachable change request modal UI element
Adds Slider element for pages layout
Adds Query params option for HTTP Request Action
Adds Capture raw body option for Webhooks
Adds Edit workbench presets capability
Adds Share workbench conversations feature
Adds Case file attachment block for Cases UI
Adds Cases block API endpoints for programmatic access
Adds Events search: scroll through results in Workbench
Adds ability to refer to URL query parameters in pages
Adds Send to story action featuring the story icon
Beelzebub v3.3.11 adds matched-command logging, regexp precompilation, HistoryStore TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. cleanup, and a memory-limit flag.
└──▷ GET THIS VERSION
$ git clone --branch v3.3.11 https://github.com/mariocandela/beelzebub.git
# already have the repo? check out this version:$ git checkout v3.3.11
└──▷ TRY IT
Cap honeypot memory usage in a resource-constrained environment such as a small VPS or container.
$ beelzebub --memLimitMiB 256
Logs which command pattern was matched for SSH and HTTP honeypot strategies, giving practitioners visibility into attacker inputs.
Precompiles regular expressions at config load time, surfacing misconfigured patterns at startup rather than silently at runtime.
Adds an automatic cleanup routine for HistoryStore with a default 1-hour TTL since last interaction, bounding memory growth from long-running honeypot sessions.
New memLimitMiB flag (default: 100 MiB) lets operators cap the process memory footprint at launch.
4 details in Everything
4 more releases in this issue
· 2025-03-01 → 2025-03-23
Beelzebub v3.3.9 keeps SSH LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. honeypot sessions alive after an attacker logs out.
└──▷ GET THIS VERSION
$ git clone --branch v3.3.9 https://github.com/mariocandela/beelzebub.git
# already have the repo? check out this version:$ git checkout v3.3.9
Preserves SSH LLM honeypot session state after an attacker logs out, enabling continuous observation across reconnections.
Beelzebub v3.3.7 adds multi-platform Docker images and structured JSON serialization of HTTP headers in logs.
└──▷ GET THIS VERSION
$ git clone --branch v3.3.7 https://github.com/mariocandela/beelzebub.git
# already have the repo? check out this version:$ git checkout v3.3.7
Adds multi-platform Docker image support, enabling deployment on non-amd64 architectures.
HTTP request headers are now serialized as structured JSON in log output, improving log parsing and SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. ingestion.
Tenzir is a data pipeline engine for security teams that collects, transforms, enriches, and routes telemetry.
Tenzir v4.31.0 adds if … else expressions, short-circuiting, from_opensearch and write_syslog operators.
└──▷ TRY IT
Safely access a field that may not exist without triggering warnings via short-circuit evaluation.
$ where this.has("foo") and foo == 42
Adds if <expr>, <expr> if <pred> and <value> if <pred> else <fallback> conditional expressions in queries.
Adds and / or short-circuit evaluation to skip unnecessary right-hand side checks.
Adds the from_opensearch operator as an OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions.-compatible REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. source for tools like Filebeat and Winlogbeat.
Adds the write_syslog operator to format events as syslog messages.
4 details in Everything
4 more releases in this issue
· 2025-03-03 → 2025-03-31
Tenzir v4.30.0 adds ClickHouse sink operator, TQL2 GCloud support, pipeline metrics and global CA cert config
Adds to_clickhouse operator to send events to ClickHouse
Port load_gcs and save_gcs operators to TQL2 for Google Cloud Storage interaction
Introduce assert_throughput operator to check minimum pipeline throughput
Add global cacert config option in Tenzir config for all TLS operators
Introduce metrics "pipeline" to view ingress and egress of every pipeline
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The skip_host_verification option has been removed from the load_http, save_email and save_http operators; its functionality is now in skip_peer_verification
!metrics "operator" is deprecated; use metrics "pipeline" instead
Adds DR_CLI_MAX_WIDTH env var, Min Stack ML rules, and investigation guide generation to the detection-rules cli.
└──▷ GET THIS VERSION
$ git clone --branch dev-v1.0.0 https://github.com/elastic/detection-rules.git
# already have the repo? check out this version:$ git checkout dev-v1.0.0
Adds the DR_CLI_MAX_WIDTH environment variable to control CLI output width
Adds new machine learning detection rules for Privileged Access Detection with Min Stack integration
Splunk Security Content v5.2.0 adds 43 new detections across GitHub, O365, and SQL Server, plus 6 new analytic stories.
└──▷ GET THIS VERSION
$ git clone --branch v5.2.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v5.2.0
New GitHub Malicious Activity analytic story with detections for disabling 2FA requirements, pausing/modifying audit log streams, deleting repositories, disabling Dependabot and branch protection rules, and registering unauthorized self-hosted runners.
New SQL Server Abuse analytic story with detections for malicious SQLCMD execution, xp_cmdshell config changes, unauthorized SQL Server configuration changes, startup procedures, and dangerous extended procedure DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. loading.
New analytic stories mapped to Black Basta Ransomware, SnappyBee, and SystemBC malware families.
New China-Nexus Threat Activity analytic story added.
+3 moreshow less
Adds 5 new macros: github_enterprise, github_organizations, o365_messagetrace, o365_suspect_search_terms_regex, and process_sqlcmd.
Adds 2 new lookups: deprecation_info and windows_suspicious_tasks.
Deprecated detections from v5.0.0 announcement are now removed starting in v5.2.0, with a published replacement list on Splunk docs.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Several detections previously marked for deprecation in ESCU v5.0.0 have been removed in v5.2.0; see the full list and replacements at https://docs.splunk.com/Documentation/ESCU/5.2.0/user/DeprecatedAnalytics#List_of_removed_detections_in_ESCU_version_5.2.0
Feedly Threat Intelligence adds Ask AI for report synthesis, AI in Automated Newsletters, and a revised sidebar.
Adds Ask AI capability to synthesize up to 25 threat reports and articles in multiple languages, extracting IoCs, TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., and actionable insights
Integrates AI generation into Automated Newsletters to help deliver clear, actionable threat intelligence content
Replaces the previous dock with a revised, more flexible sidebar for personalized experience
$ git clone --branch 3.4.0 https://github.com/certtools/intelmq.git
# already have the repo? check out this version:$ git checkout 3.4.0
Adds intelmq.bots.experts.securitytxt expert bot for processing security.txt files
Adds intelmq.bots.experts.fake.expert bot to generate fake data for testing
Renamed Twitter parser to IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Extractor Parser (intelmq.bots.parsers.ioc_extractor) with backwards-compatible stub at intelmq.bots.parsers.twitter
Adds Ubuntu 24.04 package support
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Drops compatibility with Python versions older than 3.8
MISP v2.5.8 adds new workflow modules, reworked attribute search with query-string support, and smarter event sync distribution handling.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.8 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.8
└──▷ HOW TO FIND IT
Allow a remote MISP instance's internal-distribution events to be pulled without distribution downgrade, by granting the remote sync user the perm_sync_internal permission.
📍In the MISP UI, go to Administration › List Users, edit the remote sync user, and enable the perm_sync_internal permission under Role settings.
Adds filter-tag workflow module to filter data based on tags.
Adds notify_user_toast workflow module to create in-app notification toasts for users.
Adds add_analyst_data workflow module to create analyst data directly from workflows.
Adds CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. and highlighting support for relationship_types in object relationships.
Adds a new default distribution setting for galaxies.
+7 moreshow less
Adds remove_missing_tags support on the Event level during pull synchronisation.
Adds perm_sync_internal flag so internal-instance pulls no longer downgrade distribution — the remote instance now controls distribution decisions.
Major rework of attribute search: parameters now passable as query strings, search form converted to GET, results easily downloadable, pagination improved, and behaviour made consistent with restsearch.
Adds event-report filtering support to the if-tag workflow module.
Adds display of the number of events to be synced when testing sync rules on the server index.
Adds support for the highlighted field in object-relationship /add and /edit endpoints.
Adds support for more HTML attributes in workflow editor form inputs.
MISP v2.4.206 adds new workflow modules, reworked attribute search, and improved sync permission controls.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.206 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.4.206
└──▷ HOW TO FIND IT
Test a sync connection and immediately see how many events would be pulled, helping you validate sync rules before committing.
📍In the MISP UI, go to Administration › Servers, select a remote server, and click Test — the result now includes the count of events that would be synced under the current sync rules.
Pull events from a remote instance marked as an internal instance without having their distribution level downgraded, provided the remote user has perm_sync_internal.
📍In the MISP UI, go to Administration › Servers, edit the remote server, and ensure the remote sync user has the perm_sync_internal permission — the pulling instance will then preserve distribution levels as determined by the remote.
New filter-tag workflow module enables filtering pipeline data based on tags.
New notify_user_toast workflow module creates in-app notification toasts for users.
New add_analyst_data workflow module lets workflows create analyst data entries.
Adds CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. and visual highlighting support for relationship_types in object relationships.
New perm_sync_internal permission flag allows internal pulls without distribution downgrade, letting the remote instance control downgrade logic.
+7 moreshow less
Adds remove_missing_tags support at the Event level during event pull/sync.
Reworked attribute search now accepts parameters as query strings, uses a GET form, supports direct downloading of results, improves pagination, and aligns with restsearch behavior.
Adds new default distribution setting for galaxies.
The if-tag workflow module now supports filtering on event reports.
Server sync test now shows the number of events to be synced when testing sync rules.
Workflow editor adds support for more HTML attributes in form inputs.
Object relationship /add and /edit endpoints now support the highlighted field.
Cribl Stream 4.11 introduces Metrics Pipeline Builder, new Aggregate Metrics Function, and Kinesis ListShards validation.
Adds a new Metrics Pipeline Builder in the UI to automate dropping or aggregating metrics from Data Preview.
Adds a new Aggregate Metrics Function supporting StatsD, Prometheus, and OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. for pre-aggregation.
Adds Indexed Fields support with JavaScript expressions in the Google Cloud Logging Destination.
Adds a new Log last schema mismatch advanced setting in the ClickHouse Destination for troubleshooting.
Adds a Max requests per socket setting to the Windows Event Forwarder Source.
+2 moreshow less
Adds an optional endpoint suffix parameter to Azure Blob Storage destinations for regional targeting.
Adds granular compression control for S2S v4 in Splunk TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. Source, Splunk Load Balanced Destination, and Splunk Single Instance Destination.
NodeZero March 2025 adds MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. subclient management, Chrome/Okta cookie theft, Metasploit implant deployment, and runner IP reporting.
MSPsMSPsA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. can create and manage subclients to allocate Insights, Tripwires, and Rapid Response features in a single step.
Deleted subclients now trigger a 60-day asset lockout before reclamation, visible via a UI countdown timer.
NodeZero gains the ability to steal locked Chrome cookies and decrypt them offline.
Attackers can hijack valid Okta sessions using stolen and decrypted session cookies.
Post-exploitation implants can be deployed directly through a new Metasploit integration.
+2 moreshow less
Runners now report their IP addresses to improve asset attribution, requiring an update via h3-cli.
Attack Graph visualizations now provide clearer vector tracing for exploit chains and lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access..
March 2025 adds Alert Triage workflows, AWS principal API timeline, Executive Risk View reports, and new Surface Command connectors.
Adds support for deploying multiple instances of the same connector in Attack Surface Management (Surface Command).
Introduces unified Executive Risk View reports on the Command Platform to consolidate cross-product risk reporting.
Adds a graph-based principal API activity timeline for AWS in Cloud Detection & Response.
Enables direct ingestion of cloud log data via webhooks and S3 into SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. (InsightIDR), Managed Threat Complete, and MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools..
Expands Digital Risk Protection (Threat Command) monitoring to LinkedIn, Roblox, and Facebook Ads for brand impersonation detection.
OSV-Scanner v2.0 adds osv-scanner scan image, interactive HTML via --serve/--port, Maven guided remediation, and several new lockfile formats.
└──▷ GET THIS VERSION
$ git clone --branch v2.0.0 https://github.com/google/osv-scanner.git
# already have the repo? check out this version:$ git checkout v2.0.0
└──▷ USE IT
Scan a specific container image layer-by-layer.
shell
osv-scanner scan image nginx:latest
Start an interactive HTML report server on a custom port for review.
shell
osv-scanner scan . --serve --port 9090
Update the local vulnerability database to get the latest detections.
shell
osv-scanner update
scan image <image-name>:<tag> command with layer-aware container scanning for Debian, Ubuntu, and Alpine
Interactive HTML output served by the --serve flag, controllable port via --port
Guided remediation for Maven pom.xml in non-interactive mode with override strategy support
osv-scalibr enhanced dependency extraction: cabal.project.freeze, stack.yaml.lock, deps.json, uv.lock, and artifacts (node_modules, wheels, uber jars, Go binaries)
New osv-scanner update command for updating the local vulnerability database (formerly experimental)
+3 moreshow less
Container scanning information added to vertical output format
Severity support in SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. report format
Support for bun.lock lockfiles
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Guided remediation now defaults to non-interactive mode; use the --interactive flag for interactive mode
!Removed the --verbosity=verbose verbosity level
!Experimental flag mechanism has been removed and all previous experimental flags are now out of experimental
!Multiple license flags have been merged into a single --license flag
!API: reporter removed; logging now uses slog, which can be overridden
!API: Deprecated packages removed, including lockfile (migrated to OSV-Scalibr)
DefectDojo 2.44.1 adds generic OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. login and Splunk vulnerability ID support.
└──▷ GET THIS VERSION
$ git clone --branch 2.44.1 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.44.1
Adds generic OIDC login option, configurable via settings.dist.py/local_settings.py and surfaced in the UI.
Adds Splunk vulnerability ID (vulnIDs) support for Splunk findings.
Tenable Exposure Management introduces a new Overview page with exposure scores and a dedicated Installed Software page for vendor/version discovery.
Adds an Overview page showing exposure scores, assets, attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. matrix, and weakness breakdowns
Adds an Installed Software page to view software vendors, versions, devices, and file paths
2 details in Everything
5 more releases in this issue
· 2025-03-06 → 2025-03-27
New IoE for unsupported Exchange servers and ESC9ESC9A Windows Active Directory privilege-escalation technique exploiting certificate template configurations where the template lacks the security extension, allowing an attacker to abuse certificate enrollment to impersonate other accounts.ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. misconfiguration reporting
Adds Unsupported or Outdated Exchange Servers Indicator of Exposure (IoE) to detect Microsoft unsupported Exchange versions and missing Cumulative Updates.
Enhances ADCS Dangerous Misconfigurations IoE to report the ESC9 vulnerability for certificate templates with the unsecured CT_FLAG_NO_SECURITY_EXTENSION flag as a deviance.
Expanded Mapped Certificates IoE with new X509X509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. mappings and AD CS ESC14 detection; improved group member counting.
Mapped Certificates on Accounts IoE now includes X509RFC822, X509IssuerSerialNumber, X509SKI, and X509SHA1PublicKey mappings in addition to original types.
Mapped Certificates on Accounts IoE now reports weak explicit certificate mappings for AD CS ESC14 Abuse Technique detection.
Single Member AD / Entra Group IoE now counts only direct members for accurate results.
Empty Group IoE now counts only direct members for accurate results.
Brinqa 11.30.93 adds report sharing RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., BQL/BCL USING keyword, dark mode UI, and query-based charts.
Adds report sharing RBAC allowing owners to restrict sharing to view-only or view-and-edit permissions
Introduces USING keyword for BQL and BCL to specify which database to query from on certain views
Makes dark mode available in the UI across the platform
Enables creating charts using a query with a RETURN statement on the Explorer page
4 details in Everything
1 more release in this issue
· 2025-03-14 → 2025-03-25
Brinqa Platform 11.29.221 adds improved orchestration performance and refined lifecycle status calculation.
Enhanced lifecycle status calculation to account for multiple source data models (SDMs) of the same type with varying inactivity values
Improved the performance of Analytics Source during orchestrations
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The NIST NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. connector is no longer supported in Brinqa Platform version 11.28 or later.
runZero 4.0.250317.0 adds custom integration HTTP methods, SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. map attributes, and dashboard list page.
Adds timeout=<seconds> parameter to http.get and http.post in custom integration scripts
Adds support for HEAD, PATCH, PUT, and DELETE HTTP methods in custom integration scripts
Introduces a new dashboard list page showing all dashboards the current user can access
Enables timestamp-based search on Meraki firstSeen and lastSeen attributes
Adds snmp.interfaceAddrsMap, snmp.interfaceAliasesMap, snmp.interfaceNamesMap, and snmp.interfaceMacsMap SNMP attributes indexed by interface index
Adds UI for viewing TLS/certificate details on host details and My Device pages.
Adds certificate data to host vitals for macOS, iOS, and iPadOS.
Adds list host certificates and list device certificates API endpoints.
Implements GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. mode that locks UI settings managed by GitOps, preventing drift.
Allows VPP (App Store) apps to be automatically installed via Fleet-created policies.
+11 moreshow less
Adds ability for users to auto-install App Store Apps from the Fleet UI without writing a policy.
Adds experimental Android MDM support: UI to enroll Android devices via BYODBYODBring Your Own Device: a policy allowing employees to use personal phones, laptops, or tablets for work, creating a network of unmanaged endpoints that cyber tools must monitor or enforce policy on. and to enable/disable Android MDM.
Adds script execution, software installs, and VPP app installs to the new upcoming_activities table for a unified activity queue.
Updates the list upcoming activities endpoint to use the new upcoming_activities table as source of truth.
Adds PATCH /api/latest/fleet/software/titles/:id/name endpoint for cleaning up incorrect software titles with a bundle ID.
Adds pagination inside each Manage Automations modal for policies.
Adds a daily sync job to keep App Store app versions in Fleet current with the actual latest version.
Adds created_at timestamp for when a VPP app was added to a specific team.
Permits setting SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. metadata and metadata_url via GitOps and the UI.
Enables Redis cluster follow-redirections by default.
Updates wine to version 10.0 to improve macOS-to-Windows installer creation on M1 chips.
16 details in Everything
└──▷ BREAKING ON UPGRADE
!The default for FLEET_VULNERABILITIES_MAX_CONCURRENCY is changed from 5 to 1; deployments relying on the previous default concurrency level will now process vulnerabilities more slowly unless the value is explicitly set.
Installomator v10.8 adds 80+ new app labels, argument load-order fix, and reorganized MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. scripts.
└──▷ GET THIS VERSION
$ git clone --branch v10.8 https://github.com/Installomator/Installomator.git
# already have the repo? check out this version:$ git checkout v10.8
Arguments now load before and after labels are loaded, enabling more flexible MDM deployment configurations.
Reorganized MDM scripts for improved deployment workflows.
1Password SDKS 0.2.1 adds bulk secret resolution, new field types, item sharing, and expanded editing capabilities
client.items.shares functions for sharing items with attached files
items.put function support for legacy fields and passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices.
client.secrets.resolveAll for resolving multiple secrets in bulk
Support for Address and Date field types in item creation, retrieval, and editing
CreatedAt and UpdatedAt metadata exposed on items and overviews
+1 moreshow less
items.listAll return type now includes item tags
6 details in Everything
13 more releases in this issue23 more releases in this issue · 2025-03
1Password for Windows 8.10.64 adds SSH URL commands, location data sync, and search filters
Adds ssh-agent custom command configuration to open bookmarked SSH URLs
Adds default expiry alerts based on item category
Syncs item locations to 1Password mobile Home screen when nearby
Adds passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. and location search filter suggestions via = in search bar
Item location support, passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices./search filters, and default expiry alerts in 1Password for Mac 8.10.64
Adds location field support to items and displays them on the Home screen of nearby 1Password mobile apps; requires enabling Maps access in Settings > Privacy > Item Location.
Adds default expiry alerts based on item category, replacing manual alert configuration for standard categories.
Adds passkey and location search filter suggestions triggered by entering an equals sign (=) in the search bar.
1Password SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Manager adds temporary access requests, Slack integration, new integrations and cost center reporting in March 2025
Adds temporary access requests for time-limited application access with unlimited, defined, or end date options.
Adds Slack integration to raise temporary access requests via Slack, automatically adjusting options based on policy settings.
Adds new integrations with ChartHop, Opsgenie, and Pleo.
Adds ‘Contract meets criteria’ trigger for automating renewal notifications and actions when contract criteria are met.
Enables cost center reporting by allowing users to select Cost center in existing spend reports.
+1 moreshow less
Allows defaulting the renewals view to End date with an adjusted calendar layout.
Custom CNAMECNAMEA DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin. support in Stytch test environments via Project Settings.
Adds full support for custom CNAMEs in test environments
1 detail in Everything
1 more release in this issue
· 2025-03-07 → 2025-03-28
Passbolt v4.12 adds v5 metadata migration controls for admins in browser extension and API
Adds PB-37699 capability: administrators can now upgrade folders to the v5 format via the API.
Adds PB-38932 through PB-38925: browser extension UI for migrating metadata content, including the MigrateMetadataContentServiceWorkerService, ConfirmMigrateMetadataDialog, and navigation to the administration page.
Adds PB-38850 and PB-36582 constraints: administrators cannot rotate entities while two metadata keys are active, and cannot reuse previously deleted metadata keys.
New onboarding flow for trial users to configure SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. and explore features during initial email scan
Enhanced onboarding experience for trial users with a guided 5-minute configuration during the initial email scan.
Ability to connect Nudge Security to an SSO provider as part of the new onboarding flow.
In-app exploration paths for shadow SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. usage discovery and spend management capabilities.
New prompts to invite teammates and schedule a product expert call within the trial experience.
JumpCloud adds SaaS ManagementSaaS ManagementA category of software that tracks, governs, and optimises an organisation's portfolio of SaaS subscriptions, covering spend, access, and licence utilisation from a single control plane. user group exclusion for browser warn/block messages
Adds the ability to exclude specific user groups from receiving warn or block messages in their browser via SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Management.
Releases JumpCloud Go Browser Extension v1.3.10 which enables the new SaaS Management User Group Exclusion functionality.
Acronis Cyber Protect combines backup, disaster recovery, and endpoint protection in one platform for businesses and managed service providers.
Email archiving for M365, Linux EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device., Fortinet integration, and Rocky Linux VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. gateways in Acronis Cyber Protect 2025-03
└──▷ HOW TO FIND IT
Verify how much space immutable archives are consuming in your backup storage.
Configure a recurring weekly task to review incident reports via the PSA console.
📍In Advanced Automation (PSA), create a new ticket and set the recurrence schedule to Weekly.
Adds email archiving for Microsoft 365 to protect historical data and support legal hold requirements.
Adds EDR detection and remediation capabilities for Linux workloads, including stop, quarantine, allow/block list actions, and backup recovery.
Adds Fortinet integration to enrich EDR incident data with URL and IP reputation and isolate devices at the firewall level.
Enables Rocky Linux 9-based VPN gateways by default for new Disaster Recovery tenants.
Adds real-time chat between technician and remote user in the Cyber Protect Cloud console.
+4 moreshow less
Adds To, Cc, and Bcc recipient support to service desk ticket emails in Advanced Automation (PSA).
Adds recurring ticket scheduling (daily, weekly, monthly, annual) for repetitive tasks in Advanced Automation (PSA).
Displays immutable storage consumption in the Cyber Protect Cloud console under Backup storage > Immutable storage.
Introduces a new device registration flow in the console to select destination customer/unit, plans, and review quotas.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!The /api/ams/REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. is deprecated and will lose support one year after the announcement date.
Druva adds Threat Hunting for Azure VMs with malware IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. search and Quarantine Bay
Adds Threat Hunting capabilities to Azure Virtual Machines including Malware IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search, Infection Scope & Timelines, Automated Quarantine of infected snapshots, and Rich Metadata.
Adds Quarantine Bay feature in the Druva Cloud Platform Console to isolate infected Azure VM snapshots and restrict data access and restore operations.
Adds Deep Scan option for Curated Snapshot feature to perform thorough malware detection on all file types.
Druva Enterprise Workloads adds powered-off Azure VM restore, Quick Scan for Restore Scan, AWS DR proxy upgrade via UI, and Oracle block-level recovery.
Adds ability to restore Azure virtual machines in a powered-off state for sandbox-style isolation during security threats
Adds Enable Quick Scan toggle under Restore Settings for File Server and NAS to reduce scan impact on performance
Adds direct upgrade workflow for DR AWS Proxy Environment through the Management Console
Enables Automated Block-Level Recovery for Oracle DTC to restore corrupted data blocks without downtime
Supports Windows Server 2025 as an operating system for File Servers and NAS proxy
+1 moreshow less
Adds Organization, Current Source, Average Annual Growth, Estimated Storage Consumed, and Retention fields to the Backup Sets section of Consumption Insights
Druva MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. adds Shared Mailbox chargeable usage details to Tenant Consumption Report v2.0
Tenant Consumption Report v2.0 now includes chargeable Shared Mailbox (SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments.) usage details for Microsoft 365 users
Shared Mailbox usage metrics are now available in API reports within Tenant Consumption Report v2.0
An open-source command-line backup program that stores encrypted, deduplicated snapshots on local disks, SFTP servers, and object storage.
restic 0.18.0 adds JSON output for check, Azure access tiers, S3 cold storage, xattr restore filters, DragonFlyBSD support, and more.
└──▷ GET THIS VERSION
$ git clone --branch v0.18.0 https://github.com/restic/restic.git
# already have the repo? check out this version:$ git checkout v0.18.0
└──▷ TRY IT
Parse repository health check results in a pipeline or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. by emitting structured JSON instead of human-readable text.
$ restic check --json
Back up a Windows workstation while skipping OneDrive Files On-Demand stubs to avoid triggering mass cloud downloads.
Adds --json flag to the check command to output all statistics in JSON format.
Adds -o azure.access-tier=<tier> option to set Microsoft Blob Storage access tier (Hot, Cool, or Cold) for newly created objects.
Adds --sort <field> and --reverse options to ls -l, supporting fields name, size, time, mtime, atime, ctime, and extension.
Adds --exclude-cloud-files option to backup to skip online-only cloud files such as OneDrive Files On-Demand.
Adds experimental S3 cold storage support.
+15 moreshow less
Adds --reverse option to find command; default sort order for find output changes from oldest-to-newest to newest-to-oldest.
Adds support for including/excluding extended file attributes (xattrs) during restore.
Adds start and end timestamps to backup JSON output.
Adds sort option to ls command for sorting directory listings.
Enables compression for ZIP archives produced by the dump command.
Makes tag command print which snapshots were modified.
Makes small pack size configurable for prune.
Makes recover automatically rebuild the index when needed.
Adds support for generating shell completions to stdout by passing - as the filename with --[shell]-completion in the generate command.
Adds SLSASLSASupply-chain Levels for Software Artifacts, a framework for assessing how software was built and protecting that process from tampering. Provenance records help verify where a build came from.provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. to GHCRGHCRGitHub Container Registry, GitHub's hosted service for storing and distributing OCI-compatible container images, giving cyber tools a versioned, access-controlled image store tied directly to a GitHub repository. container images.
Adds DragonFlyBSD platform support.
Adds xattr support for NetBSD 10+.
Adds snapshot summary statistics to rewritten snapshots.
Adds retry mechanism for loading repository config.
Randomizes how chunks are assembled into pack files to mitigate content-defined chunking attacks.
20 details in Everything
└──▷ BREAKING ON UPGRADE
!TLS versions older than TLS 1.2 are now disabled; restic now requires at least Windows 10 or Windows Server 2016 on Windows, and macOS 11 Big Sur on macOS.
!The deprecate-legacy-index, deprecate-s3-legacy-layout, explicit-s3-anonymous-auth, and safe-forget-keep-tags feature flags are now stable and can no longer be disabled; they will be removed in restic 0.19.0.
!The default sort order for find output changes from oldest-to-newest to newest-to-oldest; use --reverse to restore the previous behaviour.
Ubiq adds Okta/Entra IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. support, BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. Okta auth, and structured cache controls across libraries and dashboards
└──▷ USE IT
Configure cache TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. and encryption for structured keys in .NET
code
var options = new UbiqOptions() {
EncryptKeysInCache = true,
CacheTtl = TimeSpan.FromHours(1),
EnableCachingForStructuredKeys = true
};
Set a custom color profile for an account in the dashboard
📍In the dashboard, go to Account Settings › Profile and select a color from the Color Profiles picker.
Adds support for authentication with Okta and Entra user tokens to C/C++ (.NET, Go, Java, Node.js, Python) client libraries
Adds cache configuration options (encrypt keys in cache, set cache TTL, enable/disable caching for structured keys) to .NET and Node.js libraries
Enables Native SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. integration support for Okta and Entra identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.
Adds BigQuery integration with Okta-based authentication via integrated login flows, eliminating API key requirements
Cyera adds AI-powered DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Insights to systematically analyze alerts, surface trends, and provide actionable recommendations
Cyera DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Insights adds AI-powered analysis of alerts to surface trends and actionable recommendations
Cyera introduces AI-powered DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. integration to automate DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policy creation and enforcement.
Adds automated DLP policy creation powered by Data Security PostureData Security PostureAn organisation's overall state of readiness to protect data, covering where sensitive data lives, who can reach it, and whether controls are correctly applied — giving cyber tools a continuous risk baseline to act on. Management (DSPM) insights
Enables fine-tuned enforcement of DLP policies using DSPM data for smarter protection
Netskope v124 adds MacOS Enterprise Browser, Amazon S3 forensic destination, Google Calendar API DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., and granular steering match criteria
└──▷ TRY IT
Use nsdiag on MacOS to rotate secure tokens from the CLI.
$ nsdiag -e
Enterprise Browser for MacOS (Beta) enables consistent browsing on macOS.
Supports Amazon S3 as a new forensic destination for Next Gen Forensics.
Next Generation API Data Protection adds support for Google Calendar, including DLP, threat protection, and alerts.
New API data protection policy action: Apply Sensitivity Label (Write) for Google Drive to apply label badges.
Steering Configuration WebUI adds Match Criteria options for OS Family and multi-select User Group/Ou.
+6 moreshow less
nsdiag -e command available on MacOS to update enrollment and encryption tokens.
Device Classification now supports Check CRL, Check UPN, and Check Smart Card (GA).
Endpoint DLP adds No Notification (Mute) template option for silent blocking.
Endpoint DLP captures source PDF for Chrome/Edge printing and supports Custom Device Classification.
New category Banking and Payments available for NG SWGSWGA Secure Web Gateway is a network proxy that inspects outbound web traffic, enforcing policy by blocking malicious sites, filtering content, and decrypting TLS — giving cyber tools a choke point for all user HTTP/S sessions. policies.
RBI now isolates 3rd party authentication flows transparently without sidecar categories.
Bytebase v3.5.1 adds Cosmos DB SQL syntax support and OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. connectivity via Elasticsearch client.
└──▷ GET THIS VERSION
$ git clone --branch 3.5.1 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 3.5.1
SQL Editor now supports WHERE clauses and SELECT projections for the Cosmos DB SQL syntax.
1 detail in Everything
1 more release in this issue
· 2025-03-13 → 2025-03-28
Bytebase 3.5.0 adds Azure IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Auth for Cosmos DB & SQL, paginated APIs, and DingTalk direct message webhooks
└──▷ GET THIS VERSION
$ git clone --branch 3.5.0 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 3.5.0
Adds page_size and page_token query parameters to GET /v1/projects for paginated project listing
Adds name and resource_id filter parameters to POST /v1/projects:search endpoint
Adds filter parameters (environment, project, instance, name, engine, label, exclude_unassigned) to GET /v1/instances/{instance}/databases for database listing
Adds filter parameters (name, email, user_type, state) to GET /v1/users for user listing
Supports Azure IAM authentication for Cosmos DB and Azure SQL connections
+3 moreshow less
Adds webhook direct message support for DingTalk integration
Allows updating the plan for database group deployment via the extended API
Configures custom maximum query time in SQL Editor via Workspace Settings -> General -> Security -> Maximum query time
Zscaler Client Connector for VDIVDIVirtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. gains ZPA support for private access
└──▷ HOW TO FIND IT
Configure a VDI template to route private traffic via ZPA instead of the public internet.
📍Configuring VDI Templates
Set up forwarding rules for VDI sessions that require ZPA application access.
Zscaler Client Connector for VDIVDIVirtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. 1.5.0.5 adds registry key to prevent onboarding after reboot
ZIA adds Python/DPI sandbox support, hex DNS field, new audit APIs, and DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries.
Adds %s{ednsreq} field to NSS and Cloud NSS feeds for hex-encoded FQDN in DNS logs
Adds GET /locations/supportedCountries endpoint to retrieve supported countries for location configuration
Adds GET /adminUsers/me, GET /configAudit, GET /configAudit/ipVisibility, and GET /configAudit/pacFile endpoints for admin and audit reporting
Extends Zscaler Sandbox to analyze .py, .p, .pkl, .pickle, .pyd, and .pyw files
Adds new predefined DLP dictionaries: National Identification Number (Chile RUN), National Identification Number (Peru CUI), and National Document ID (Uruguay)
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The /adminRoles, /departments, and /groups endpoints are now exclusively available via Zscaler OneAPI; direct access through the ZIA cloud service API is limited to GET operations only.
ZIA adds CASBCASBA Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. collaborator count to DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. scoping and a configurable EUN IP for DNS Control
Adds CASB Collaborator Count field under Special Settings of the Tenant Details page as a new scoping criteria for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Data at Rest Scanning DLP policies in file sharing applications.
Enables redirection to a Zscaler-hosted EUN web page via DNS Control rules by specifying the IP 34.215.46.88 in the Redirect Response action.
DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds AI service posture monitoring, AWS single-account onboarding, and new investigation predicates.
Adds Exposed to AI Service posture label for data stores accessible by Azure AI Foundry Hub.
Supports AWS single-account onboarding for environments restricted at the organization level.
Adds Sensitive Data Triggers, Sensitive Data Matches, Sensitive Data Volume, and Last Completed Scan predicates to investigation queries.
Expands supported data stores to include GCP Cloud SQL Instances, unmanaged PostgreSQL on Azure/AWS, and unmanaged MSSQL on AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware..
DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Azure AI Hub detection, new posture labels, AWS single-account onboarding, expanded DB support, and investigation predicates
Detects Azure AI Foundry Hub services that access data stores containing sensitive data and displays findings in the Data Inventory graph.
Applies the Exposed to AI Service posture label to data stores exposed via AI services.
Supports onboarding of individual AWS single accounts for DSPM monitoring.
Enhances the Compliance dashboard with failed policy counts by severity/control and lists of failed resources/policies.
Adds AI Services Widget to the Dashboard showing sensitive data exposure, trigger access, and risk.
+6 moreshow less
Updates Top Risk Data Stores widget See All link to navigate directly to the Data Inventory page.
Displays Top Accounts and Top Data Stores widgets on the Data Discovery tab of the Dashboard.
Adds new data posture policies for AWS RDS, S3, DynamoDB, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware.; Azure Storage, Key Vault, VMs, SQL/PostgreSQL; GCP storage buckets regarding GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification./data residency.
Extends AI/ML document classification to support over 100 new document types across 10 categories.
Adds scanning support for Google Cloud SQL Instances (MSSQL, PostgreSQL, MySQL), unmanaged PostgreSQL on Azure/AWS, and unmanaged MSSQL on AWS EC2.
Updates the Investigation Has Data predicate with Sensitive Data Triggers, Sensitive Data Matches, Sensitive Data Volume, and Last Completed Scan.
ZPA introduces native secondary Layer 3 VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. tunnel support for legacy apps
ZPA adds STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against.-compliant RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 images for Azure and auto-generated CA certs for AppProtection TLS inspection.
Adds Red Hat Enterprise Linux 9 App Connector and Private Service Edge VM images for Microsoft Azure that support Security Technical Implementation Guide (STIG) requirements without disabling password expiration
Enables automatic certificate generation for AppProtection TLS inspection by selecting an enrollment (CA) certificate when configuring an application segment
ZIA adds DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest.PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. dictionaries, granular Smart Isolation targets, Misc/Unknown URL isolation, and AWS/GCP app service groups.
Persistent State toggle added to ZIA isolation profiles to replace cookie persistence
Users and Groups fields added to the Smart Isolate tab for granular Secure Browsing policies
Preconfigured Isolation profile available for the Miscellaneous and Unknown URL category
AWS and GCP application service groups added to Firewall policy for cloud traffic management
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The cookie persistence toggle in ZIA isolation profiles is renamed to Persistent State
ZPA now allows users to define exceptions for OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. controls within AppProtection profiles.
New Client Connector for VDIVDIVirtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. type and corresponding ZPA API support for multi-session VDI environments.
Introduces Client Connector for VDI, a lightweight client type for multi-session VDI environments
Adds a new client type to the ZPA cloud service API to support multi-session VDI configurations
STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. VM images for Nutanix and VMware now support RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 App Connector and PSE with password expiration enabled.
Nutanix STIG-hardened App Connector image (RHEL 9) available without disabling password expiration
VMware STIG-hardened App Connector and Private Service Edge images (RHEL 9) available without disabling password expiration
Execute GPO Update option added to the None mode in forwarding profiles
Auto System Info and Log Fetch: allows Zscaler to retrieve and analyze log bundles for issue resolution
Digital Experience (ZDX) Module for Windows upgrade package can be downloaded for MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. or CLI deployment
Fail close options for driver error or FW/AV error in App Profiles
Certificate prompt handling improved via WebView2 Authentication to reduce frequency
+3 moreshow less
Setting to restrict ZPA partner logins to specify which partner tenants can access your organization’s tenant
Option to control screen focus for notifications from the Zscaler Notification Framework
Use Tunnel SDK Version 4.3 option added for iOS support
ZDX 2025 introduces SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. Auto Provisioning to simplify admin group management via automated identity synchronization.
SCIM Auto Provisioning enables automatic association of user groups with ZDX Administrator Management roles and scopes.
ZIA adds granular Smart Browser Isolation for users/groups, new API endpoints for admin/role/dept/group mgmt, DNS block with response code action, and AWS/GCP service groups.
Adds Users and Groups fields to the Smart Isolate tab (Policy > Secure Browsing > Smart Isolate) for granular browser isolation targeting
Adds BLOCK_WITH_RESPONSE action and blockResponseCode attribute in the FirewallDnsRule model to DNS Control policy via API
Adds new Cloud Service API endpoints under Admin & Role Management (/adminRoles), User Management (/departments, /groups), and Traffic Forwarding (/subclouds)
Adds AWS and GCP application service groups to Firewall policy for managing cloud provider traffic
ZPA adds microphone/camera support in isolation profiles and RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for ZPA API keys.
Adds Microphone and Camera toggle per isolation profile to enable audio/video passthrough when Turbo Mode is enabled.
Enables granular Role-Based Access ControlRole-Based Access ControlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC) for ZPA API operations, allowing predefined or custom roles to be assigned to API keys.
Adds ability to manage financial risk calculation settings in the Risk360 Admin Portal Account page.
Updates the existing financial risk exposure calculation method, which changes how the Loss Curve chart reflects risk exposure starting from the update date.
Zscaler Client Connector 4.4 adds GPO updates in None mode, ZPA tenant restriction, and log fetch options.
Adds the Execute GPO Update option to the None mode in forwarding profiles
Adds an option to allow Zscaler to retrieve and analyze Zscaler Client Connector log bundles via Auto System Info and Log Fetch
Adds a setting to restrict Zscaler Private Access (ZPA) partner logins to specify which partner tenants can access your organization’s tenant
Adds the Lockdown on Tunnel Process Exit option updates to include tunnel crashes and the Repair App option
Adds the ability to download a Digital Experience (ZDX) Module for Windows upgrade package for MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. or CLI deployment
+2 moreshow less
Adds an option to control screen focus for notifications from the Zscaler Notification Framework
Adds a Use Tunnel SDK Version 4.3 option to support new features introduced with Zscaler Client Connector version 4.3 for iOS
ZIA adds Admin/Role/User/Group API endpoints, DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries for LATAM nations, granular Smart Isolation controls, and DNS Block with Response Code.
GET /adminRoles, POST /adminRoles, PUT /adminRoles/{roleId}, DELETE /adminRoles/{roleId} (plus lite variants) enable programmatic management of admin roles via the Cloud Service API.
GET /departments, POST /departments, PUT /departments/{departmentId}, DELETE /departments/{departmentId} (plus lite variants) allow creating, updating, and deleting departments programmatically.
GET /groups, POST /groups, PUT /groups/{groupId}, DELETE /groups/{groupId} (plus lite variants) provide full CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. for groups via the API.
DLP now includes new predefined dictionaries: National Identification Number (Chile RUN), National Identification Number (Peru CUI), and National Document ID (Uruguay).
New Zscaler Deception features: Interactive AI decoy UI/API, JSON export, GuardDuty/ZPA integration, AWS multi-region, new datasets/rate limit rules.
Zscaler Deception Admin Portal now includes a theme builder for customizing the user interface of interactive generative AI decoys.
Interactive generative AI decoys expose OpenAI-compatible APIs for chat completion and model retrieval.
Deception events can now be exported in JSON format for analysis.
New integration with Amazon GuardDuty to automatically isolate attackers by blocking their AWS access.
AWS Cloud Deception supports deployment across multiple AWS accounts and regions within a single account.
+3 moreshow less
New static application datasets: Grafana, BitBucket, Fortinet SSL VPN, NextCloud, VMware Aria, SAP HANA Web UI.
New CVE-targeted application datasets for Journyx, Palo Alto Expedition, Apache Solr, Microsoft Exchange Server, Palo Alto PAN-OS, Apache OFBiz, SonicWall GMS, Zyxel NAS326.
QoS Rate Limit for Threat Intelligence (TI) decoys: blocks attackers generating >1,000 events for one hour and generates a QoS event with a 2-hour cooldown.
Client Connector adds Authentication Service SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. integration and IP-based bypasses for Android/ChromeOS
Adds support for the Authentication Service platform integration, enabling user authentication and registration via Single Sign-On (SSO) to access Zscaler services.
Adds support for predefined and custom IP-based application bypasses to exclude routes from the VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. profile for Android 13+ and ChromeOS 132+.
Sophos ZTNA 2025.08 adds inactivity timeout and resource connection pooling controls for gateway-agent tunnels.
└──▷ HOW TO FIND IT
Set an inactivity timeout to automatically drop idle gateway-agent tunnels, reducing attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. from stale sessions.
📍In the Sophos Central console, go to ZTNA Settings and configure the inactivity timeout for the tunnel between the ZTNA gateway and the ZTNA agent.
Disable resource connection pooling when per-session isolation is required for sensitive resources.
📍In the Sophos Central console, go to ZTNA Settings and turn off resource connection pooling.
Adds inactivity timeout setting for the tunnel between the ZTNA gateway and ZTNA agent via ZTNA Settings.
Adds the ability to turn off resource connection pooling via ZTNA Settings.
Teleport v17.4.0 adds Oracle RDS access, Windows dual-host support, and workload-identity-aws-ra service
└──▷ GET THIS VERSION
$ git clone --branch v17.4.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.4.0
Database access for Oracle RDS with KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. authentication
AWS integration status dashboard and user tasks view in the web UI to highlight remediation steps
Support for registering a single Windows host as both domain-joined and standalone machine
Joined Kubernetes sessions from the web UI
static_jwks field in the GitLab join method configuration
+6 moreshow less
New workload-identity-aws-ra service for generating AWS credentials via Roles Anywhere in tbot
Support for specifying a second factor list in the teleport-cluster Helm chart
Support for topologySpreadConstraints in the teleport-cluster Helm chart
SendEnv OpenSSH option support in tsh
Support for DynamoDB Streams FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. endpoints
Workload ID: support for attesting Systemd services
Teleport v16.4.18 adds Podman workload attestation, a --join-method flag for teleport configure, and configurable PKCS#11PKCS#11The standard programming interface software uses to ask an HSM, smart card or token to sign or decrypt with a key it holds. Supporting it lets a tool keep its keys in hardware. max connections.
└──▷ GET THIS VERSION
$ git clone --branch v16.4.18 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v16.4.18
└──▷ TRY IT
Specify how Teleport should join a cluster during the initial configuration process.
$ teleport configure --join-method=token
Workload ID: support for attesting Podman workloads.
Allow specifying the maximum number of PKCS#11 HSMHSMA tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them. connections.
Adds Workload ID Predicate Language support and changes default TLS routing upgrade mode.
└──▷ GET THIS VERSION
$ git clone --branch v17.3.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.3.1
Workload Identity templates and rules now accept Teleport Predicate Language expressions for matching workloads.
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!Default TLS routing connection upgrade mode changes from supporting ALPN fallback to requiring WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. headers; the TELEPORT_TLS_ROUTING_CONN_UPGRADE_MODE environment variable must be set to legacy if ALPN is required.
Aembit adds Standalone CAs for granular TLS control and Credential Provider Integrations like GitLab.
Adds Standalone CAs feature to create dedicated Certificate Authorities independent of Tenant-level certificates for isolated trust boundaries.
Updates Deploy Edge Components experience in the Aembit admin UI with deployment guides for Kubernetes, Ubuntu Linux, Red Hat Enterprise Linux, and Microsoft.
Introduces Credential Provider Integrations to automate credential lifecycle management, starting with GitLab Service Account integration.
3 details in Everything
1 more release in this issue
· 2025-03-05 → 2025-03-25
Aembit Credential Provider for AWS STSAWS STSAWS Security Token Service, an Amazon Web service that issues short-lived credentials for IAM roles, letting tools authenticate to AWS APIs without storing long-term secrets. now supports SigV4SigV4AWS's request-signing protocol that authenticates HTTP calls by hashing the request body, headers, and credentials into a signature; cyber tools use it to talk to AWS APIs without embedding long-lived secrets. and SigV4a request signing
SPIRE v1.12.0 adds S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. storage support, Rego V1 policy engine, and SAN-based node attestation selectors.
└──▷ GET THIS VERSION
$ git clone --branch v1.12.0 https://github.com/spiffe/spire.git
# already have the repo? check out this version:$ git checkout v1.12.0
└──▷ USE IT
Publish SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. bundles to a self-hosted MinIO cluster instead of AWS S3 by pointing the aws_s3 BundlePublisher at a custom endpoint.
Supports any S3-compatible object storage (e.g., MinIO) in the aws_s3 BundlePublisher plugin, not just AWS S3.
Supports Rego V1 syntax in the authorization policy engine.
Adds SAN-based selectors in the x509pop NodeAttestor plugin for finer-grained node attestation.
Agents now use the SyncAuthorizedEntries API for periodic entry synchronization by default.
Log timestamps now include nanosecond precision.
+1 moreshow less
Experimental events-based cache now supports reading from read-only database replicas when data staleness is tolerated, improving read performance.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The use_legacy_downstream_x509_ca_ttl server setting now defaults to false; deployments relying on legacy downstream X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. CA TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. behavior must explicitly set it to true or migrate.
!The deprecated k8s_sat NodeAttestor plugin has been removed; deployments using it must migrate to an alternative node attestor before upgrading.
Adds STEP_OPEN_BROWSER env var support and custom user claim to ca token
└──▷ GET THIS VERSION
$ git clone --branch v0.28.4 https://github.com/smallstep/cli.git
# already have the repo? check out this version:$ git checkout v0.28.4
└──▷ TRY IT
Run step cli in headless CI environments without opening a browser window
$ STEP_OPEN_BROWSER=false step ca token
Issue a certificate with a specific user identity in the JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. payload
$ step ca token --user my-service <sub-claim> <path-to-csr>
STEP_OPEN_BROWSER=false skips launching the default browser during authentication flows
step ca token now supports a custom user claim via --user flag
Mondoo introduces CVE detection for AIX/SQL Server/MS365, CSV exports, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. tracking and hypervisor detection
New CVE detection engine covering AIX, SQL Server, and Microsoft 365 vulnerabilities
Exports findings to CSV format for external analysis
Adds SLA tracking capabilities to monitor vulnerability remediation timelines
Enhances hypervisor detection with advanced identification logic
Scrut adds search in owner dropdown, email search, file attachments, and new review management UI features.
Adds a search bar to the Owner in Scrut dropdown for finding owners
Enables searching by user email/identifier in addition to name
Allows reviewers to upload file attachments (screenshots/evidence) during reviews, with owner/admin visibility and removal rights
Requires a justification reason when revoking access, matching admin approval workflow
Makes the Select All action respect current filters so only visible users are selected
+7 moreshow less
Adds a Pending Review filter and clickable doughnut chart to focus on specific review statuses
Greys out unassigned applications in the review list to highlight actionable items
Hides MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. columns and flags when MFA data is not relevant or supported
Places newly created reviews at the top of the review list
Retains manual owner mappings automatically across future review cycles
Allows setting a review start date for the same day to enable faster turnarounds
Ensures case-insensitive email matching so users are auto-mapped regardless of casing
Scrut adds Validate Review for real-time access change verification with an Access validated column.
For integrated applications that support real-time data retrieval, adds Validate Review to trigger on-demand comparison of revocations or role changes against the external application, such as GitHub.
Adds Access validated column in the interface and export files to display validation results for applications and users
Introduces visual status indicators (green checkmarks and red crosses) with summary counts and timestamps for live discrepancy highlighting
Users can now edit the Group field for employees synced from HRIMS tools via a new button on the Employee Details page.
Adds an Edit button beside Group on the Employee Details page for changing employee groups separately from locked HRIMS-synced data; changes cannot be saved if all groups are removed.
Removes the Group field from the Edit Employee modal to simplify editing workflows.
Scrut adds MongoDB Atlas and Slack compliance tests with unified status and audit center visibility.
Adds new automated tests for MongoDB Atlas including cluster storage autoscaling, tier autoscaling, backup, encryption, dedicated nodes, and replication checks
Adds a Slack MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.-enforcement compliance test.
Adds an Asset Management test checking that the asset list tracks resources containing critical data.
Displays Automated Tests in the Audit Center side panel
Automatically adds vendors from new integrations made from January onwards and introduces a Source column.
New integrations made from January onwards are automatically added as vendors in Vendor Management, with their source identifying the integration origin.
A new Source column (hidden by default) distinguishes vendor origins: Existing, Manual, Integration, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. discovery, Intake form
Vanta adds standard TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. fields (contract amount, headquarters) and preserves evidence when merging vendors.
Adds Contract Amount and Vendor Headquarters as standard fields in Vendor Risk Management
Preserves security reviews, evidence, and findings from both sources during vendor merge operations
Drata adds Kolide integration for MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. compliance automation with customizable monitoring sources
Enables Drata to automatically collect security posture data from Kolide for five standard MDM checks: Screensaver Lock Required, Password Manager Software Installed, Malware Detection Software Installed, Security Patches Auto-Applied, and Hard-Disk Encryption Enabled on employee computers.
Allows users to customize the default monitoring source for these security monitors to any device check available in Kolide.
Adds right-click tab support for audits, client identification in nav bar during read-only mode, and synchronized logout across tabs for MSSPs and auditors.
Auditors can now right-click to open new audits in a new tab
Client name and logo are displayed in the main navigation bar while in read-only mode
Drata adds access review integrations for Box, Dropbox, and Make among others.
Adds new Access Review connections for Box, Dropbox, DropSign, Harvest, Kameleoon, Retool, Make, and Toggl to enable viewing users, roles, and groups.
Redesigns SafeBase AI Questionnaire Assistance (AIQA) user experience for greater control over AI-generated responses and transparency into answer generation.
CISO Assistant v2.3.1 adds a new Quick Start flow for Edition Enterprise
└──▷ GET THIS VERSION
$ git clone --branch v2.3.1 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.3.1
└──▷ HOW TO FIND IT
New users can access the guided onboarding flow for Edition Enterprise.
📍In the console, look for the new Quick Start option in the EE dashboard.
feat: add quick start to EE
1 detail in Everything
8 more releases in this issue
· 2025-03-05 → 2025-03-30
CISO Assistant v2.3.0 adds major incident management, PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. FR referentiel, GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. Processings register, and asset linkage
└──▷ GET THIS VERSION
$ git clone --branch v2.3.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.3.0
Adds incident management timeline and ux improvements for tracking cyber incidents over time
Adds support for the PCI DSS FR referential in compliance assessments
Introduces the GDPR Processings register for mapping processing activities
Enables linking solutions to assets within the tool's data model
Enables linking assets to applied controls for better dependency mapping
+1 moreshow less
Adds a quickstart button to accelerate initial setup workflows
CISO Assistant v2.2.13 adds Google SAIF framework, findings follow-up data visualisation, and labels for threats and controls.
└──▷ GET THIS VERSION
$ git clone --branch v2.2.13 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.2.13
Adds the Google SAIF framework to the library for use in assessments.
Adds label support for threats, reference controls, and applied controls.
New TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. dashboard, filtering assets and findings by labels, CIS KubernetesCIS KubernetesHardening benchmarks published by the Center for Internet Security for Kubernetes clusters, giving cyber tools a concrete, versioned checklist of configuration checks to run and report against. benchmark, Danish locale
└──▷ GET THIS VERSION
$ git clone --branch v2.2.12 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.2.12
└──▷ TRY IT
Enable TLS for the Helm ingress controller when deploying CISO Assistant.
Adds inherited and own related fields to the applied control detail view for better provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. tracking
Adds ingress.tls.enabled Helm chart flag to explicitly enable TLS ingress configuration
Adds filtering against labels on assets and findings, allowing queries like asset.label:production
Adds new TPRM dashboard under the third-party risk management module
Adds CIS benchmark for Kubernetes hardening to the library of controls
+1 moreshow less
Adds support for Danish language localization (da_DK)
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Assets links in the UI are renamed to reflect supported by terminology, which may require updates to bookmarks or automated scrapers targeting those specific anchors.
v2.2.10 simplifies the links view on the assets graph in the UI.
└──▷ GET THIS VERSION
$ git clone --branch v2.2.10 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.2.10
CISO Assistant v2.2.9 adds perimeters and findings batch import support
└──▷ GET THIS VERSION
$ git clone --branch v2.2.9 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.2.9
CISO Assistant v2.2.8 adds requirement inspection and a backend auditlog API; no breaking changes
└──▷ GET THIS VERSION
$ git clone --branch v2.2.8 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.2.8
inspect feature: allows inspecting individual requirements within the application.
Adds a GET /api/auditlog/ endpoint to retrieve audit logs from the backend.
CISO Assistant v2.2.6 adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. email attribute mapping fallback
└──▷ GET THIS VERSION
$ git clone --branch v2.2.6 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.2.6
Adds sso fallback to use the email attribute when nameID does not contain an email address.
Adds canary releases and parametric Gunicorn binding port to CISO Assistant v2.2.5.
└──▷ GET THIS VERSION
$ git clone --branch v2.2.5 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.2.5
gunicorn binding port is now parametric via configuration or environment variable
Portkey Data Service v1.1.4 adds Vertex batch embeddingsembeddingsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG., model logging, custom batch outputs, and TLS via env vars
Added TLS_KEY_PATH and TLS_CERT_PATH environment variables to enable internal pod-to-pod HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. communication by mounting a volume with certificate and key files.
Added support for Vertex batch embeddings as a new embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. provider capability.
Includes model information in log objects, enabling visibility into which model was used for each embedding request.
Implemented custom batch processing output generations, allowing users to define specific output formats for batch jobs.
Portkey Enterprise Gateway 1.10.12 adds Anthropic Extended Reasoning support, internal POD HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. via env vars, and new Prometheus metrics
Adds unified API signature for single-turn and multi-turn conversations with Anthropic Extended Reasoning across Anthropic, AWS Bedrock, and VertexAI.
New Prometheus metric llm_last_byte_diff_duration_milliseconds tracks LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. last byte latency for chunked JSON responses.
All Prometheus metrics now include a stream label with possible values of 0 or 1.
NeMo Guardrails v0.13.0 adds multimodalmultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. rails, Fiddler integration, and reasoning trace support
└──▷ GET THIS VERSION
$ git clone --branch v0.13.0 https://github.com/NVIDIA-NeMo/Guardrails.git
# already have the repo? check out this version:$ git checkout v0.13.0
FiddlerGuardrail integration enables low-latency hosted guardrail models for content safety and hallucination detection.
Multimodal input and output rails allow checking safety of image prompts and vision-language modelvision-language modelA vision-language model that works with images and text together, such as answering questions about a picture or describing what it contains. outputs.
New NemoGuardJailbreakDetect NIM support for jailbreak detection capabilities.
Generation metadata is now included in streaming chunks via the metadata field on chunk objects.
ToolHive v0.0.2 adds --secrets-provider keychain flag and new MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server support.
└──▷ GET THIS VERSION
$ git clone --branch v0.0.2 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.0.2
Adds --secrets-provider CLI flag with keychain value to specify the secrets backend
Adds Firecrawl MCP server to the list of supported servers
Adds Pushover MCP server to the list of supported servers
Adds hass-mcp (Home Assistant) to the list of supported MCP servers
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The formula release label is renamed from formula to vt as SLSASLSASupply-chain Levels for Software Artifacts, a framework for assessing how software was built and protecting that process from tampering. Provenance records help verify where a build came from. support is disabled.
ToolHive v0.0.1 adds vt run for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers with directory mounting, secrets management, and a vt ls alias.
└──▷ GET THIS VERSION
$ git clone --branch v0.0.1 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.0.1
└──▷ USE IT
Run an MCP server with a local directory mounted for persistent data.
shell
vt run --mount /host/path:/container/path <server-image>
Search for a specific MCP server using the new short subcommand.
shell
vt search <query>
Adds directory mounting capabilities to the vt run command for containerized tools
Adds directory mounting capabilities to the vt registry run command for containerized tools
Adds Cedar-based authorization framework support for MCP Servers
Adds basis for Kubernetes runtime execution via internal refactors
Introduces the vt search subcommand to shorten the previous search invocation
+2 moreshow less
Adds the ls alias for the existing vt registry list command
Changes the released binary name from vibetool to vt and excludes Windows builds
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The main CLI binary is now named vt instead of vibetool; scripts calling vibetool must be updated.
!Windows builds are no longer provided; users on Windows must use WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host. or another method to run the cyber tool.
SysReptor 2025.25 adds webhook-on-update events, API comment ranges, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. username support, and member search in projects.
└──▷ GET THIS VERSION
$ git clone --branch 2025.25 https://github.com/Syslifters/sysreptor.git
# already have the repo? check out this version:$ git checkout 2025.25
└──▷ TRY IT
Anchor a new comment to a specific text range in a report section via the API.
The code-oss project is an open-source code editor combining editing, debugging, and extensibility for developers across Windows, macOS, and Linux.
VS Code 1.98 adds Copilot agent mode, terminal IntelliSense, notebook edits, diagnostics commit hook, and custom title bar on Linux.
└──▷ GET THIS VERSION
$ git clone --branch 1.98.0 https://github.com/microsoft/vscode.git
# already have the repo? check out this version:$ git checkout 1.98.0
New Next Edit Suggestions (preview): Copilot predicts and surfaces the next edit you are likely to make in your code.
New Agent mode (preview): Copilot autonomously completes multi-step tasks without manual prompting for each step.
New Copilot Edits support for Jupyter notebooks, enabling iterative AI-assisted edits directly in notebook cells.
New advanced codebase search in Copilot Chat lets Copilot find relevant files across the repo to ground chat responses.
New Terminal IntelliSense (preview) provides rich, context-aware completions inside the integrated terminal.
+5 moreshow less
New drag-and-drop support for Peek References lets you open a reference directly in a new editor by dragging it.
Custom title bar on Linux is now enabled by default, bringing consistent native-style chrome to Linux users.
New Unresolved Diagnostics commit hook (preview) prompts developers when committing with outstanding errors or warnings.
Soft-delete for untracked files in source control: discarding untracked changes now moves files to the system trash instead of permanently deleting them.
Custom Instructions for Copilot is now generally available, allowing persistent, per-repo or per-user behavior tailoring.
Adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. install by digest, HTTPRoute template support, CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./memory profiling, hook log output, and resource ready status logging
└──▷ USE IT
Install a chart from an OCI registry pinned to a specific digest for reproducible deployments.
Cloudflare is a connectivity cloud platform delivering internet security, performance, and developer infrastructure services.
Cloudflare Registrar adds .ai and .shop domain support at cost with native DNS/CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server./SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. integrations
Register and renew .ai and .shop domains at cost without markups
1 detail in Everything
27 more releases in this issue
· 2025-03-01 → 2025-03-27
Cloudflare introduces beta v2 Audit Logs API with automated, standardized logging and expanded coverage.
Automates audit log generation via API Shield based on OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. schemas, removing manual logging requirements for Dashboard and public API actions.
Expands audit log coverage from 75% to 95%, including /accounts, /zones, and /organizations endpoints.
Workers now supports cpu_ms config to run for up to 5 minutes of CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. time per request.
Adds cpu_ms configuration key in Wrangler config to set Worker CPU time limits up to 300,000ms (5 minutes).
AI Gateway adds Realtime WebSockets API for persistent low-latency AI connections with OpenAI, Gemini Live, Cartesia, and ElevenLabs.
Adds the Realtime WebSockets API endpoint at wss://gateway.ai.cloudflare.com/v1/<account_id>/<gateway>/openai to enable persistent, low-latency AI interactions.
Enables real-time text and speech interactions with models from OpenAI Realtime API, Google Gemini Live API, Cartesia, and ElevenLabs through a single integration surface.
Cloudflare adds Secure DNS Locations Management User Role for granular PDNS endpoint access
Introduces the Secure DNS Locations Management User Role (Cloudflare Zero Trust) to allow external partners to administer DNS location endpoints without overprovisioning permissions
Workers AI adds toMarkdown utility method and associated REST endpoint for converting documents to Markdown.
Adds the env.AI.toMarkdown() binding in Workers AI runtime for programmatic document conversion
Exposes a new REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoint for converting PDFs and images to Markdown format
Cloudflare Agents SDK adds CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. support, client-callable methods via @unstable_callable(), and a scheduling module
Supports cors: true in routeAgentRequest to enable permissive CORS headers for Agent responses
Adds @unstable_callable() decorator for defining RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. methods callable from client code
Introduces experimental /schedule module with prompt/schema for adding scheduling to your app
New automatic risk labeling for API endpoints in Cloudflare API Shield.
Adds cf-risk-sensitive label for sensitive data detected by WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. ruleset
Adds cf-risk-missing-auth label when configured session ID is absent from requests
Adds cf-risk-mixed-auth label when some requests have session ID and others do not
Adds cf-risk-missing-schema label for endpoints with no active schema despite learned schema availability
Adds cf-risk-error-anomaly label for recent increases in response errors over 24 hours
+3 moreshow less
Adds cf-risk-latency-anomaly label for recent increases in response latency over 24 hours
Adds cf-risk-size-anomaly label for spikes in response body size over 24 hours
Adds beta labels cf-risk-bola-enumeration and cf-risk-bola-pollution for suspected BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. vulnerabilities
Adds GET /leaked_credential_checks/summary/{dimension} to retrieve summaries of HTTP authentication requests distribution across two dimensions.
Adds GET /leaked_credential_checks/timeseries_groups/{dimension} to retrieve timeseries data for HTTP authentication requests distribution across two dimensions.
Workers AI adds BGE-M3 embeddingsembeddingsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG., BGE rerankerrerankerA model that re-scores a first batch of search results against the query and reorders them, more accurately than the fast first-stage search., Whisper large-v3-turbo, and Melotts TTS models.
Adds @cf/baai/bge-m3 multi-lingual embeddings model supporting dense, multi-vector, and sparse retrieval for over 100 languages
Adds @cf/baai/bge-reranker-base, the first reranker model outputting similarity scores for RAGRAGRetrieval-augmented generation: looking up relevant documents and adding them to the prompt before the model answers. It grounds responses in private or current data without retraining. systems
Graduates @cf/openai/whisper-large-v3-turbo speech-to-text model from beta to general availability with new pricing
Adds @cf/myshell-ai/melotts, a text-to-speech model generating MP3 audio from text input
Adds nodejs_compat_populate_process_env flag to populate Worker process.env with secrets and variables
└──▷ BREAKING ON UPGRADE
!After April 1, 2025, populating process.env will become the default behavior when both nodejs_compat is enabled and compatibility_date is after 2025-04-01.
Hyperdrive connection pooling and IP access control listaccess control listAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. support reduces query latency by up to 90%
Hyperdrive pools database connections in regions near the database, reducing uncached query latency by up to 90%
Hyperdrive now connects using Cloudflare's standard IP address ranges, enabling IP access control list configuration for database firewalls
Adds the /cdn-cgi/media/<OPTIONS>/<SOURCE-VIDEO> URL pattern to transform short-form video and image files directly via HTTP requests.
Enables on-the-fly optimization of source assets (e.g., width adjustment) into optimized MP4 outputs without requiring asset migration or additional storage.
New Logpush integration for Browser Isolation tracks copy/paste, downloads/uploads, and printing actions.
Enables Logpush jobs to receive new browser isolation event types including copy, download, upload, and print within Remote Browser Isolation sessions.
New SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider./OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. fields and JSONataJSONataA query and transformation language for JSON data, maintained as an open-source project. Cyber tools use it to extract, reshape, and map JSON payloads without writing custom parsing code. transforms for Access for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. apps.
Adds OIDC Group Filtering via RegEx to control application access based on group membership
Adds OIDC Claim mapping from an IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. to map incoming identity claims to application roles
Adds OIDC token lifetime control to set the duration of OIDC tokens for Access applications
Adds Advanced OIDC auth flows (hybrid and implicit) support for broader SaaS integration coverage
Adds improved SAML attribute mapping from an IdP for more flexible identity configuration
+1 moreshow less
Adds JSONata expressions for SAML transformations to fully customize SAML identity statements sent to apps
THE CYBER TOOLCHAIN