The Cyber Toolchain — issue -017, February 28, 2025
THE CYBER TOOLCHAIN
NO. -017
Tail
THE DAILY RELEASE FIREHOSE
PUBLISHED FEBRUARY 28, 2025 · EVERY DAY
EDITIONStail|grep|head|ls|diff|uniq
The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
dnsx v1.2.2 adds DNS over SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy support for anonymous or proxied DNS resolution.
└──▷ GET THIS VERSION
$ git clone --branch v1.2.2 https://github.com/projectdiscovery/dnsx.git
# already have the repo? check out this version:$ git checkout v1.2.2
Supports routing DNS queries through a SOCKS5 proxy for anonymous or network-constrained resolution.
xnLinkFinder v6.7 adds TLDTLDThe rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type.-aware filtering and a new --all-tlds flag to control domain false-positive rates.
└──▷ GET THIS VERSION
$ git clone --branch v6.7 https://github.com/xnl-h4ck3r/xnLinkFinder.git
# already have the repo? check out this version:$ git checkout v6.7
└──▷ TRY IT
Restrict discovered domain links to a custom TLD list by editing commonTLDs in your config before running a focused engagement.
$ # In config.yml, add or trim entries under commonTLDs:
# commonTLDs:
# - com
# - io
# - net
xnLinkFinder -i https://example.com
New commonTLDs config key in config.yml (top 50 TLDs) lets users define which TLD set is used to filter discovered domain links.
New -all/--all-tlds flag returns links with any TLD, trading precision for recall when broader coverage is needed.
Extra-regex domain extraction now filters out invalid TLDs, too-short labels, and a hardcoded blocklist of common variable/JS names to cut false positives.
Excludes any discovered links that begin with a - character.
xnLinkFinder v6.5 adds TLDTLDThe rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type.-validated regex expansion and quote-encoding normalization to surface more links with fewer false positives.
└──▷ GET THIS VERSION
$ git clone --branch v6.5 https://github.com/xnl-h4ck3r/xnLinkFinder.git
# already have the repo? check out this version:$ git checkout v6.5
Adds a secondary regex pass that catches previously missed links by validating discovered URLs against a TLD check before including them.
Normalizes multiple encodings of double quotes to " before link extraction to maximize links found in encoded content.
Filters outbound requests to only follow links whose TLD is valid, reducing noise during active crawling.
BloodHound v7.0.0 adds CoerceAndRelayNTLMToSMB detection, a new vertical nav, Cypher shortcuts, and expanded posture/findings APIs.
└──▷ GET THIS VERSION
$ git clone --branch v7.0.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v7.0.0
Adds post-processing and exploitation information for the CoerceAndRelayNTLMToSMB attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. edge.
Introduces Cypher query shortcut helpers in the UI to speed up graph query authoring.
Redesigns navigation with a new vertical nav bar, including collapsible state and integrated collector downloads.
Adds a No Data alert to surface missing collection data directly in the UI.
Adds display_title and display_type fields to the finding-trends API endpoint.
+3 moreshow less
Introduces aggregated risk and posture data view on the Posture page.
Adds impact/exposure data to findings on the Posture page.
Applies consistent Kerberoastable exclusions across relevant attack path queries.
multimon-ng 1.4.0 adds partial JSON output, UTC ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability.-8601 timestamps, and FLEX offset estimation.
└──▷ GET THIS VERSION
$ git clone --branch 1.4.0 https://github.com/EliasOenal/multimon-ng.git
# already have the repo? check out this version:$ git checkout 1.4.0
└──▷ TRY IT
Suppress per-message timestamps in FLEX output when your log aggregator adds its own timestamps, reducing noise.
$ rtl_fm -f 929.0125M -s 22050 | multimon-ng -t raw -a FLEX --flex-no-ts -
Adds partial JSON output mode for structured, machine-readable decoding results.
Adds UTC ISO-8601 timestamp mode for consistent, timezone-unambiguous logging.
Adds --flex-no-ts flag to suppress timestamps in FLEX decoder output.
FLEX decoder now estimates total offset based on estimated elapsed full cycles.
Move custom generator logic to report-filters-custom.js and expose filters in the UI via subTemplatingFilters.
└──▷ GET THIS VERSION
$ git clone --branch v1.2.0 https://github.com/pwndoc/pwndoc.git
# already have the repo? check out this version:$ git checkout v1.2.0
backend/src/lib/custom/report-filters-custom.js is the new mandatory path for custom report filter definitions
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!Custom filters defined in backend/src/lib/custom-generator.js must be moved to backend/src/lib/custom/report-filters-custom.js; existing paths will stop working.
1 more release in this issue
· 2025-02-21 → 2025-02-28
SecLists 2025.1 adds new SPA filepath, IIS, password, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code., and API wordlists plus expanded coverage across existing lists.
└──▷ GET THIS VERSION
$ git clone --branch 2025.1 https://github.com/danielmiessler/SecLists.git
# already have the repo? check out this version:$ git checkout 2025.1
Adds filepaths wordlist for testing Single-page applications (SPAs).
Adds IIS default page and image files wordlist.
Adds 2024-197_most_used_passwords.txt (derived from 2024-200_most_used_passwords) to Common-Credentials.
Expands LLM data-leakage payload wordlist with more entries.
Adds missing words to API actions wordlists.
+5 moreshow less
Adds more endpoints to common.txt, including daloradius.
Adds protobuf mimetypes to relevant wordlists.
Expands combined_subdomains.txt with more subdomain entries.
Greatly expands Amounts wordlists.
Updates spring-boot.txt to cover Spring Boot v2.1.7 endpoints.
Plans Early Access Rust and Groovy support in Snyk Code, rolling out through Snyk Preview from March 3
Early Access rollout starts March 3 through Snyk Preview: adds Rust language support in Snyk Preview to scan backend web applications for security vulnerabilities in frameworks, HTTP handling, async runtimes, and database interactions.
Early Access rollout starts March 3 through Snyk Preview: adds Groovy language support in Snyk Preview to identify security risks in backend web applications using standard libraries and major web frameworks.
Plans asset-tag type visibility and removal of selected hard-coded tags in Snyk Essentials on February 26
From February 26, 2025, the Inventory and individual asset views will show each asset tag’s type.
From February 26, 2025, selected repository-name-based system tags will be removed; users can recreate their desired tagging conditions through asset policies.
Plans expanded Jakarta EE and Java EE detection in Snyk Code for March 1, 2025
Planned availability March 1, 2025: adds JMS messaging, WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output., and Mail as new sources of user-controlled data for vulnerability detection in Snyk Code.
Planned availability March 1, 2025: extends detection coverage across Jakarta EE components and sinks for enhanced security insights.
Planned availability March 1, 2025: enables recognition of sanitizers defined via ConstraintValidator annotations within the same repository.
Snyk Code PR Checks is GA across supported SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations; failed checks can gate merges through SCM configuration
C# API wrapper v25.2.10.2 adds failbuild parameter and Git URL update support
└──▷ USE IT
Ensure CI pipelines fail immediately when application artifact uploads to Veracome fail.
code
var profile = new ApplicationProfile() { GitRepoUrl = "https://github.com/example/repo", FailBuild = true };
Adds the failbuild parameter to the C# API wrapper to fail the build if an artifact fails to upload.
Adds support for updating a Git repository URL for an application profile via the C# API wrapper.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Replaced deprecated XML APIsXML APIsInterfaces for reading, writing, or querying XML documents, provided by libraries such as libxml2 or built into language runtimes; cyber tools use them to parse structured data like configs, reports, or protocol messages reliably. with REST equivalents in C# wrappers.
GitLab 17.9 adds self-hosted Duo models, parallel Pages sites, DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. UI config, composite identity, and multiple security filters.
Adds self-hosted Large Language Model support for GitLab Duo Code Suggestions and Chat via the Duo Enterprise add-on
Enables parallel deployments for GitLab Pages sites with unique prefix-based URLs and customizable expiry
Allows configuring DAST scans through the UI with granular crawl, auth, and timeout controls instead of pipeline-only config
Introduces composite identity tokens allowing AI agents to authenticate as both a service account and the initiating user simultaneously
Enables project-level application and removal of compliance frameworks via the project's compliance center
+19 moreshow less
Adds FluxCD CI/CD component support for packaging Kubernetes manifests into OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. images
Introduces inject_policy strategy for pipeline execution policies to enforce custom stages with DAGDAGA directed acyclic graph — a data structure of nodes connected by one-way edges with no cycles — used by tools to model task pipelines or data flows where execution order and dependencies must be enforced without loops. merging
Adds self_rotate scope for access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. allowing rotation without a separate request for new token generation
Adds project-level Dependency Scanning using SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. analyzer for Cargo, Conda, Cocoapods, and Swift projects via Dependency-Scanning.latest.gitlab-ci.yml
Enables multi-core Advanced SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scanning by setting SAST_SCANNER_ALLOWED_CLI_OPTS to --multi-core N
Adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching., KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use., and CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. data fields to Vulnerability Report and Vulnerability Details for risk prioritization
Adds ability to block deletion of active security policy projects linked to groups or projects
Extends Merge Request Approval Policies to allow custom roles as approvers
Adds search and filter capabilities to the Credentials Inventory, including expiration windows
Generates User authorized an OAuth application audit events when users authorize OAuth applications
Allows viewing inactive project and group access tokens for 30 days post-expiry/revocation
Displays up to the last seven IP addresses used by personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. in the UI
Adds ability to restrict GitLab Pages access at the group level via a single setting
Extends Work Items GraphQL API with filters for created/updated/closed/due dates, health status, and weight
Allows changing work item type in place and keeping the child creation form open after submission
Adds custom expiration date (expires_at) support when rotating service account tokens
Supports CI_MERGE_REQUEST_SOURCE_BRANCH_SHA, CI_MERGE_REQUEST_TARGET_BRANCH_SHA, and CI_MERGE_REQUEST_DIFF_BASE_SHA in pipeline execution policies
Adds Read compliance dashboard permission for custom roles
Allows filtering project Vulnerability Report by vulnerability identifier (CVE/CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.) with a 20,000 record limit
24 details in Everything
└──▷ BREAKING ON UPGRADE
!The inject_ci mode for pipeline execution policies is deprecated; inject_policy replaces it as the new strategy
!GitLab Composer (Gemnasium) analyzer will reach end of support in GitLab 18.0 and be removed after GitLab 19.0
New DeepSource Directory for checkers; Globstar supports Go-based checkers with tree-sitter API
Launches the DeepSource Directory, a central place to explore code quality and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. checkers across 20+ Analyzers
Enables writing Globstar checkers in Go with an all-new API for tree-sitter scope resolution and multi-file analysis
Mend SCA 25.2.1 adds isProprietary field to API 3.0 and updates Dependencies Risk Report with metadata.
Adds isProprietary boolean field to the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform API 3.0 to indicate whether a library is proprietary
Enhances the Dependencies Risk Report with organization, application, and project names on the first page
Mend SCA v25.2.1 adds isProprietary field to SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. via API 3.0 and updates risk report metadata/columns.
Introduces the isProprietary boolean field in SBOM reporting (hidden for non-proprietary libraries) via the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform and API 3.0
Enhances the Dependencies Risk Report with organization, application, and project names metadata on the first page based on scope
Adds a Last Scan column to application and project-level risk reports displaying recent scan dates
Terraform v1.11 adds write-only resource attributes, GA S3 native state locking, and JUnit XMLJUnit XMLA widely adopted test-report file format, originally from the Java JUnit framework, that records test suite results as XML; cyber tools emit it so their output plugs into CI systems like Jenkins or GitLab without custom parsers. test reports.
└──▷ GET THIS VERSION
$ git clone --branch v1.11.0 https://github.com/hashicorp/terraform.git
# already have the repo? check out this version:$ git checkout v1.11.0
└──▷ TRY IT
Run tests in CI and emit a JUnit XML report that can be ingested by test reporting tools like Jenkins or GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure..
$ terraform test -junit-xml=results.xml
Enable S3-native state locking without DynamoDB by setting use_lockfile in your S3 backend config.
Adds write-only resource attributes: providers can mark attributes as write-only so they are never persisted in state, enabling safe use of ephemeral values in those fields.
Promotes terraform test -junit-xml to general availability, producing structured JUnit XML test reports.
Promotes S3 native state locking to GA via the use_lockfile argument in the S3 backend, eliminating the need for a DynamoDB table.
Adds override_during = plan option in terraform test run blocks so mocked/overridden values are applied during the plan phase instead of only at apply.
Adds state_key attribute to run blocks in terraform test, giving test authors control over which internal state file a test run uses.
+3 moreshow less
Expands Azure backend authentication with new properties: use_cli, use_aks_workload_identity, client_id_file_path, client_certificate, and client_secret_file_path, aligning with azurerm provider auth.
Supports .netrc credentials during terraform init provider installation for registry download and shasum URLs.
Includes the ca-certificates package in the official Terraform Docker image for improved certificate handling.
nuclei v3.3.9 adds AI-powered on-the-fly template generation, a live DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Server API, and DSL expressions in headless args.
└──▷ GET THIS VERSION
$ git clone --branch v3.3.9 https://github.com/projectdiscovery/nuclei.git
# already have the repo? check out this version:$ git checkout v3.3.9
└──▷ TRY IT
Generate and run a custom detection template from plain English without writing YAML — useful for quick, ad-hoc recon during a bug bounty engagement.
$ nuclei -list h1.txt -ai "extract page titles"
Start the experimental Live DAST Server so a proxy or crawler can push requests to nuclei's fuzzer in real time during an active scan session.
$ nuclei -dts
New -ai flag generates and runs nuclei templates on the fly from natural-language prompts.
New -dts flag starts an experimental Live DAST Server API (HTTP) for real-time fuzzing at localhost:9055.
Wallarm AASM GA brings AI CVE classification, expanded detection scope, CSV/JSON export, and new risk charts.
General Availability of the API Vulnerability Scanner within Wallarm AASM
Expanded vulnerability detection covering approximately 2,500 widespread vulnerabilities and outdated software versions across web servers, frameworks, libraries, CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly. platforms, plugins, programming languages, network services, and API gateways
Vulnerability Intelligence Enrichment providing public exploit availability, in-the-wild exploitation status, ransomware campaign usage, and EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. ranking for detected issues
AI-powered CVE classification using OpenAI LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. to automatically categorize detected vulnerabilities
Wallarm adds improved SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. provisioning to manage users and roles from SSO providers.
Adds the ability to align SSO provider groups with Wallarm roles for automatic user access assignment.
NGWAFNGWAFA next-generation web application firewall that inspects HTTP traffic at the application layer, using behavioral analysis and contextual rules rather than pure signature matching to block attacks like SQLi and XSS. historical stats now expose per-request lifecycle metrics via the API
Adds ngwaf_requests_total_count to Historical Stats responses for NGWAF traffic volume
1 detail in Everything
5 more releases in this issue
· 2025-02-04 → 2025-02-26
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. agent 4.63.0 adds Alpine 3.21 support and new reverse proxy buffer config options.
read-buffer-size and write-buffer-size reverse proxy configuration options
Fastly KV StoreKV StoreA key-value store is a database that maps arbitrary keys to values with no fixed schema, offering fast lookups that cyber tools use for caching, state sharing, or configuration at scale. supports conditional delete via if-generation-match header.
Adds support for the if-generation-match HTTP header when deleting items from a KV Store
Returns 412 Precondition Failed if the item's generation does not match the supplied value
Fastly adds support for Microsoft Teams Workflows, replacing retired Office 365 connectors for WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. alerting.
BunkerWeb 1.6.0 adds mCaptcha antibot mode and a new ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. global CRS setting to speed up multi-service config generation.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.0 https://github.com/bunkerity/bunkerweb.git
# already have the repo? check out this version:$ git checkout v1.6.0
└──▷ USE IT
When you run many services and ModSecurity config generation is slow, enable the global CRS to share one ruleset across all services.
yaml
USE_MODSECURITY_GLOBAL_CRS: "yes"
Adds mCaptcha as a new antibot mode for bot protection.
New USE_MODSECURITY_GLOBAL_CRS setting lets you share a single CRS across all services instead of per-service CRS, accelerating configuration generation at scale.
2 details in Everything
0 more releases in this issue2 more releases in this issue · 2025-02-14 → 2025-02-27
cside now provides weekly automated PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. compliance reports including script justifications and security header changes for enterprise customers.
Adds automatic weekly delivery of PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. DSS compliance reports to cside enterprise customers who opted into the PCI DSS dashboard
Adds download capability for the PCI DSS report within the PCI DSS dashboard
Nexus Repository 3.77.0 adds Hugging Face proxy repos, automatic malware removal tasks, Conan v2 replication, Helm staging for Pro, and EULA API.
Adds Hugging Face Proxy repository format to manage and cache pre-trained AI/ML models
Adds Automatic Malware Management task configuration to automatically remove detected malware from proxy repositories (Pro only)
Adds Content Replication support for Conan v2 format in Pro edition
Adds Helm staging functionality for Pro customers using H2 or PostgreSQL databases
Adds status check alert for deployments using embedded H2 database when usage exceeds recommended limits
+1 moreshow less
Adds new EULA REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoint to accept Community Edition End User License Agreement during upgrade
cosign v2.4.3 adds KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. plugin support, offline signature fetching, and improved file flag completion.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.3 https://github.com/sigstore/cosign.git
# already have the repo? check out this version:$ git checkout v2.4.3
cosign v2.4.2 adds bundle/trusted-root create commands, mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. registry support, and root checksum verification.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.2 https://github.com/sigstore/cosign.git
# already have the repo? check out this version:$ git checkout v2.4.2
New bundle create helper command for creating Sigstore bundles.
New trusted-root create helper command for creating trusted root configurations.
Supports mTLS towards container registries for mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. authentication.
Adds root checksum verification in cosign initialize.
Adds UseSignedTimestamps to CheckOpts with refactored TSA options for timestamp authority verification.
+2 moreshow less
Detects whether a user supplied a valid protobuf bundle and logs a message if --trusted-root is not provided.
Updates open-policy-agent library to 1.1.0 (Rego v0 policies supported).
Socket API now accepts standard unencoded Bearer tokensBearer tokensA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. on all routes
Removes mandatory base64 encoding for Authorization: Bearer <token> headers across all API routes
Socket adds compact parameter to Batch PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. and Full-Scans API endpoints
Enables high-efficiency integrations by stripping optional data from API responses to reduce payload size
Socket SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Connector adds direct Microsoft Sentinel support for unified alerting
GuardDog v2.4.0 adds a GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. ecosystem so you can scan action packages for malicious behavior.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.0 https://github.com/DataDog/guarddog.git
# already have the repo? check out this version:$ git checkout v2.4.0
Chalk v0.5.4 adds run_secret_scanner_tools config and EXTERNAL_TOOL_DURATION env var for secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. and performance reporting
└──▷ GET THIS VERSION
$ git clone --branch v0.5.4 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:$ git checkout v0.5.4
EXTERNAL_TOOL_DURATION environment variable reports external tool duration for each invocation.
run_secret_scanner_tools configuration option collects a new SECRET_SCANNER key, currently supporting only Trufflehog.
syft v1.20.0 adds file cataloger selection config, license content inclusion in SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., and Bitnami embedded SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. support.
└──▷ GET THIS VERSION
$ git clone --branch v1.20.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.20.0
Adds file catalogers to the selection configuration, giving users explicit control over which file catalogers run.
New configuration option to include full license contents (not just identifiers) in generated SBOMs.
Supports Bitnami embedded SBOMs, enabling syft to ingest and surface pre-existing SBOM data from Bitnami container images.
infisical-cli v0.35.0 adds gateway CLI commands and a built-in KMIP server
└──▷ GET THIS VERSION
$ git clone --branch infisical-cli/v0.35.0 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical-cli/v0.35.0
Adds gateway subcommands to the CLI for managing gateway connections
Adds a built-in KMIP server accessible via the CLI
Improves heartbeat messaging feedback in the CLI
3 details in Everything
6 more releases in this issue
· 2025-02-05 → 2025-02-26
Infisical v0.112.0 adds batch upsert capability for managing secrets at scale.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.112.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.112.0-postgres
Improves UI responsiveness by switching from isLoading to isPending state handling
Adds native Databricks sync and Azure App Config/Key Vault support; auto-runs DB migrations.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.111.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.111.0-postgres
feat(secret-syncs): azure app config & key vault support enables syncing secrets from Azure App Configuration and Key Vault
Feature: Databricks Connection & Sync adds native Databricks as a secret destination for sync operations
Database migrations now run automatically at startup, removing the need for manual migration steps
Infisical v0.110.0 adds AWS Secrets Manager sync and metadata filtering for secrets.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.110.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.110.0-postgres
Adds aws_secrets_manager_sync config key to .env or environment variables to enable automatic syncing of secrets from AWS Secrets Manager
Adds GET /api/v1/secrets?metadataKey=&metadataValue= query parameters to the secrets list endpoint for filtering by metadata
Includes secret metadata fields in audit log entries
Adds AWS Secrets Manager sync and metadata-based secret filtering via API
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.108.1-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.108.1-postgres
└──▷ TRY IT
Retrieve only secrets tagged with a specific environment label via the API
v0.108.0-postgres increases the GCP service account credential length limit for identity auth.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.108.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.108.0-postgres
Increases Identity GCP authentication credential limit from 255 to platform-specific limits (e.g., ~30k+ characters).
Excludes Reserved Folders from Deep Search folder queries.
Adds a Secrets Overview page with the ability to move secrets between environments
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.107.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.107.0-postgres
TruffleHog finds, verifies, and analyzes leaked credentials across Git, chat, wikis, cloud storage, and more
TruffleHog v3.88.14 adds GitHub Realtime authentication and an Airtable Personal Access Token detector.
└──▷ GET THIS VERSION
$ git clone --branch v3.88.14 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.14
Enables GitHub Realtime authentication for live credential validation against GitHub.
New Airtable Personal Access Token detector identifies leaked Airtable PATsPATsA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. in scanned sources.
2 details in Everything
7 more releases in this issue
· 2025-02-05 → 2025-02-27
TruffleHog v3.88.13 adds an ElevenLabs analyzer for validating leaked ElevenLabs API keys.
└──▷ GET THIS VERSION
$ git clone --branch v3.88.13 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.13
Adds ElevenLabs analyzer to validate detected ElevenLabs API credentials.
TruffleHog v3.88.12 adds an Airtable OAuth Token analyzer and updates the Sendgrid analyzer.
└──▷ GET THIS VERSION
$ git clone --branch v3.88.12 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.12
New Airtable analyzer validates leaked Airtable OAuth tokens.
Updated Sendgrid analyzer with expanded analysis capabilities.
TruffleHog v3.88.6 adds Airtable OAuth detection and merges the analyze TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. into the main TruffleHog TUI.
└──▷ GET THIS VERSION
$ git clone --branch v3.88.6 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.6
New Airtable OAuth detector identifies leaked Airtable OAuth tokens during scanning.
Merges the analyze TUI into the main TruffleHog TUI, unifying the interactive interface.
TruffleHog v3.88.5 adds Auth0 and Azure refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. detectors plus a new Private Key Analyzer.
└──▷ GET THIS VERSION
$ git clone --branch v3.88.5 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.5
New Auth0 detector enables verification of Auth0 credentials found in scans.
New Azure refresh token detector identifies exposed Azure OAuth refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API..
New Private Key Analyzer inspects detected private keys for additional context and risk signals.
Release binary is now compressed with UPX, reducing download size.
Adds SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. Credentials, Azure Storage Connection String, DeepSeek API Key, Netlify Token v2, and 1Password Service Account Token detectors.
Adds smb_uri detection for SMB credentials inside a connection URI
New detector for Microsoft Azure Storage Connection String (Azure Blob Storage)
Added detector and new checker for DeepSeek API Key
New detector added for Netlify Token v2
New detector added for 1Password Service Account Token
OpenBao v2.2.0-beta20250213 adds ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. TLS provisioning, PKCS#11PKCS#11The standard programming interface software uses to ask an HSM, smart card or token to sign or decrypt with a key it holds. Supporting it lets a tool keep its keys in hardware. auto-unseal, recursive scanning via SCAN verb and scan ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource., Transit key derivation, and restores the WebUI.
└──▷ GET THIS VERSION
$ git clone --branch v2.2.0-beta20250213 https://github.com/openbao/openbao.git
# already have the repo? check out this version:$ git checkout v2.2.0-beta20250213
ACME TLS Listener Certificate Provisioning: automatically fetch TLS certificates for OpenBao Server's TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. listeners via an ACME-capable CA (RFC 8555), enabling self-hosted certificate signing [[GH-857](https://github.com/openbao/openbao/pull/857)]
PKCS#11 Auto-Unseal: add support for automatic unsealing of OpenBao using a PKCS#11-enabled HSMHSMA tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them. or KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. [[GH-889](https://github.com/openbao/openbao/pull/889)]
Scanning: introduce recursive listing within plugins with a separate scan ACL capability, the SCAN HTTP verb (with GET fallback via ?scan=true), corresponding API endpoints, CLI support, and KVv1/KVv2 engine integration [[GH-763](https://github.com/openbao/openbao/pull/763)]
Transit key derivation: add support for deriving new keys from a base key using named algorithms, currently supporting ECDH (base key as ECC private key, peer_public_key as PEM-encoded public key) [[GH-811](https://github.com/openbao/openbao/pull/811)]
WebUI reintroduction: bring back the web-based user interface for OpenBao management and monitoring [[GH-940](https://github.com/openbao/openbao/pull/940)]
+1 moreshow less
Raft non-voter nodes: allow Raft cluster nodes to join as non-voters, enabling expandable quorum structures without voting rights [[GH-741](https://github.com/openbao/openbao/pull/741)]
Launch a new ImHex window in debug mode for troubleshooting.
$ imhex --new--debug-mode
Adds the --select, --pattern, and --debug-mode command-line subcommands for scripting and automation
Adds messaging support on macOS and Linux to control a running ImHex instance via CLI flags
Adds separate font configuration options for the main UI, Hex Editor, and Pattern Editor in settings
Adds initial support for custom disassemblers defined via JSON files in ImHex-Patterns/disassemblers
Adds support for OpenGLOpenGLA cross-platform graphics API, maintained by the Khronos Group, that lets programs issue GPU draw calls through a standardized interface, giving cyber tools hardware-accelerated rendering without writing GPU-vendor-specific code. post-processing shaders by loading shader.vert and shader.frag from resource folders
5 details in Everything
4 more releases in this issue
· 2025-02-16 → 2025-02-26
ImHex v1.37.3 adds CLI messaging, custom disassemblers, post-processing shaders and ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. AppImage support.
└──▷ GET THIS VERSION
$ git clone --branch v1.37.3 https://github.com/WerWolv/ImHex.git
# already have the repo? check out this version:$ git checkout v1.37.3
└──▷ TRY IT
Open a binary in the existing ImHex instance and jump to a specific memory range via CLI
Adds --open, --select, --pattern and --debug-mode subcommands for controlling ImHex via the command line on macOS and Linux
Supports custom disassemblers defined in JSON format within the ImHex-Patterns/disassemblers directory
Enables OpenGLOpenGLA cross-platform graphics API, maintained by the Khronos Group, that lets programs issue GPU draw calls through a standardized interface, giving cyber tools hardware-accelerated rendering without writing GPU-vendor-specific code. post-processing shaders by placing shader.vert and shader.frag files in an ImHex resource folder
ImHex v1.37.2 adds --select/--pattern subcommands, messaging IPCIPCInter-process communication, ways for separate programs to exchange data or signals. Examples include pipes, sockets and shared memory., custom disassembler JSON format, and OpenGLOpenGLA cross-platform graphics API, maintained by the Khronos Group, that lets programs issue GPU draw calls through a standardized interface, giving cyber tools hardware-accelerated rendering without writing GPU-vendor-specific code. shader support
└──▷ GET THIS VERSION
$ git clone --branch v1.37.2 https://github.com/WerWolv/ImHex.git
# already have the repo? check out this version:$ git checkout v1.37.2
└──▷ TRY IT
Open a binary file and select a specific memory range from the command line for analysis
Create a new empty file to start a hex editing session via CLI
$ imhex --new
Configure a custom disassembler for ImHex by placing the JSON definition in the patterns repository
📍# Place your custom_disasm.json file in:
ImHex-Patterns/disassemblers/custom_disasm.json
Adds --open, --select, --pattern, --new, and --debug-mode CLI subcommands to control ImHex instances from the command line
Adds messaging IPC support for macOS and Linux to allow external applications to send commands (like opening files or selecting regions) to a running ImHex instance
Adds initial support for custom disassemblers via JSON format in ImHex-Patterns/disassemblers directory
Adds support for OpenGL post processing shaders by placing shader.vert and shader.frag files in ImHex resource folders
Adds option to randomize window title to avoid anti-cheat detection
ImHex v1.37.1 adds macOS/Linux messaging CLI, custom disassemblers, OpenGLOpenGLA cross-platform graphics API, maintained by the Khronos Group, that lets programs issue GPU draw calls through a standardized interface, giving cyber tools hardware-accelerated rendering without writing GPU-vendor-specific code. shaders, and ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. release.
└──▷ GET THIS VERSION
$ git clone --branch v1.37.1 https://github.com/WerWolv/ImHex.git
# already have the repo? check out this version:$ git checkout v1.37.1
└──▷ TRY IT
Open a binary in an existing ImHex instance and select memory from 0x100 to 0x200.
ImHex v1.37.0 adds HiDPI support, custom disassemblers, CLI messaging, OpenGLOpenGLA cross-platform graphics API, maintained by the Khronos Group, that lets programs issue GPU draw calls through a standardized interface, giving cyber tools hardware-accelerated rendering without writing GPU-vendor-specific code. shaders, and UTF-16/32 types.
└──▷ GET THIS VERSION
$ git clone --branch v1.37.0 https://github.com/WerWolv/ImHex.git
# already have the repo? check out this version:$ git checkout v1.37.0
Adds proper HiDPI scaling support on Windows, macOS, and Linux.
Adds native menu bar support on macOS.
Enables separate font configuration for the main UI, Hex Editor, and Pattern Editor.
Adds initial support for custom disassemblers defined via a JSON format, enabling analysis of custom instruction sets.
Adds messaging support on macOS and Linux, allowing ImHex to be controlled from the command line via flags such as --open, --select, --pattern, and --debug-mode.
+21 moreshow less
Adds a --new CLI option and a New File entry to the GNOME launcher.
Adds support for scanning binaries for UTF-8 strings.
Adds support for OpenGL post-processing shaders via shader.vert and shader.frag files placed in an ImHex resource folder.
Adds utf16 and utf32 string and char types to the Pattern Language.
Adds ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. AppImage release and a WebAssemblyWebAssemblyA binary instruction format that runs in browsers and server runtimes at near-native speed, letting developers compile C, Rust, or other languages into a portable, sandboxed module any compliant host can execute. release for self-hosting ImHexWeb.
Adds build attestation for all CI-generated artifacts.
Adds option to randomize the ImHex window title.
Adds visibility toggle to hide bookmark highlighting.
Adds option to fit hex columns to screen width.
Adds setting to disable hex editor highlights entirely.
Adds a preview to the Edit → Copy as options.
Adds Jump to address option to the data inspector row context menu.
Adds option to change the radix of numbers in the hex editor view.
Adds context menu and next/previous navigation buttons to the data inspector.
Adds option to copy data as an escaped string.
Adds shortcut for Copy as → Custom Encoding.
Pattern Language evaluator now retains as many patterns as possible when an error occurs.
Pattern Language adds cursor positions to error stack traces.
Pattern Language now displays exported global variables in output.
Pattern Language adds support for rvalue assignments inside structs.
pwndbg 2025.02.19 adds Linux kernel nftables inspection commands, LoongArch64 support, and new cymbol/dumpargs capabilities.
└──▷ GET THIS VERSION
$ git clone --branch 2025.02.19 https://github.com/pwndbg/pwndbg.git
# already have the repo? check out this version:$ git checkout 2025.02.19
└──▷ TRY IT
Dump all nftables internals on a live kernel to quickly map firewall rules during incident response.
$ knft_dump
Load struct definitions from a project header so cymbol can resolve custom types without a debug build.
$ cymbol -f /path/to/structs.h
Adds eight new kernel nftables inspection commands: knft_dump, knft_list_tables, knft_list_chains, knft_list_rules, knft_list_exprs, knft_list_sets, knft_list_objects, and knft_list_flowtables.
Adds initial LoongArch64 architecture support, using native GDB/LLDB disassemblers in the disasm context section.
The cymbol command now accepts a -f header-filepath.h flag to load symbols directly from C header files.
The dumpargs command now displays formatted bit flags, currently supporting mmap flags.
IDA and Binary Ninja integration servers can now be configured via PWNDBG_IDA_SERVER_HOST, PWNDBG_IDA_SERVER_PORT, PWNDBG_BINJA_SERVER_HOST, and PWNDBG_BINJA_SERVER_PORT environment variables.
+2 moreshow less
Adds GDB 16+ compatibility support.
LLDB gains fallback disassembly for architectures not supported by Capstone (e.g. LoongArch64), plus ported version and bugreport commands.
New pcicam command and PA-based memory functions for HyperDbg v0.13
└──▷ GET THIS VERSION
$ git clone --branch v0.13 https://github.com/HyperDbg/HyperDbg.git
# already have the repo? check out this version:$ git checkout v0.13
Adds the pcicam command to interpret PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. CAM fields
Adds support for dumping PCI CAM memory via pcicam in HyperDbg
Exports SDK functions for enabling and disabling transparent mode
Adds memcpy_pa() function to the script engine
Introduces poi_pa, hi_pa, low_pa, db_pa, dd_pa, dw_pa, and dq_pa keywords in the script engine
+1 moreshow less
Adds eb_pa, ed_pa, and eq_pa functions to the script engine
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The parameters of the !hide command have changed
!The parameters of the !unhide command have changed
!TSC mitigation for transparent mode is deprecated
CHIPSEC 1.13.10 adds MC1 register check to remap, new module archiving status, metadata tags, and dynamic log filenames.
└──▷ GET THIS VERSION
$ git clone --branch 1.13.10 https://github.com/chipsec/chipsec.git
# already have the repo? check out this version:$ git checkout 1.13.10
Adds MC1 register check to the remap module for broader memory remapping validation.
Adds archiving status tracking to the framework for test modules.
Adds metadata tags to modules and removes the MTAG prefix from module tags.
Changes default logger file name to include the entry name and timestamp (entry-yearMonDay-Time.log).
Adds Windows Server 2025 to officially supported versions.
+1 moreshow less
Changes sgx_check module result to information when CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. is a sample part, rather than a pass/fail verdict.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The MTAG prefix is removed from module tags; scripts or tooling that filter or match tags using the MTAG prefix will no longer find matches.
!The default logger file name format has changed to entry-yearMonDay-Time.log; any automation that relies on the previous default log file name pattern will need to be updated.
Corellium 7.2 adds SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider./LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. auth, VLAN tagging, Admin Activity Logger, and Android code signing checks.
Adds SAML authentication support for single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. with Identity Providers like Okta, OneLogin, and Azure AD.
Adds LDAP authentication integration to map LDAP groups to Corellium roles and centralize RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. management.
Adds VLAN tagging configuration at the project level for network isolation in on-premise deployments.
Adds a User Activity Logger in the Admin interface to track user actions for security auditing.
Adds a new check that gathers code signing artifacts from Android applications.
capa v9.0.0 adds span-of-calls dynamic analysis scope and new rule linting capabilities
└──▷ GET THIS VERSION
$ git clone --branch v9.0.0 https://github.com/mandiant/capa.git
# already have the repo? check out this version:$ git checkout v9.0.0
New span-of-calls scope matches features across a sliding window of API calls within a thread, enabling detection of multi-call behaviors like OpenFile/ReadFile/CloseFile without analyzing an entire thread.
New lint rule detects duplicate features within a single capa rule.
New lint rule catches rules that depend on other rules with an impossible scope combination.
Adds a warning when analyzing dynamic .NET samples.
New rules for RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. encryption via embedded library, BigInt function usage, and a dynamic .NET limitation guard.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The is_static_limitation method is removed from capa.rules.Rule; any code calling it will break.
!The rule format now includes the span-of-calls scope; rule files using this scope will not be compatible with older capa versions.
!Capabilities functions now return dataclasses instead of tuples; any code that unpacks the return values positionally will break.
Extract base64-encoded payloads including PowerShell Core and service-creation events, then pipe tab-separated results into a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents.-friendly CSV.
New emergency severity level: add critical system hostnames (DCs, file servers) to config/critical_systems.txt and alerts automatically escalate one tier higher, with critical becoming emergency.
New config-critical-systems command automatically discovers domain controllers and file servers and populates ./config/critical_systems.txt.
New -X, --remove-duplicate-detections option for eid-metrics and logon-summary commands to deduplicate results.
New -S, --tab-separator option in csv-timeline, search, and log-metrics commands to delimit field output with tabs.
Adds --timeline-start / --timeline-end time-range filtering options to the search command.
+3 moreshow less
Expands extract-base64 to cover PowerShell Classic EID 400 events, PowerShell Core logs, and System 7045 (Service Creation) events.
The search command gains a new -s, --sort option; results are now unsorted by default, yielding significantly lower memory usage and faster execution.
Adds RuleID field to all output profiles except minimal.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!The -s, --sort-events option is renamed to -s, --sort; any scripts or workflows using --sort-events will break.
Adds local docker compose debugging, Chrome credential parsing, ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. and Mach-O parsing
└──▷ GET THIS VERSION
$ git clone --branch 20250131 https://github.com/google/turbinia.git
# already have the repo? check out this version:$ git checkout 20250131
Adds local docker compose debugging support via a dedicated compose file configuration
Enables parsing and extracting saved Chrome credentials within Turbinia recipes
Adds ELF File Format Parsing capability for binary analysis
Adds Mach-O File Format Parsing capability for macOS binary analysis
Shuffle responder now triggers on all datatypes in Cortex-Analyzers 3.4.4
└──▷ GET THIS VERSION
$ git clone --branch 3.4.4 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.4.4
Timesketch 20250112 adds AI event summarization, Google AIStudio LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. support, CLI label/user management, and threat intel view improvements.
└──▷ GET THIS VERSION
$ git clone --branch 20250112 https://github.com/google/timesketch.git
# already have the repo? check out this version:$ git checkout 20250112
└──▷ HOW TO FIND IT
Delete a Story you no longer need directly from the sketch UI instead of via the API.
📍In the Timesketch UI, open a sketch, navigate to Stories, select the story you want to remove, and click the Delete button.
Adds Google AIStudio as a supported LLM provider alongside existing options.
New LLM-powered event summarization feature lets analysts summarize timeline events using configured AI providers.
LLM providers can now be configured per feature, giving finer control over which model backs each AI capability.
Adds response_schema support and a location parameter to the VertexAI LLM interface.
CLI gains sketch label management commands for adding, removing, and listing labels on sketches.
+8 moreshow less
CLI index information now includes field count per Timesketch index.
Enhances tsctl with user status and group membership queries.
OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. field mapping limit is now increased dynamically during CSV/JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. ingestion, removing a common import ceiling.
Star and Comment label counts in the left panel now update dynamically without a page reload.
Adds a User Settings menu to the home page.
Adds context menu and sketch creation directly from the homepage.
osdfir-infrastructure 2.1.0 adds a new OpenRelik Helm chart for Kubernetes deployments.
└──▷ GET THIS VERSION
$ git clone --branch osdfir-infrastructure-2.1.0 https://github.com/google/osdfir-infrastructure.git
# already have the repo? check out this version:$ git checkout osdfir-infrastructure-2.1.0
iLEAPP v2.1.0 adds GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. module filtering, a pre-release media manager for LAVA, and new forensic modules including call history group calls and Apple Clock stopwatch/timer artifacts.
└──▷ GET THIS VERSION
$ git clone --branch v2.1.0 https://github.com/abrignoni/iLEAPP.git
# already have the repo? check out this version:$ git checkout v2.1.0
Adds GUI module filter to quickly select or deselect analysis modules before a run.
Introduces pre-release Media Manager for LAVA, enabling media artifact handling and export across modules (voicemail, address book, app snapshots).
New Call History Group Call module extracts group call records from iOS call history.
Enhances Apple Clock artifacts with new Stopwatch and Timer artifact extraction.
Adds support for the updated Photos.sqlite database schema with report icons.
+1 moreshow less
Updates Health module with expanded artifact coverage.
ALEAPP v3.3.0 adds Bluesky, Google Keep Notes, and MeetMe Chats modules alongside a new GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. with module filtering
└──▷ GET THIS VERSION
$ git clone --branch v3.3.0 https://github.com/abrignoni/ALEAPP.git
# already have the repo? check out this version:$ git checkout v3.3.0
Adds Bluesky module for parsing Bluesky artifacts
Adds MeetMe Chats module for parsing MeetMe Chats
Adds new Graphical User Interface with module filtering
Velociraptor v0.74 ships a reworked Sigma rule editor and new live event sources for Linux and Windows.
└──▷ GET THIS VERSION
$ git clone --branch v0.74 https://github.com/Velocidex/velociraptor.git
# already have the repo? check out this version:$ git checkout v0.74
Adds a reworked Sigma rule editor for developing and testing Sigma rules directly within Velociraptor.
Adds new live event sources for Linux and Windows to power real-time Sigma-based detections.
Introduces a new timeline feature for correlating and reviewing detection events.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Elastic index names may change: sanitization rules were relaxed to align with official Elastic naming conventions, which can rename existing indexes in your pipeline.
GRR v3.4.9 adds %SystemDrive%\Users collection support; renames restricted_flow_users/groups to admin_users/admin_groups.
└──▷ GET THIS VERSION
$ git clone --branch v3.4.9.0-release https://github.com/google/grr.git
# already have the repo? check out this version:$ git checkout v3.4.9.0-release
Adds listing of %SystemDrive%\Users as a supplementary mechanism for collecting Windows user profiles alongside registry data.
Renamed restricted_flow_users and restricted_flow_groups to admin_users and admin_groups respectively.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The APIv1 is removed; you must use the v2 API (URLs containing /v2/).
!The legacy AngularJS UI (UIv1) is removed.
!ListFlowApplicableParsers API method removed.
!ListParsedFlowResults API method removed.
!ApiClient.users field removed; use ApiClient.knowledge_base.users instead.
Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. adds XDRC 1.5.0 (OpenSSL 3+) and XDRC 1.4.3 support for specific Windows versions; fixes duplicate logs.
Adds XDRC 1.5.0 collector line supporting Windows 10+ and OpenSSL 3+
Adds XDRC 1.4.3 collector line supporting Windows 8 and Server 2012 R2
Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 3.13 adds Prisma Browser integration, analytics detections, syslog/Auth APIs, and alert email fields.
Adds Prisma Browser data integration for Cortex XDR, allowing queries into browser activity and generation of detection/correlation rules
Introduces new Analytics detection suites on MacOS: Credentials grabbing, Sensitive information stealing, and AppleScript detection
Adds Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs. Activity logs as a new data source with Microsoft Graph Activity logs anomalous activity detection
Expands public API to include endpoint for deleting Cortex XDR agent installation packages
Adds new APIs for syslog server management and IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems./SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. configuration (Identity Provider and Single Sign-On) settings
+3 moreshow less
Adds Name, Description, Severity, File path, and Timestamp fields to the body of forwarded alert emails
Allows defining Endpoint tags during the creation of an agent installation package, which are applied to new agents
Enables configuration in Windows endpoints to analyze ASP and ASPX files and prevent malicious ones from being written to the file system
Supports the ed25519 algorithm to connect to private content repositories
Allows setting upgrade variables such as https_proxy using a new upgrade.conf file during engine upgrades
Adds RHEL version 9.5, Oracle Linux version 9.4, Amazon Linux 2023, and Ubuntu 24.04 to supported platforms for engine installation
Records analyst actions (commands entered in War Room and Playground) in audit logs
Allows forwarding integration logs to the Syslog server
+4 moreshow less
Allows forwarding Guard Rail alerts and warnings to the Syslog Server
Adds new administration APIs for automating engine deployment, managing syslog servers at scale, and configuring IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems./SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.
Adds support for Cortex API endpoints to edit indicators and delete batches of incidents
Enables bulk Retain/Undo Retain actions on incidents from the incidents table
Prisma Access 5.2 adds on-premises Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. support for Remote Browser Isolation policy targeting.
Enables Remote Browser Isolation (RBI) to evaluate security rules against users and user groups derived from on-premises Active Directory.
Prisma Access 5.2 adds IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Device-ID based security policies for mobile users.
Enables creation of Device-ID based Security policies specific to mobile users
Allows extension of existing Device-ID based Security policies for remote networks to include mobile users
Prisma Access 5.2 introduces Prisma SASESASEA network architecture model combining wide-area networking and network security functions into a single cloud-delivered service, letting cyber tools enforce consistent policy regardless of where users or workloads sit. 5G for agentless zero-trust security on enterprise 5G networks.
Integrates zero-trust security with 5G infrastructure to enable service providers to offer comprehensive SASE services for 5G-connected devices without agents or inline hardware.
Provides agentless authentication, flexible traffic routing, and intuitive multi-tenant management for bridging 5G authentication and SASE policy rules.
Prisma Access 5.2 introduces Third-Party NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. Integration via Traffic Replication.
Adds Traffic Replication capability for third-party Network Detection and Response (NDR) integration.
Prisma Cloud adds new CIEM/IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. RQL attributes and AWS S3 public access policies plus multiple API ingestions
└──▷ TRY IT
Investigate Azure permissions granted at the resource group level to identify broad entitlements.
$ config from iam where grantedby.level.type = 'Azure Resource Group'
Adds grantedby.level.type, grantedby.level.name, and grantedby.level.id attributes to RQL queries for IAM filtering by userPrincipalName (UPN)
Adds new CIEM capability to filter Azure resource group permissions using grantedby.level.type = 'Azure Resource Group' in RQL
Introduces three new config policies: aws-s3api-get-bucket-acl block public access bucket policy, ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. setting, and ACL write permission checks
Adds support for ingesting 26 new AWS/Azure/GCP resources including aws-apigatewayv2-authorizer, azure-data-protection-backup-vaults, and gcloud-dataproc-serverless-batch
Updates Satellite API request body to require only clusterAssetId string and config object for cluster info addition
+1 moreshow less
Deprecates GET /uve/api/v1/dashboard/vulnerabilities/overview (and v2, v3) in favor of POST /uve/api/v4/dashboard/vulnerabilities/overview
6 details in Everything
└──▷ BREAKING ON UPGRADE
!GET /uve/api/v1/dashboard/vulnerabilities/overview, GET /uve/api/v2/dashboard/vulnerabilities/overview, and GET /uve/api/v3/dashboard/vulnerabilities/overview endpoints have been deprecated in favor of POST /uve/api/v4/dashboard/vulnerabilities/overview.
Prisma Access 5.2 adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support for public apps in IP Optimization deployments
Expands IP Optimization to support IPv6 addresses for public (internet-facing) applications in existing Prisma Access deployments.
Enables dual-stack (IPv4/IPv6) address resolution and connectivity for public app services under the IP Optimization feature set.
Cortex Xpanse Expander 2.8 adds bulk asset management, dynamic protocol detection, and new IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems./SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. APIs.
Aviatrix CoPilot 4.17.0 adds IP whitelist management, DCF Kubernetes support, ExternalGroups, health views, and conntrack alerts
Adds Settings > Configuration > General > Security section for managing the CoPilot IP Access List to whitelist allowed IP addresses.
Enables Aviatrix Distributed Cloud Firewall (DCF) support for Kubernetes clusters via automated networking, security, and Kubernetes-based SmartGroups in DCF rules.
Introduces the ExternalGroups feature for creating named groups for access controls and security policies across multiple resource types via DCF, including Azure SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally., GitHub, threat feeds, and country restrictions.
Provides a comprehensive Controller & CoPilot Health view with graphs for System, Application, and Network health, service health reporting, and metric alert configuration.
Adds Conntrack Allowance Available and Conntrack Usage Rate as new metrics supported by the Alert System for monitoring connection tracking resource utilization.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Controller and CoPilot Metrics have been moved from the Performance page and are now found in Settings > Resources > System Health.
Snort3 3.7.0.0 adds extractor default filter, logging constraints, and IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. option re-use limit warnings.
└──▷ GET THIS VERSION
$ git clone --branch 3.7.0.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.7.0.0
Adds a default filter to the extractor, reducing configuration needed for common extraction scenarios.
Adds logging constraints to the extractor for finer control over extraction output.
Adds a framework interface to warn operators when the IPS option re-usage limit is being reached.
Warns on excessive detection options in IPS rules to surface over-complex rule configurations.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The base API version has been bumped — rules from snort.org require the Talos_lightSPD package from 2025-02-12-001 or later to remain compatible.
1 more release in this issue
· 2025-02-04 → 2025-02-17
Security Onion 2.4.120 adds Trend Micro & OpenCTI integrations, Zeek 7 with HTTP/2 and QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking., local lookup support, and a Connect API.
└──▷ GET THIS VERSION
$ git clone --branch 2.4.120-20250212 https://github.com/Security-Onion-Solutions/securityonion.git
# already have the repo? check out this version:$ git checkout 2.4.120-20250212
Upgrades to Zeek 7 with HTTP/2 protocol parsing and logging.
Adds OpenVPN and IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. protocol support to Zeek.
+21 moreshow less
Adds QUIC protocol support and field mappings to Zeek.
Introduces initial local lookup support for enriching events.
Introduces a Connect API for external integrations.
Adds process and file creation event mappings.
Adds a so-ip-mappings index for IP enrichment.
Enables adding annotations to existing detections.
Adds tuning notes capability to detections.
Adds detection status hunt view.
Adds ignored SIDs management in the UI.
Adds source dates display for detection rule sources.
Provides more flexibility for AutoEnable Sigma rules.
Generates MSI installer for the Security Onion agent.
Adds a local custom Logstash pipeline template support.
Adds a new limit on bulk creating related events to improve scalability.
Enables ILM (Index Lifecycle Management) on managed indices.
Adds HTTP/2 support to the Elastic Agent Logstash pipeline.
Invalidates user sessions when an admin changes a user's password.
Allows the CA certificate to be downloaded from the UI.
Makes MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. issuer name a standard (non-advanced) setting.
Refactors ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. Navigator for detections, including airgap support.
Keeps imported data in a dedicated logs-import-so index.
Malcolm v25.02.0 delivers 18x faster PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. processing, 4x faster NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. enrichment, and long-connection detection via a new Zeek plugin.
└──▷ GET THIS VERSION
$ git clone --branch v25.02.0 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v25.02.0
└──▷ USE IT
Tune long-connection detection thresholds so Zeek flags sessions exceeding 10 min, 30 min, 1 hr, and 12 hr, and suppress notices for high-volume environments.
ini
# in config/zeek.env
ZEEK_LONG_CONN_DURATIONS=600,1800,3600,43200
ZEEK_LONG_CONN_DO_NOTICE=false
ZEEK_LONG_CONN_REPEAT_LAST_DURATION=true
Raise NetBox enrichment cache limits before restarting Malcolm to sustain the 4x speedup in high-asset environments.
ini
# in config/netbox-common.env
NETBOX_CACHE_SIZE=20000
NETBOX_CACHE_TTL=600
Adds ZEEK_LONG_CONN_REPEAT_LAST_DURATION, ZEEK_LONG_CONN_DO_NOTICE, and ZEEK_LONG_CONN_DURATIONS to zeek.env to configure the new corelight/zeek-long-connections plugin.
Adds MALCOLM_NETWORK_INDEX_ALIAS and MALCOLM_OTHER_INDEX_ALIAS to opensearch.env to define index alias names required for OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. Security Analytics detectors.
Increases default NETBOX_CACHE_SIZE to 10000 and NETBOX_CACHE_TTL to 300 seconds in netbox-common.env, making NetBox enrichment approximately 4x faster.
Adds validate_local_site_policy.sh script for validating Zeek local site policy.
Adds config/env-var-actions.yml to drive automatic migration of environment variables between Malcolm versions (moving, removing, or updating keys across .env files).
+5 moreshow less
Includes corelight/zeek-long-connections Zeek plugin to log long connections, exposing a new zeek.conn.long field and updating the Connections dashboard.
Suricata processing of large sets of uploaded PCAP files is now approximately 18x faster.
Adds clear_bit field to dnp3_control.log to indicate whether the DNP3DNP3A serial and TCP/IP communication protocol used in industrial control systems, especially power grids and water utilities, to let control software poll and command field devices like sensors and switches. control code clear bit is set or unset.
Adds container health checks for live capture containers that previously lacked them.
Normalizes Windows event log (evtx) fields to more closely match Winlogbeat/Winlog fields in preparation for Sigma rule support via OpenSearch Security Analytics.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!REDIS_CACHE_HOST and REDIS_HOST have moved from netbox.env to redis.env; old values with the netbox- prefix will prevent NetBox from connecting to Redis on startup — update them to REDIS_HOST=redis and REDIS_CACHE_HOST=redis-cache before starting Malcolm.
!REDIS_CACHE_PASSWORD and REDIS_PASSWORD have moved from netbox-secret.env to redis.env.
!DB_HOST and DB_NAME have moved from netbox.env to netbox-postgres.env.
!DB_PASSWORD and DB_USER have moved from netbox-secret.env to netbox-postgres.env.
!netbox-redis-cache.env has been removed; its settings now live in redis.env.
!netbox-redis.env has been renamed to redis.env.
!CONNECTION_SECONDS_SEVERITY_THRESHOLD has been removed from lookup-common.env; replace it with the new ZEEK_LONG_CONN_* variables in zeek.env.
eksctl v0.205.0 adds EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. access entries for EKS Auto Mode, capacity-block instance market options, and Neuron device selection.
└──▷ GET THIS VERSION
$ git clone --branch v0.205.0 https://github.com/weaveworks/eksctl.git
# already have the repo? check out this version:$ git checkout v0.205.0
Adds support for creating access entries of type EC2 for EKS Auto Mode clusters.
Supports setting MarketType/InstanceMarketOptions for capacity-block reservations.
Enables separate explicit selection of Neuron Devices (distinct from GPUsGPUsA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference.) in the API.
Adds allow/deny regexp filtering in instanceSelector for fine-grained instance type control.
Re-adds support for AWS SDK environment variable keys in eksctl configuration.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The default ExecConfig API version is switched from v1alpha1 to v1beta1; configs relying on the old default may behave differently.
2 more releases in this issue
· 2025-02-01 → 2025-02-28
eksctl v0.204.0 adds automatic NVIDIA plugin for AL2023 GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. AMIs, EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. IO2 support for managed nodegroups, and Bottlerocket on Neuron instances.
└──▷ GET THIS VERSION
$ git clone --branch v0.204.0 https://github.com/weaveworks/eksctl.git
# already have the repo? check out this version:$ git checkout v0.204.0
Automatically enables the NVIDIA plugin for AL2023 GPU AMIs, removing manual setup for GPU workloads.
Adds EBS IO2 volumeType support to Managed NodeGroups for high-performance storage configurations.
Enables Bottlerocket as an OS option for Neuron instance types (Inferentia and Trainium) used in ML inference and training.
Adds a new /dev/infiniband volume mount for updated EFA plugin images to support high-performance networking.
eksctl v0.203.0 makes VGW/TGW optional when creating Hybrid Nodes clusters
└──▷ GET THIS VERSION
$ git clone --branch v0.203.0 https://github.com/weaveworks/eksctl.git
# already have the repo? check out this version:$ git checkout v0.203.0
Hybrid Nodes cluster creation no longer strictly requires a Virtual Gateway (VGW) or Transit GatewayTransit GatewayAn AWS-managed network hub that connects VPCs and on-premises networks through a single gateway, replacing complex peering meshes and giving cyber tools a central point to route or inspect cross-network traffic. (TGW) to be provided
Cloud Custodian 0.9.43 adds 11 new AWS resource types, cross-account EFS/SES filters, Shield tagging, and new Azure/Tencent resources.
└──▷ GET THIS VERSION
$ git clone --branch 0.9.43.0 https://github.com/cloud-custodian/cloud-custodian.git
# already have the repo? check out this version:$ git checkout 0.9.43.0
└──▷ TRY IT
Detect EFS file systems with cross-account access and remove the offending policy statements to enforce least-privilege.
Adds aws.lexv2-bot resource for managing Lex V2 bots.
Adds aws.timestream-influxdb resource with network-location filter for Timestream InfluxDB instances.
Adds aws.athena-work-group, aws.athena-capacity-reservation, and aws.athena-data-catalog resources for Athena governance.
Adds aws.cloudhsm-backup resource for CloudHSM backup management.
Adds aws.kafka-config resource for MSK cluster configuration.
+22 moreshow less
Adds aws.kendra resource for Amazon Kendra index management.
Adds aws.quicksight-account resource for QuickSight account settings.
Adds aws.ses-configuration-set-v2 and aws.ses-ingress-endpoint resources for SESv2 governance.
Adds cross-account filter and remove-statements action to aws.efs for detecting and remediating cross-account EFS access.
Adds cross-account filter and remove-policies action to aws.ses-email-identity.
Adds full tagging support to aws.shield-protection (tag, remove-tag, auto-tag-user, copy-related-tag, mark-for-op, marked-for-op) plus finding filter.
Adds used-by filter to aws.elastic-ip to identify in-use Elastic IPs.
Adds template filter to aws.cfn for searching CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. stack templates.
Adds is-log-forwarding filter to aws.directory for Directory Service log subscription checks.
Adds kms-key filter to aws.dms-endpoint to audit DMS endpoint encryption.
Adds configuration filter to aws.swf-domain for SWF domain configuration inspection.
Adds has-statement partial-match support via policystatement filter.
Adds support for non-default EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. event buses in aws.event-rule and event targets.
Adds azure.afd-endpoint and azure.afd-custom-domain resources for Azure Front Door management.
Adds webapp filter to azure.appserviceplan to find plans hosting specific web apps.
Adds management-policy-rules filter to azure.storage for lifecycle rule inspection.
Adds jit-policy-port filter to azure.vm for Just-In-Time access policy auditing.
Adds ability to set minimum TLS version on Azure storage buckets.
Adds support for custom namespaces in Azure metrics filter.
Adds tencentcloud.eip, tencentcloud.dns-record, and tencentcloud.subnet resources.
Adds --workspace option to c7n-left for selecting a Terraform workspace during shift-left policy evaluation.
Adds discard_local_ssd parameter support to GCP instance stop action.
Prowler 5.3.0 adds Microsoft365 provider with 5 new checks, CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. M365 benchmark, new AWS KMSAWS KMSAWS Key Management Service, Amazon's hosted service for creating and controlling cryptographic keys, giving cyber tools a durable, audited place to encrypt data without managing raw key material themselves. check, and real-time scan visibility.
└──▷ GET THIS VERSION
$ git clone --branch 5.3.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 5.3.0
└──▷ TRY IT
Audit a Microsoft365 tenant using a registered Entra app (service principal) — useful for automated pipelines where interactive login is unavailable.
$ prowler microsoft365 --sp-env-auth
List all available Microsoft365 checks before running a full assessment to understand coverage.
$ prowler microsoft365 --list-checks
Adds Microsoft365 as a new cloud provider with three authentication methods: service principal, Azure CLI, and interactive browser.
New Microsoft365 security checks: admincenter_groups_not_public_visibility, admincenter_settings_password_never_expire, admincenter_users_admins_reduced_license_footprint, admincenter_users_between_two_and_four_global_admins, and entra_thirdparty_integrated_apps_not_allowed.
Adds CIS Microsoft 365 Foundations Benchmark v4.0.0 as a new compliance framework.
New AWS KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. check kms_cmk_not_multi_region to detect Customer Managed Keys configured as multi-region.
Scans now appear immediately in the UI after launch, eliminating the previous delay for real-time visibility.
+3 moreshow less
Scheduled scan instances are created in advance with SCHEDULED state, making upcoming scans visible before they run.
Increased allowed provider UID length for Kubernetes providers to support AWS EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves., Azure AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations., and GCP GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure..
Findings API endpoints now require at least one date filter when retrieving all findings.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Findings API endpoints now require at least one date filter to retrieve all findings — queries that previously omitted a date filter will no longer return results.
ScubaGear v1.5.0 adds high-risk app/service-principal detection, privileged SP tables, report UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide., and OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic. v1.0.1.
└──▷ GET THIS VERSION
$ git clone --branch v1.5.0 https://github.com/cisagov/ScubaGear.git
# already have the repo? check out this version:$ git checkout v1.5.0
Identifies high-risk permissions held by Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. registered applications and third-party service principals, surfaced via risky_applications and risky_third_party_service_principals keys in the ScubaResults JSON file.
Adds a privileged service principals table to the Azure AD baseline HTML report.
Appends a UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. to the ScubaResults JSON filename for unique report identification.
New -Scope option on Initialize-SCuBA supports installing the module for AllUsers.
Stack traces are now included in error output for easier troubleshooting.
+6 moreshow less
HTML elements stripped from ScubaResults.json for cleaner machine-readable output.
Version update notification displayed on ScubaGear module import.
Bumps bundled OPA from v0.69.0 to v1.0.1.
SharePoint Online interactive auth now requires only Global Reader role — no longer needs SharePoint Administrator role.
Baseline MS.AAD.3.1v1 updated to include device-bound passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. language.
Baseline MS.SHAREPOINT.4.2v1 removed following Microsoft's update to custom scripting settings.
11 details in Everything
└──▷ BREAKING ON UPGRADE
!MS.SHAREPOINT.4.2v1 has been removed from the baseline due to Microsoft's update to custom scripting settings; any automation or reporting referencing this control will no longer find it.
Inspektor Gadget v0.37.0 adds execveat tracing, failed-connection filtering, richer exec fields, and expanded WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. APIs
└──▷ GET THIS VERSION
$ git clone --branch v0.37.0 https://github.com/inspektor-gadget/inspektor-gadget.git
# already have the repo? check out this version:$ git checkout v0.37.0
└──▷ TRY IT
Filter trace_exec output on a value containing a comma by escaping it, so the filter parser treats it as a single value.
$ ig trace_exec --filter 'comm=foo\,bar'
Adds execveat syscall support to trace_exec gadgets, covering exec-via-file-descriptor paths missed by execve alone.
Merges trace_tcpconnect into trace_tcp, unifying TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connection tracing under a single gadget.
Adds --failed-only option to trace_tcp to surface only failed TCP connections.
Adds dev, inode, and fupper_layer fields to trace_exec for identifying executed file identity and overlay-filesystem layer.
Adds ptid (parent thread ID) field to trace_exec events.
+11 moreshow less
Adds exepath to trace_exec output even when execution fails.
Adds additional DNS metadata fields to DNS trace output.
Provides human-readable representations of bytes and time durations in gadget output.
Adds fd field to trace_tcp events.
Adds WASM API functions to get syscall names and declarations from gadgets.
Adds WASM API support for array and hash map types.
Adds WASM API functions to interact with perf buffers.
Adds kallsymsSymbolExists WASM helper for runtime kernel symbol checks.
Allows escaping commas in filter expressions, enabling filtering on values that contain commas.
Adds support for non-unix://-prefixed socket paths in container runtime configuration.
Returns client version from kubectl-gadget even when the server is unreachable.
16 details in Everything
└──▷ BREAKING ON UPGRADE
!trace_tcpconnect is merged into trace_tcp; any scripts or workflows invoking trace_tcpconnect as a standalone gadget will need to switch to trace_tcp.
!Built-in gadgets are deprecated tree-wide; existing setups relying on built-in gadgets should migrate to image-based gadgets.
Adds --artifact-annotation flag to manifest add for annotating OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. artifact manifests.
Adds --security-opt mask and --security-opt unmask support to control path masking during builds.
Adds --no-pivot-root flag to the executor for environments where pivot_root is unavailable or undesirable.
Allows cache mounts (--mount=type=cache) to reference build stages and additional build contexts as sources.
Accepts image names as sources for cache mounts, enabling pre-populated cache layers from existing images.
+1 moreshow less
Records the hash or digest of images used in --mount into the image build history for improved reproducibility auditing.
Kata Containers 3.14 adds sandbox API support, reclaim_guest_freed_memory config for QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware./CHV, and VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space.-AP coldplug for s390x
└──▷ GET THIS VERSION
$ git clone --branch 3.14.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:$ git checkout 3.14.0
Adds the sandbox API implementation allowing external management of Kata sandboxes
Adds reclaim_guest_freed_memory configuration option for both qemu and cloud-hypervisor hypervisors to allow host reclamation of freed guest memory
Enables VFIO-AP coldplug support for s390x architectures
Mend Container 25.2.1 adds license side panel and --skip-security-checks CLI flag for leaner scans
--skip-security-checks CLI parameter excludes secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. and Reachability analysis in container scans.
New License side panel in the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform shows compliance data and sources for detected licenses.
security-profiles-operator v0.9.0 releases spoc CLI with install/uninstall commands and adds AppArmorAppArmorA Linux kernel security module, maintained as part of the kernel, that confines programs to a declared set of files, capabilities, and network access — letting cyber tools sandbox processes without writing custom kernel code. complain mode and abstract policies.
└──▷ GET THIS VERSION
$ git clone --branch v0.9.0 https://github.com/kubernetes-sigs/security-profiles-operator.git
# already have the repo? check out this version:$ git checkout v0.9.0
Introduces the spoc CLI for managing security profiles, including spoc install and spoc uninstall subcommands.
Adds complainMode field to the ApparmorProfile CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. to switch AppArmor profiles into complain mode.
Allows AppArmor profiles to use either an abstract or a concrete policy via the new abstract field in the API.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The policy field is removed from the ApparmorProfile CRD; users must now use the abstract field which automatically generates the policy before installation.
Tracee v0.23.0 adds stack_pivot and chmod_common events, unparsed flag helpers, epoch timestamps as standard
Adds the stack_pivot event type for detecting process execution context switches
Adds the chmod_common event type for monitoring permission changes
Introduces suspicious_syscall_source event to identify the origin of suspicious syscalls
Makes epoch timestamps standard (feat(time)!: epoch timestamps as standard) replacing previous time format
Removes default usage of parse-arguments, exposing raw argument values in engine output
+4 moreshow less
Adds unparsed flag helper functions GetProtoHTTPRequestByName and GetProtoHTTPResponseByName to the helpers library
Reimplements ksymbols for improved kernel symbol resolution
Converts syscall arguments to names at the processing stage instead of earlier
Enables signatures consuming other signatures in the analyze engine
9 details in Everything
└──▷ BREAKING ON UPGRADE
!The default behavior for argument parsing changes: raw argument values are now returned by default instead of being parsed, requiring consumers to update signature logic or output processing.
Tracee v0.23.0 adds stack_pivot and suspicious_syscall_source detections, chmod_common event, epoch timestamps, and kernel data filtering.
└──▷ GET THIS VERSION
$ git clone --branch v0.23.0 https://github.com/aquasecurity/tracee.git
# already have the repo? check out this version:$ git checkout v0.23.0
└──▷ TRY IT
Detect stack pivoting exploitation attempts in real time by enabling the new stack_pivot event.
$ docker run --privileged--pid=host-v /etc/os-release:/etc/os-release -v /sys/kernel/security:/sys/kernel/security aquasec/tracee:0.23.0 --events stack_pivot
Detect syscalls issued from suspicious (non-standard) memory regions to catch shellcode or injection activity.
$ docker run --privileged--pid=host-v /etc/os-release:/etc/os-release -v /sys/kernel/security:/sys/kernel/security aquasec/tracee:0.23.0 --events suspicious_syscall_source
Track all chmod-family permission change operations across processes using the new unified chmod_common event.
$ docker run --privileged--pid=host-v /etc/os-release:/etc/os-release -v /sys/kernel/security:/sys/kernel/security aquasec/tracee:0.23.0 --events chmod_common
Adds suspicious_syscall_source event to detect syscalls originating from suspicious memory regions.
Adds stack_pivot event to detect stack pivoting techniques used in exploitation.
Adds chmod_common event to track permission change operations.
Introduces epoch timestamps as the standard time format for all events.
Adds kernel-side data filtering to reduce unnecessary event data sent to userspace.
+7 moreshow less
Enables signatures to consume other signature findings in the analyze pipeline (chained detection logic).
Adds GetProtoHTTPRequestByName and GetProtoHTTPResponseByName signature helper functions for HTTP protocol inspection.
Adds EventCounts field to GetMetricsResponse in the gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. API.
Removes Rego signature support, leaving Go and Golang-based signatures as the supported path.
Removes default usage of parse-arguments, giving operators explicit control over argument parsing.
Restricts set_fs_pwdeBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. hook to (f)chdir syscalls only, reducing noise.
Adds perf event write metrics for observability of eBPF pipeline throughput.
12 details in Everything
└──▷ BREAKING ON UPGRADE
!Epoch timestamps are now the standard for all events; integrations that relied on the previous timestamp format will receive differently formatted time values.
!Rego signature support has been removed; any signatures written in Rego will no longer be loaded or executed.
!parse-arguments is no longer enabled by default; deployments that depended on automatic argument parsing must explicitly enable it.
New UK region support, Cisco Meraki/Sophos/Mimecast/REST/Kafka collectors, correlation rule statuses/descriptions, NL visualization, device context search, license PDF export
Cisco Meraki Cloud Collector available in Early Access for data collection from Cisco Meraki APIs
Mimecast Cloud Collector available in Early Access for Archive Search Logs, TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. Attachment Protection Logs, TTP Impersonation Protect Logs, TTP URL Logs, SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Logs, Archive Message View Logs, and Audit Events
Sophos Cloud Collector available in Early Access for alerts and events data sources
REST API Cloud Collector available in Early Access for data collection from REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints
Kafka Collector added to Site Collectors 2.6 for collecting logs in any text format from Kafka servers
+9 moreshow less
Archive Windows Collector added to Site Collectors 2.6 for *.gz, *.tar, *.tar.gz, *.gzip, *.rar, *.7z log files
Archive Linux Collector added to Site Collectors 2.6 for *.7z, *.arj, *.bzip2, *.cab, *.gzip, *.iso, *.lzh, *.rar, *.gz, *.tar, *.tar.gz, *.z, and *.zip log files
Correlation rules now support Stopped status (auto-disabled if triggered >50 times in 5 minutes) and Testing status (outcomes suppressed)
Correlation rules now support a user-defined description field visible in list and details views, auto-reused from templates
Threat Center Alert visualizations can be auto-created using natural language prompts via Exabeam Nova
Basic and Advanced Search now supports querying device context tables for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments., CrowdStrike, and Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.
License View dashboard adds option to export details as a PDF file
Analytics rules changes can now be applied using the Apply Changes Without Training option in bulk operations
All Threat Center cases are automatically assigned a unique numeric case ID for human-readable reference and search
14 details in Everything
└──▷ BREAKING ON UPGRADE
!Search API limit parameter no longer accepts -1; it must be a positive integer (default 3,000)
Databricks ODBCODBCA standard API, maintained by Microsoft, for connecting applications to relational databases regardless of vendor. Cyber tools use it to query databases without writing engine-specific code. 2.9.1 adds idle statement timeout and token passthrough renewal
Adds driver-side timeout option for idle statements to prevent hanging during result fetching.
Adds token renewal support for the token passthrough OAuth flow.
2 details in Everything
13 more releases in this issue
· 2025-02-05 → 2025-02-28
Databricks makes withEventTimeOrder GA for Structured Streaming Delta sources.
Adds the withEventTimeOrder option to Structured Streaming queries reading from Delta tables, enabling event-time ordering during initial snapshot processing.
DLT sinks enter Public Preview, enabling writes from pipelines to Kafka, Event Hubs, Unity Catalog tables, and Hive metastoreHive metastoreA central metadata repository, part of the Apache Hive project, that stores schema and location information for distributed data sets so query engines can discover and read structured data without hardcoding paths. tables
Adds DLT sink API in Public Preview for writing transformed pipeline data to external targets
Supports Azure Event Hubs as a sink target via the new DLT sink capability
Supports Apache Kafka as a sink target via the new DLT sink capability
Supports Unity Catalog managed tables as a sink target via the new DLT sink capability
Supports Hive metastore managed tables as a sink target via the new DLT sink capability
Sekoia.io adds out-of-beta on-prem Playbooks for local environment execution.
Enables running automation playbooks directly within a local on-premises environment via the playbook runner component.
Allows admins to orchestrate Docker-based actions (e.g., disabling Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. users) from the Sekoia platform.
Wazuh v4.11.0 adds CISA vulnerability content priority, .pkg support, and API revoke action.
└──▷ GET THIS VERSION
$ git clone --branch v4.11.0 https://github.com/wazuh/wazuh.git
# already have the repo? check out this version:$ git checkout v4.11.0
Adds CISA vulnerability content prioritized over NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. in the vulnerability scanner
Extends Syscollector to detect installed .pkg packages on macOS
Adds security:revoke permission action for the PUT /security/user/revoke API endpoint
Enhanced Recommendation Scan for Server & Workload Security replaces classic scan with improved efficiency and reliability.
Adds Enhanced Recommendation Scan to identify security rules for Intrusion Prevention, Integrity Monitoring, and Log Inspection with optimized performance.
1 detail in Everything
16 more releases in this issue
· 2025-02-01 → 2025-02-24
Trend Vision One ZTSAZTSAZero Trust Security Architecture: a network access model where no user or device is trusted by default, requiring continuous verification before granting access, letting cyber tools enforce least-privilege policies across any environment. On-prem Gateway v1.0.60 adds FTP over HTTP and OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists. stapling support
Adds FTP over HTTP protocol support for tools like PowerShell and Curl.
Adds OCSP stapling support for server certificate verification.
Agentic SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. & XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Detection Model Management adds AND/OR logical operators for custom detection model filters
Adds user synchronization to Synchronize selected users for Exchange Online in Cloud Email and Collaboration Protection
Adds the ability to add or remove users after granting Exchange Online access via the Synchronize selected users option, allowing administrators to review and adjust synchronized user lists post-provisioning.
Official release of paid AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow Log detections with unlimited credit-based ingestion.
Sophos Central Feb 10 2025 release adds AI Assistant in New AI Features EAP
Enrolls eligible customers in the New AI Features EAP to access AI Assistant, a GenAI-powered triage and investigation tool using natural language.
Provides the capability for users to interact with the Sophos XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. platform via natural language queries to accelerate case triage and investigation workflows.
Adds five new C2-related indicator types to ThreatStream detection capabilities.
Adds c2_dns_name indicator type for detecting command-and-control DNS names
Adds freq_abused_dns_provider indicator type for identifying frequently abused DNS providers
Adds mal_relay_server_ip indicator type for malicious relay server IPs (IPv4)
Adds mal_relay_server_ipv6 indicator type for malicious relay server IPs (IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only.)
Adds suspected_c2_dns_name indicator type for suspected C2 DNS names
OpenCTI 6.5.0 adds TAXII 2.1TAXII 2.1An OASIS-standard HTTP-based protocol for exchanging cyber threat intelligence, letting cyber tools publish and subscribe to structured threat data across organizations without custom integration work. Push ingester, outcome template support, exclusion lists, and EE license key enforcement.
└──▷ GET THIS VERSION
$ git clone --branch 6.5.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.5.0
TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. Push ingester enables exposing TAXII 2.1 data collections for pushing STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form.-formatted data
New capability to create customizable finished intelligence templates with container variables and entities (Enterprise Edition)
Ability to import and export outcome templates across platforms
Managements of dissemination lists for sending PDF documents via email (Enterprise Edition)
Restrict access to a container using the authorized member mechanism (Enterprise Edition)
+11 moreshow less
Revamped AI module available across all platform entities with activity summaries and logs
Correlation views redesigned to allow correlation between all container types
List widgets in dashboards now support selecting and reordering columns in knowledge & entity perspective
Notifications can be filtered on the trigger via label click or filter selection
Enhanced Knowledge views for Attack Patterns with a relation view
OpenBAS integration updated to specify architecture when creating injects, replacing deprecated mutations
Integration of GraphQL playground for testing and interacting with the GraphQL API
Performance improvements through worker thread pool control and relocating lock handling to a separate process
New connectors: Tenable Security Center, Google SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation.SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., Proofpoint ET Pro Rep List, Spycloud, Zvelo, YARA Import Files, Loader Insight Agency File Feed, Intel471-V2, Zscaler ZIA, IBM XTI, Hunt.io, Wiz
Docker containers now accessible via GitHub Container Registry in addition to Docker Hub
16 details in Everything
└──▷ BREAKING ON UPGRADE
!Upgrading a platform with Enterprise Edition activated and without a valid license key will result in the full de-activation of all EE features due to the new license key system.
!The obasContainerGenerateScenario, obasThreatGenerateScenario, and obasVictimGenerateScenario mutations are deprecated and replaced by obasContainerGenerateScenarioWithInjectPlaceholders, obasThreatGenerateScenarioWithInjectPlaceholders, and obasVictimGenerateScenarioWithInjectPlaceholders respectively.
!The signature and response format of the deprecated OpenBAS GenerationScenario mutations have changed, introducing new SimulationConfig and GenerationResponse objects.
TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. dashboard now supports malware type selection; Malware and Threat Actor Insight Cards gain new data fields.
Adds the ability to select any malware type in the TTP dashboard
Adds affected platforms to Malware Insight Cards
Adds threat actor motivation to Threat Actor Insight Cards
3 details in Everything
1 more release in this issue
· 2025-02-05 → 2025-02-19
Cloudmersive Private Cloud Virus API v10-1-2 adds ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. executable detection and logging enhancements.
Introduces enhanced detection of ELF executables for malware scanning
IntelOwl v6.3.0 adds UltraDNS and WAD analyzers, a data model visualizer, playbook flow UI, and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. Docker support.
└──▷ GET THIS VERSION
$ git clone --branch v6.3.0 https://github.com/intelowlproject/IntelOwl.git
# already have the repo? check out this version:$ git checkout v6.3.0
└──▷ HOW TO FIND IT
Detect web technologies on a domain using the new WAD analyzer to fingerprint frameworks, CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly., or CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. in use.
📍In the IntelOwl UI, submit a URL or domain observable, then select the WAD analyzer from the analyzer list before running the scan.
Enrich a domain or IP with UltraDNS passive DNS data as part of a DNS investigation playbook.
📍In the IntelOwl UI, submit a domain or IP observable and select the UltraDNS analyzer (requires UltraDNS API key configured in PluginConfig).
New UltraDNS analyzer for DNS-based threat intelligence lookups.
New WAD (Web Application Detector) analyzer for identifying technologies on web targets.
New data model visualizer surfaces structured entity mappings in the UI.
New frontend data model mapping view for navigating analysis results by entity type.
Adds playbook flow visualization in the frontend, enabling users to explore and build possible playbook chains.
+3 moreshow less
Advanced search improvements expand filtering and query capabilities in the job list.
ARM architecture support added to Docker integrations, enabling deployment on ARM-based hosts.
Updates abuse.ch service integrations (MalwareBazaar, ThreatFox) including configurable timeout parameters.
Yeti 2.3.0 introduces RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. and changes API key handling
└──▷ GET THIS VERSION
$ git clone --branch 2.3.0 https://github.com/yeti-platform/yeti.git
# already have the repo? check out this version:$ git checkout 2.3.0
Adds Role-Based Access ControlRole-Based Access ControlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC)
Changes API key generation and usage mechanics
2 details in Everything
└──▷ BREAKING ON UPGRADE
!New API keys will have to be regenerated for all users
Lookyloo v1.28.0 adds headed browser capture, CIRCL Passive DNS triggering, indexing of IPs/TLDs, and capture push to other instances
└──▷ GET THIS VERSION
$ git clone --branch v1.28.0 https://github.com/Lookyloo/lookyloo.git
# already have the repo? check out this version:$ git checkout v1.28.0
└──▷ HOW TO FIND IT
Enable a local lacus instance to run interactive, headed browser captures instead of headless ones.
📍"Edit config/generic.json and set \"allow_headed\": true, then restart the app. In the Web UI, untick 'Use headless browser' under Capture configuration."
Trigger a headed capture via API with a custom interaction timeout.
MSTICPy v2.16.0 adds Prisma Cloud data driver, Cyberint TI provider, and certificate auth for OData drivers
└──▷ GET THIS VERSION
$ git clone --branch v2.16.0 https://github.com/microsoft/msticpy.git
# already have the repo? check out this version:$ git checkout v2.16.0
Adds PrismaCloudDriver for querying Prisma Cloud assets, configurations, and events via its CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. API within MSTICPy workflows.
Adds Cyberint as a new Threat Intelligence provider for IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. lookup via the Cyberint API.
Adds certificate authentication support for OData-based drivers (Microsoft Defender and Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs.).
Adds experimental Azure Monitor search driver with support for custom tables (tracked as issue #831).
MISP v2.4.205 adds quick overcorrelation search, a sync-rule test widget, and org-UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.-based sync filtering.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.205 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.4.205
└──▷ HOW TO FIND IT
Evaluate how many events would be filtered by your current sync rules before pushing to a remote instance — use the new Test Sync Rules widget in the MISP UI.
📍In the MISP console, go to Sync Actions › Servers, select a remote server, and open the Test Sync Rules widget to see the count of events matched or filtered by the current synchronization filtering rules.
Adds quick search for overcorrelations to speed up data investigation and correlation management.
New Test Sync Rules widget lets users evaluate how many events are filtered under current synchronization rules before applying them.
Sync filtering now uses organization UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. instead of names, reducing ambiguity in event propagation rules.
Expands Galaxy Cluster search scope to include fields beyond synonyms, improving search flexibility.
MISP v2.5.7 adds quick overcorrelation search, a sync-rule test widget, and org-UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.-based sync filtering.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.7 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.7
└──▷ HOW TO FIND IT
Validate how many events your current sync rules would filter before pushing to a remote MISP instance — navigate to the sync server settings and use the new widget.
📍In the MISP UI, go to Sync Actions › List Servers, open a server entry, and use the new Test Sync Rules widget to see the count of events that would be filtered by the configured synchronization rules.
Adds quick search for overcorrelations, enabling faster investigation and management of over-correlated data.
New Test Sync Rules widget lets users evaluate how many events would be filtered under current synchronization filtering rules before applying them.
Sync filtering now uses organization UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. instead of names, reducing ambiguity in multi-org synchronization configurations.
Expands Galaxy Cluster search scope beyond synonyms to additional fields, improving search flexibility and accuracy.
Sigma r2025-02-03 adds 5 new detection rules covering Azure conditional access bypass, LDAPNightmare, and Windows event log tampering.
└──▷ GET THIS VERSION
$ git clone --branch r2025-02-03 https://github.com/SigmaHQ/sigma.git
# already have the repo? check out this version:$ git checkout r2025-02-03
New rule: detects Azure Login Bypassing Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. Policies.
New rule: detects CVE-2024-49113 (LDAPNightmare) exploitation attempts.
New rule: detects suspicious binaries and scripts placed in public folders.
New rule: detects suspicious shell invocation via Rsync.
New rule: detects Windows Event Log access tampering via the registry.
+3 moreshow less
Updated Exploit Framework User Agent rule to include the default Havoc C2 user agent string.
Updated Shell Execution via Rsync (Linux) rule with more generic logic covering additional shells.
Updated Suspicious Windows Service Tampering rule with additional monitored services.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!The Windows Defender Exclusion Deleted rule has been removed and will no longer fire on upgrade.
dev-v0.4.0 adds ~30 new detection rules across AWS, Azure, and Linux kernel/process auditing.
└──▷ GET THIS VERSION
$ git clone --branch dev-v0.4.0 https://github.com/elastic/detection-rules.git
# already have the repo? check out this version:$ git checkout dev-v0.4.0
New Rule Adding Coverage for Self-Created Login Profile for Root Accounts in AWS
New Rule Adding Coverage for Azure Entra MFA TOTP Brute Force Attempts
New Rule Endpoint Security Promotion Rules for Specific Events
New RulePAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Version Discovery
New Rule Pluggable Authentication Module Creation in Unusual Directory
+21 moreshow less
New Rule Unusual SSHD Child Process
New Rule Unusual Preload Environment Variable Process Execution
New Rule Loadable Kernel Module Configuration File Creation
New Rule Simple HTTP Web Server Creation
New Rule Simple HTTP Web Server Connection
New Rule Kernel Object File Creation
New Rule Dynamic Linker (ld.so) Creation
New Rule Pluggable Authentication Module Source Download
New Rule SSH via Backdoored System User
New BBR Linux System Information Discovery via Getconf
New Rule Suspicious Path Invocation from Command Line
New Rule System Binary Path File Permission Modification
New Rules Kernel Seeking/Unpacking Activity
New Rule Process Started with Executable Stack
New Rule GRUB Configuration File Creation
New Rule GRUB Configuration Generation through Built-in Utilities
New Rule Adding Coverage for AWS SQS Queue Purge
New Rule Adding Coverage for AWS EC2 Deprecated AMI Discovery
New Rule Adding Coverage for SNS Topic Message Publish by Rare User
New Rule Adding Coverage for Unusual AWS S3 Object Encryption with SSE-C
[Deprecation] Deprecating Potential Password Spraying of Microsoft 365 User Accounts
dev-v0.3.0 introduces new detection rules, hunting queries, and a prerelease source connector.
└──▷ GET THIS VERSION
$ git clone --branch dev-v0.3.0 https://github.com/elastic/detection-rules.git
# already have the repo? check out this version:$ git checkout dev-v0.3.0
Adds sentinel_one_cloud_funnel as a prerelease version for the data source
Adds investigation guide generation capability via [FR] Generate investigation guides
Adds new detection rule for Execution of a downloaded windows script
Adds new detection rule for Process Backgrounded by Unusual Parent
Adds new detection rule for Suspicious Usage of bpf_probe_write_user Helper
+47 moreshow less
Adds new detection rule for File with Right-to-Left Override Character Created/Executed
Adds new detection rule for Unusual D-Bus Daemon Child Process
Adds new detection rule for Adding Coverage for AWS S3 Unauthenticated Bucket Access by Rare Source
Adds new detection rule for Polkit Version Discovery
Adds new detection rule for Polkit Policy Creation
Adds new detection rule for Unusual Pkexec Execution
Adds new detection rule for NetworkManager Dispatcher Script Creation
Adds new detection rule for D-Bus Service Created
Adds new detection rule for Manual Dracut Execution
Adds new detection rule for Dracut Module Creation
Adds new detection rule for OpenSSL Password Hash Generation
Adds new detection rule for Boot File Copy
Adds new detection rule for Initramfs Unpacking via unmkinitramfs
Adds new detection rule for Initramfs Extraction via CPIO
Adds new detection rule for Systemd Shell Execution During Boot
Adds new detection rule for GRUB Configuration Generation through Built-in Utilities
Adds new detection rule for GRUB Configuration File Creation
Adds new detection rule for Process Started with Executable Stack
Adds new detection rule for Kernel Seeking/Unpacking Activity
Adds new detection rule for System Binary Path File Permission Modification
Adds new detection rule for Suspicious Path Invocation from Command Line
Adds new detection rule for Linux System Information Discovery via Getconf
Adds new detection rule for Adding Coverage for SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. Topic Message Publish by Rare User
Adds new detection rule for Adding Coverage for AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Deprecated AMI Discovery
Adds new detection rule for Adding Coverage for AWS SQS Queue Purge
Adds new detection rule for Sensitive Audit Policy Sub-Category Disabled
Adds new detection rule for Potential Process Name Stomping with Prctl
Adds new detection rule for SSH via Backdoored System User
Adds new detection rule for Pluggable Authentication Module Source Download
Adds new detection rule for Dynamic Linker (ld.so) Creation
Adds new detection rule for Kernel Object File Creation
Adds new detection rule for Simple HTTP Web Server Connection
Adds new detection rule for Simple HTTP Web Server Creation
Adds new detection rule for Loadable Kernel Module Configuration File Creation
Adds new detection rule for Unusual Preload Environment Variable Process Execution
Adds new detection rule for Unusual SSHD Child Process
Adds new detection rule for Pluggable Authentication Module Creation in Unusual Directory
Adds new detection rule for PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Version Discovery
Adds new detection rule for Endpoint Security Promotion Rules for Specific Events
Adds new detection rule for Adding Coverage for Azure Entra MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. Brute Force Attempts
Adds new detection rule for Adding Coverage for Self-Created Login Profile for Root Accounts in AWS
Adds new detection rule for Adding Coverage for AWS STSAWS STSAWS Security Token Service, an Amazon Web service that issues short-lived credentials for IAM roles, letting tools authenticate to AWS APIs without storing long-term secrets. AssumeRoot by Rare User and Member Account
Adds new hunting query for IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Unusual Default Aviatrix Role Activity
Adds new hunting query for Persistence via Initramfs
Adds new hunting query for Persistence via GRUB Bootloader
Adds new hunting queries for AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. Unusual AWS Access Key Usage for User
Adds deprecation warnings for Experimental ML commands
Tenzir is a data pipeline engine for security teams that collects, transforms, enriches, and routes telemetry.
Tenzir v4.29.0 adds duration parsing, print functions, and chart null-value support
int() and uint() now accept a base option for hexadecimal string parsing.
New years, months, weeks, days, hours, minutes, seconds, milliseconds, microseconds, and nanoseconds functions convert numeric values to durations, with corresponding count_* variants.
abs() function calculates absolute value for numbers or durations.
New any.print_json() and any.print_yaml() print any value as a string.
New record.print_kv(), record.print_csv(), record.print_ssv(), record.print_tsv(), and record.print_xsv() print records in respective formats.
+8 moreshow less
write_xsv operators now accept multi-character separators.
New write_kv operator writes events as Key-Value pairs.
The sep argument on flatten and unflatten functions is now a positional argument.
read_* operators and parse_* functions use the unflatten_separator option instead of unflatten.
XSV operators and functions use named arguments field_separator, list_separator, and null_value instead of field_sep, list_sep, and null_value.
read_kv operator and parse_kv function use named arguments field_split and list_split.
write_ndjson output is more compact without unnecessary whitespace; write_json no longer prints trailing whitespace after commas.
chart_area, chart_bar, and chart_pie operators now allow null values, previously only supported by chart_line.
13 details in Everything
└──▷ BREAKING ON UPGRADE
!The unflatten option on many read_* operators and parse_* functions is renamed to unflatten_separator.
!field_sep, list_sep, and null_value options on XSV operators and functions are renamed to field_separator, list_separator, and null_value respectively.
2 more releases in this issue
· 2025-02-10 → 2025-02-25
Beelzebub v3.3.5 refactors the LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Plugin with a new declarative YAML API supporting OpenAI and Ollama providers.
└──▷ GET THIS VERSION
$ git clone --branch v3.3.5 https://github.com/mariocandela/beelzebub.git
# already have the repo? check out this version:$ git checkout v3.3.5
└──▷ USE IT
Deploy an SSH honeypot that responds to any command using a locally-hosted Ollama model — no OpenAI key or internet access required.
New declarative plugin: block in honeypot YAML config lets you specify llmProvider (openai or ollama), llmModel, and openAISecretKey directly per-service.
Supports Ollama as an LLM backend alongside OpenAI, enabling self-hosted, air-gapped LLM-powered honeypots.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The LLM Plugin API has been refactored; existing honeypot configs using the prior LLM plugin configuration format must be updated to the new plugin: block structure with llmProvider, llmModel, and openAISecretKey fields.
1 more release in this issue
· 2025-02-13 → 2025-02-18
Beelzebub v3.3.3 adds TLS support for HTTP honeypot listeners.
└──▷ GET THIS VERSION
$ git clone --branch v3.3.3 https://github.com/mariocandela/beelzebub.git
# already have the repo? check out this version:$ git checkout v3.3.3
Supports TLS-based HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. connections for HTTP honeypot services.
Splunk Security Content v5.1.0 adds 4 analytic stories and 41 new detections spanning RMM abuse, S3 hijacking, Cisco Secure Endpoint tampering, and Windows audit policy manipulation.
└──▷ GET THIS VERSION
$ git clone --branch v5.1.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v5.1.0
New analytic story: Remote Monitoring and Management Software — detects unauthorized RMM tool usage (AnyDesk, TeamViewer) via phishing and drive-by compromise.
New analytic story: AWS S3 Bucket Security Monitoring — tracks public S3 bucket decommissioning, access attempts, and potential bucket hijacking using CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. logs, DNS queries, and web proxy data.
New analytic story: Security Solution Tampering — covers Cisco Secure Endpoint service inhibition, disabling, and modification techniques.
New analytic story: Windows Audit Policy Tampering — detects auditpol.exe abuse, registry-based audit policy changes, and audit log clearing.
Adds 6 new Office 365 detections: email transport rule changes, file access/download/sync exfiltration, multi-OS authentication anomalies, and suspicious SharePoint search behavior.
+9 moreshow less
Adds detections for Cisco Secure Endpoint tampering: stopped services, Immunet service manipulation via sfc.exe, and uninstall attempts.
Adds Windows audit policy detections covering disabled, cleared, restored, excluded-category, and security-descriptor-tampering scenarios via auditpol and registry.
New endpoint detections: Windows RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. network brute-force, process execution from removable media, process execution in Temp directory, suspicious driver load paths, suspicious process file paths, and USBSTOR/WPDBusEnum registry modifications.
New PowerShell detections: malicious string matching in both process command lines and script block logging, backed by a new malicious_powershell_strings lookup.
New Telegram C2 detection: Potential Telegram API Request Via CommandLine.
New Windows compatibility telemetry detections: suspicious child processes and registry-based tampering.
New baseline: Baseline Of Open S3 Bucket Decommissioning for tracking S3 buckets before deletion.
Adds windows_suspicious_services lookup and new macros (important_audit_policy_subcategory_guids, normalized_service_binary_field, process_auditpol, windows_exchange_iis) to support new detections.
Adds a dashboard dropdown to the navigation bar in the Splunk Security Content UI.
Cribl Stream 4.10.1 adds sensitiveFields API filter, v2 Prometheus parser, and Datadog counter conversion.
Adds sensitiveFields configuration property to filter sensitive information in /inputs and /outputs API responses
Adds prometheusParser: v2 config option to the Prometheus Remote WritePrometheus Remote WriteA protocol for streaming time-series metrics from a Prometheus instance to a remote storage backend, letting cyber tools offload long-term metric retention and query load to a dedicated system. Source for ~2.5x throughput improvement
Adds Datadog Destination option to send counter metrics as count
NodeZero February 2025 adds MTTR trends, CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. filtering, ZMap scan speed tuning, Shadow Credential attack content, and Add Once, Later scheduling.
Adds Mean-Time-To-Remediation (MTTR) trend charts in Insights for weaknesses that have been mitigated
Adds CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. filtering option in NodeZero Insights to display only CISA Known Exploited VulnerabilitiesCISA Known Exploited VulnerabilitiesA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing CVEs confirmed to have been actively exploited in the wild, which cyber tools use as a high-signal prioritization feed for patching and scanning.
Adds Scan Options menu with Normal (1500 pps) and Slow (150 pps) ZMap scope discovery settings
Adds Shadow Credential Attack content leveraging GenericAll/GenericWrite permissions for privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources.
Adds Add Once, Later scheduling option for pentest templates to increase setup flexibility
New GCP credential-access technique: simulate bulk retrieval of a high number of Secret Manager secrets (gcp.credential-access.secretmanager-retrieve-secrets).
Caldera 5.1.0 adds payload management UI, cron-based schedule management, planner update API, and AD user format support.
└──▷ GET THIS VERSION
$ git clone --branch 5.1.0 https://github.com/mitre/caldera.git
# already have the repo? check out this version:$ git checkout 5.1.0
└──▷ HOW TO FIND IT
Manage payloads (upload, list, delete) through the Caldera web UI.
📍In the Caldera console, navigate to Payloads and use the new Manage Payloads interface to upload or remove payload files.
New payload management feature lets operators manage payloads through the Caldera UI.
Adds cron-based schedule management, with API support for creating and updating schedules.
New API functionality to update planners via the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
Adds user_format_string setting to support Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. user authentication.
Adds Rich logging and build warnings for improved operator visibility during startup.
Rapid7 February 2025 adds On-Prem API integrations for Surface Command, custom IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. query filters, Chronological Search in InsightIDR, and new UI for Credits Management.
Adds on-premise API Integrations to Attack Surface Management (Surface Command) to ingest asset, identity, vulnerability, and exposure data from private IT systems like Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments.
Introduces ~250 custom query filters for Cloud Formation in Cloud Security (InsightCloudSec) via the Security > Query Filters UI path
New connectors added to Attack Surface Management: Action1 Vulnerability Management, ESET PROTECT Platform, Cloudflare, JumpCloud, Red Hat Insights, and SOTI MobiControl
Adds Chronological Search in SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. (InsightIDR) > Log Search to view event logs in time order for investigation
Adds alert triage capabilities in SIEM (InsightIDR) > Alerts including filtering, bulk actions, and contextual grouping
+6 moreshow less
New Credits Management UI in Digital Risk Protection (Threat Command) at Settings > Subscription for tracking service credits
Configurable Credential Alert Timeframe in Digital Risk Protection (Threat Command) at Configurations > Customization > Company Credentials Policies
Adds automated MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for Macro workflow in Application Security (InsightAppSec) and Exposure Command
Adds Vulnerability Proof view in Remediation Hub to see concrete vulnerability evidence before assigning fixes
Adds exportable solution reports feature in Remediation Hub at Command Platform > Response & Remediation > Remediation Hub
Adds Security Context from Attack Surface Management to Remediation Hub for holistic asset risk view
SploitScan v0.13.0 adds Gemini/Grok/DeepSeek AI support, local CVE DB sync, keyword search, and a fast mode.
└──▷ GET THIS VERSION
$ git clone --branch v.0.13.0 https://github.com/xaitax/SploitScan.git
# already have the repo? check out this version:$ git checkout v.0.13.0
└──▷ TRY IT
Use DeepSeek for AI-powered risk assessment instead of the default OpenAI provider.
$ sploitscan CVE-2024-1234 --ai deepseek
Search for all CVEs related to a vendor keyword across local and remote sources, with automatic exploit correlation.
$ sploitscan --keywords "Apple"
Run a quick triage of a CVE list in CI without waiting for exploit, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching., or AI lookups.
Adds --ai option to select AI provider for risk assessment: OpenAI ChatGPT, Google Gemini, xAI Grok, or DeepSeek.
Adds --local flag to clone or pull updates from the full CVE List V5 repository for offline/local CVE lookups.
Adds --keywords flag to search for CVEs by keyword (e.g., a vendor or product name) across the local CVE database, CISA, and Nuclei Templates, with automatic exploit correlation.
Adds --fast-mode flag to limit output to basic CVE info, skipping exploit lookups, EPSS scoring, and AI risk assessments for faster results.
4 details in Everything
1 more release in this issue
· 2025-02-01 → 2025-02-25
Adds --ai option for multi-AI provider support, local CVE cloning via --local, keyword search with --keywords, and fast mode output via --fast-mode.
└──▷ GET THIS VERSION
$ git clone --branch 0.13.0 https://github.com/xaitax/SploitScan.git
# already have the repo? check out this version:$ git checkout 0.13.0
└──▷ USE IT
Perform risk assessment using Google Gemini instead of the default provider.
shell
sploitscan --ai google-gemini <target>
Search for CVEs containing Apple across local and remote sources.
shell
sploitscan --keywords Apple
Quickly scan a target with basic CVE info only, skipping exploit/EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. lookups.
shell
sploitscan --fast-mode <target>
Adds --ai option to select AI providers (OpenAI, Gemini, Grok, DeepSeek) for risk assessment
Implements local CVE database management with --local flag to clone or update the CVE List V5 repository
Introduces --fast-mode option to limit output to basic CVE info and bypass additional lookups
DefectDojo v2.43.2 adds async CLI import, connector min severity config, and dedup logic updates.
└──▷ USE IT
Run a non-blocking import so the CLI returns immediately while processing continues in the background.
shell
defectdojo-cli import --background-import
Configure a connector to only ingest findings at High severity or above.
config
minimum_severity: High
(CLI Tools) Added a background-import flag to allow for asynchronous imports or reimports.
(Connectors) Users of Burp, SonarQube and Dependency-Track Connectors can now set a minimum Severity level for Findings to limit the amount of data imported via Connector.
(Pro UI) Tests and Risk Acceptances can now be added directly from the All Tests / All Risk Acceptances lists.
DefectDojo 2.43.1 adds MGASA vulnerability ID support and clarifies nullable SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. days in the API spec.
└──▷ GET THIS VERSION
$ git clone --branch 2.43.1 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.43.1
Adds MGASA vulnerability ID support as a recognized vuln ID source.
API spec now correctly documents that SLA days remaining can be null.
DefectDojo 2.43.0 adds two new SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. parsers, NoseyParker v0.22 support, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. range filters, split disclaimers, and granular verified-status toggling.
└──▷ GET THIS VERSION
$ git clone --branch 2.43.0 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.43.0
New HCL AppScan on Cloud SAST parser for importing cloud SAST results.
New Checkmarx CxFlow SAST parser for importing CxFlow pipeline findings.
Advances NoseyParker parser to support version 0.22.0.
Adds ALBA as a supported vulnerability ID type in vulnid handling.
Adds range filters for EPSS scores on findings.
+10 moreshow less
Adds imageTags support to AWS SecurityHub and Inspector2 parsers.
Wiz parser now imports findings regardless of status.
Split disclaimers feature: disclaimers can now be configured separately per context.
Verified Status Toggle gains granularity controls.
API prefetching of multiple endpoints now returns all prefetch models.
Notes on Findings are now supported for Simple Risk Acceptance.
Mitigated On/Before/After filters now use DateTimeFilter for precise date-time filtering.
Helm chart supports adding a custom local_settings.py via a new option.
Django service type is now configurable in Kubernetes deployments.
Kubernetes resources support additional annotations.
15 details in Everything
└──▷ BREAKING ON UPGRADE
!All dc- convenience scripts have been dropped; any automation referencing them will break.
!Django AuditLog upgraded to 3.x, which may require settings or migration changes — consult upgrade notes.
Edgescan adds configurable report filters for assessment type and CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. scoring, plus improved plugin component support.
Adds the ability to specify assessment_type when filtering reports in the UI/API
Allows cvss scores to replace exf scoring in generated reports
Increases visibility into assessment progress status for paused assessments
Enhances Edgescan & Jira plugin to allow specifying component information
4 details in Everything
1 more release in this issue
· 2025-02-04 → 2025-02-26
Tenable One OT Exposure 4.1.38 adds overlapping IP support, IEC substation SCD import, AI detections, NERC-CIP dashboard, and bulk Nessus scan controls.
Supports IEC 61850 protocol analysis for OT asset discovery
Displays CVSSv3 scores on the Findings and Vulnerabilities tables via a new column
Allows bulk enabling or disabling of sensor active query behavior
Maps NERC CIP controls in the Compliance dashboard
Enables centralized updates for paired ICPs from the Enterprise Manager
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Field ntpChange is removed from object type FlagList
!Field ntpFault is removed from object type FlagList
!Field ntpServersUnreachable is removed from object type FlagList
!Argument keepNetworkConfig: Boolean! is removed from field Mutation.factoryReset
!Field setSystemTime is removed from object type Mutation
2 more releases in this issue
· 2025-02-05 → 2025-02-20
Tenable One Identity Exposure 3.88 adds AD Exchange misconfiguration detection and improved UI export/localization
Adds Indicator of Exposure (AD) — Exchange Dangerous Misconfigurations to list misconfigurations impacting Exchange resources or underlying Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. schema objects.
Allows selection of custom columns in the Exposure Overview for data export.
Tenable One Identity Exposure adds new IoE detections and the Exposure Center interface for identity security posture.
Introduces Exposure Center, a new feature within Tenable One Identity Exposure that provides an Exposure Overview, Exposure Instances, and Findings view to identify identity security weaknesses.
Artemis v3.5.0 adds passive DNS integration for orphaned domain detection and ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. scanning support
└──▷ GET THIS VERSION
$ git clone --branch v3.5.0 https://github.com/CERT-Polska/Artemis.git
# already have the repo? check out this version:$ git checkout v3.5.0
Adds Detecting cases where a domain has been removed but a server still hosts it via passive DNS server configuration
Adds Support of ASN scanning as a new scanning capability
Brinqa 11.29.200 adds password length config, fullscreen container rendering fixes, and refined CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. risk calculation.
Adds a Length field to the Password type attribute configuration, enabling admins to set the minimum password length for the Brinqa Platform
Enables Administrator and Security administrator roles to CREATE, READ, UPDATE, and DELETE any saved queries
Adds UTC indicator to date column headers in exports for discrete date and time formats
Adds Download and Refresh buttons on the Subnets tab in host details views
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The NIST NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. connector is no longer supported in Brinqa Platform version 11.28 or later, requiring users to switch to Brinqa Risk Intelligence.
1 more release in this issue
· 2025-02-11 → 2025-02-24
Brinqa 11.29.177 enforces unique emails for users, adds BQL validation on export, and updates Risk Intelligence CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. ingestion.
Updates Brinqa Risk Intelligence to ingest more CPE records
Adds a check for invalid BQL in data export so exports no longer run when the query is malformed
Apple Business Manager profiles gain settings to skip correspondent page and control Apple Intelligence/Lockdown Mode/Web Content; Windows app editing uses Get Store ID.
└──▷ HOW TO FIND IT
Configure an Apple Business Manager profile to skip the correspondent page for iOS devices.
📍In the console, go to Policies › Profiles › Apple Business Manager and set Skip Corresponder Page to Yes.
Fill in the Windows app Store ID automatically instead of relying on the removed API.
📍In the console, go to Apps › Windows apps › Edit <App Name> and click Get Store ID to fetch the identifier.
Adds configuration options in Apple Business Manager profiles to skip the correspondent page in the setup assistant for iOS, iPadOS, and macOS
Adds controls in Apple Business Manager profiles for Apple Intelligence, Lockdown Mode, and Web Content Filtering settings that apply to iOS and iPadOS only
Replaces the Get data button with a Get Store ID button on the Edit Windows app page to automatically fill in the Store ID
Adds bash interpreter support for script execution on hosts.
Adds API endpoint for updating script contents.
Adds ability to target App Store apps with include/exclude labels.
Adds ability to edit targets or self-service option for App Store apps.
Adds exclude_fleet_maintained_apps option to GET /api/v1/fleet/software/titles.
+10 moreshow less
Adds download URL for Fleet-maintained apps as url property on GET /api/fleet/software/fleet_maintained_apps/:id.
Adds option to populate users and labels on the list hosts endpoint.
Adds fleetctl Linux ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. binary to releases.
Disk encryption keys are now archived (never deleted) when created or updated.
Includes current host status and pending action in lock, unlock, and wipe API responses.
Disables webhooks automatically when not present in GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. configuration.
Adds gzip compression for static CSS and JS assets to decrease bundle download times.
Adds details modal for add, edit, and delete App Store app global activities.
Adds modal to edit script contents in the UI.
Replaces Include Fleet desktop checkbox with host-type radio buttons when adding Windows or Linux hosts.
15 details in Everything
└──▷ BREAKING ON UPGRADE
!The fleetctl binary has been removed from the fleetdm/fleet Docker image.
1 more release in this issue
· 2025-02-04 → 2025-02-18
Fleet 4.63.0 adds VPP app installs on policy failure, CloudFront CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. delivery for installers, and platform-filtered software dropdowns.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.63.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.63.0
└──▷ HOW TO FIND IT
Trigger automatic VPP app installation when a host fails a policy — configure via the Fleet UI on the policy's failed-action dropdown.
📍In the Fleet console, go to Policies › <your policy> › Actions on failure, then select a VPP app from the automatic installation dropdown.
Enables delivery of bootstrap packages and software installers via signed CloudFront CDN URLs using three new server settings: s3_software_installers_cloudfront_url, s3_software_installers_cloudfront_url_signing_public_key_id, and s3_software_installers_cloudfront_url_signing_private_key.
Adds the ability to install VPP apps automatically on policy failure, with auto-install information surfaced on the VPP app details page.
Adds platform-specific filtering in the software dropdown for failed-policy auto-install, showing only software compatible with each policy's targeted platforms.
Supports filtering software titles by 'any of these platforms' in GET /api/v1/fleet/software/titles.
Adds a timestamp for host count last update time on software, OS, and vulnerability detail pages.
+4 moreshow less
Persists each user's column display selection for the hosts table using new user-level settings.
Includes a host's team-level queries when targeting a specific host via the host details page.
Displays command-line installation instructions when a package is generated.
Adds a fallback for extracting app names from .pkg installers with default or incorrect title attributes in their distribution file.
runZero 4.0.250213.1 auto-redirects SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.-only self-hosted logins to the IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.
SSO-only self-hosted installations now automatically redirect to the identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. on login
ProjectDiscovery Cloud v1.0 introduces dynamic asset groups, multi-select filters, AI labeling, and Nuclei CLI integration for template generation
Adds automated TLS certificate probing via tlsx, ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. metadata integration via asnmap, and exposed IP discovery via uncover during onboarding and all discoveries.
Enables creation of dynamic asset groups from saved filter selections to organize discovered assets.
Introduces new multi-select filters for assets and support for negative search parameters in the platform UI.
Adds AI-powered automatic labeling and categorization based on screenshots and HTTP metadata.
Provides a universal exclusion mechanism for specific templates or targets in future vulnerability scans and asset discovery runs.
+1 moreshow less
Improves template writing and management with an enhanced API and integration with Nuclei CLI via the -ai flag for on-the-fly generation.
WinGet v1.10.320 adds --locale flag to show, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. auth for REST sources, and COM API source management.
└──▷ GET THIS VERSION
$ git clone --branch v1.10.320 https://github.com/microsoft/winget-cli.git
# already have the repo? check out this version:$ git checkout v1.10.320
Adds --locale argument to the show command to filter output language
Adds end-to-end support for Entra ID authentication when using a private WinGet REST source
Implements source management capabilities in the WinGet COM API
Auto-lock policies now apply to standalone browser extensions and OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. saving triggers unlock prompts.
Extends auto-lock policy enforcement to 1Password browser extensions that are not integrated with the desktop app
Adds automatic unlock prompt and save flow for one-time passwords (OTPs) detected in QR codes when the extension is locked and Offer to save one-time passwords automatically is enabled
2 details in Everything
6 more releases in this issue11 more releases in this issue · 2025-02
1Password SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Manager Feb 2025 adds license overview, threshold alerts, history, Drata/GroWrk/Sigma integrations and UI changes
Adds a comprehensive Licenses overview list to the admin console for visibility into utilization across apps
Adds configurable threshold alerts that automatically notify admins when remaining licenses drop below a set value
Adds a History view in the license UI to track historical data for license costs and user counts with automatic recalculation on contract changes
Adds Drata, GroWrk, and Sigma as new integration connectors for SaaS Manager
Adds a currency picker to the spend report allowing admins to convert and view values in different currencies
+1 moreshow less
Updates Assets section to be renamed Devices across the interface
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The Assets section and related UI labels are now renamed to Devices
1Password for Mac adds location fields, default expiry alerts, and passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices./search filters in beta.
Adds Item Location setting under Settings > Privacy to enable location fields and nearby item display on Home screen
Adds default expiry alerts based on item category
Adds passkey and location search filter suggestions triggered by typing = in the search bar
1Password for Android 8.10 Beta adds Anti-Peek Mode and passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices./location search filters
Adds Anti-Peek Mode to conceal important details in the app UI
Adds default expiry alerts based on item category
Adds passkey and location search filter suggestions triggered by entering '=' in the search bar
1Password for Windows beta adds custom SSH URL command, passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices./location search filters, and identity-based username suggestions.
Adds customCommand configuration to open bookmarked SSH URLs with a user-defined executable
Adds = prefix in the search bar to reveal passkey and location filter suggestions
Enables email address from saved Identity items as the suggested username for new entries
1Password for iOS adds Anti-Peek Mode via Labs settings, plus new search filters and SSH agent warnings.
Adds Anti-Peek Mode in Settings > Labs to conceal item details on screen
Adds default expiry alerts based on the category of an item
Adds passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. and location search filter suggestions via the equals sign “=” in the search bar
Shows a warning callout in the SSH Agent page when 6 or more keys are enabled
Nudge Security adds bulk selection to update multiple SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. accounts simultaneously via the UI.
Nudge Security adds customizable notification rules for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. account activity by country of origin.
Adds customizable notification rules to alert admins on SaaS app and account activity originating from companies headquartered in countries of security interest
Uses proprietary security vendor profiles to filter and target alerts based on organization-established standards
Topaz v0.32.54 adds AuthZENAuthZENAn OpenID Foundation working group specification that standardises the API between policy enforcement points and policy decision points, letting cyber tools swap authorization engines without rewriting integration code. Access Service draft-03 support and updates identity resolution
└──▷ GET THIS VERSION
$ git clone --branch v0.32.54 https://github.com/aserto-dev/topaz.git
# already have the repo? check out this version:$ git checkout v0.32.54
4 more releases in this issue
· 2025-02-06 → 2025-02-27
Topaz v0.32.53 introduces AuthZENAuthZENAn OpenID Foundation working group specification that standardises the API between policy enforcement points and policy decision points, letting cyber tools swap authorization engines without rewriting integration code. Access service draft-03 and API Gateway 2 infrastructure.
└──▷ GET THIS VERSION
$ git clone --branch v0.32.53 https://github.com/aserto-dev/topaz.git
# already have the repo? check out this version:$ git checkout v0.32.53
Adds AuthZEN Access service draft-03 as a new capability to the access control engine
Introduces api gateway 2 as a new architectural component for routing requests
Topaz v0.32.50 adds the AuthZENAuthZENAn OpenID Foundation working group specification that standardises the API between policy enforcement points and policy decision points, letting cyber tools swap authorization engines without rewriting integration code. access service and moves the controller into the core binary.
└──▷ GET THIS VERSION
$ git clone --branch v0.32.50 https://github.com/aserto-dev/topaz.git
# already have the repo? check out this version:$ git checkout v0.32.50
JumpCloud SaaS ManagementSaaS ManagementA category of software that tracks, governs, and optimises an organisation's portfolio of SaaS subscriptions, covering spend, access, and licence utilisation from a single control plane. V2 adds Connector-driven shadow IT detection, manual app addition, and CSV export
Adds Connectors for API-driven shadow IT detection for Google Workspace, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., and Slack in SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Management V2
Adds the ability to add SaaS apps manually in SaaS Management V2
Adds CSV export functionality for SaaS management reporting
Stytch introduces Connected Apps to make any app an OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms./OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. via dashboard and SDK
Introduces Connected Apps feature allowing applications to act as compliant OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0/OIDC Identity Providers
Adds ability to configure Client types, Custom scopes, Custom claims, Secret rotation, PKCEPKCEProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier., and Redirect URLs for Connected Apps
Enables issuing access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions., transferring authentication state, and authenticating AI agents via the new Connected Apps integration
Ory Network and Ory Hydra OEL can revoke token chains through DELETE /admin/oauth2/auth/sessions using consent_request_id.
Adds consent_request_id query parameter to the DELETE /admin/oauth2/auth/sessions endpoint to revoke all tokens bound to a specific OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. consent session.
1 detail in Everything
2 more releases in this issue
· 2025-02-24 → 2025-02-25
Ory Network adds FedCM support for Google and NetID SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. with new Browser API endpoint
Adds a new Ory Network endpoint that returns FedCM parameters including SSO provider config URLs, a nonce encoding the provider ID, and a CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. token for use with navigator.credentials.get
Enables Google and NetID SSO via Federated Credential Management (FedCM) standard in Ory Network
Adds new pre-hydrated relative URL feature in core.
└──▷ GET THIS VERSION
$ git clone --branch version/2025.2.1 https://github.com/goauthentik/authentik.git
# already have the repo? check out this version:$ git checkout version/2025.2.1
Acronis Cyber Protect combines backup, disaster recovery, and endpoint protection in one platform for businesses and managed service providers.
WinRE recovery, M365 XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. integration, device geolocation, agent management enhancements in v2025-02
Adds WinRE-based pre-boot environment for bare-metal recovery on modern hardware (NVMe RAIDRAIDA storage architecture that combines multiple physical disks into one logical volume using mirroring, striping, or parity to trade capacity for redundancy, speed, or both., wireless/Ethernet adapters) with a configurable file to choose between Linux and Windows reboot environments.
Adds agentless backup support for Windows Server 2025 Hyper-V virtual machines.
Enables Direct Microsoft 365 integration with Advanced XDR, providing automated file enrichment across SharePoint Online, OneDrive, Teams, and Exchange Online.
Extends security incident email notifications to all devices under a child tenant, covering Active Protection, Antimalware protection, and EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.-related alerts for various administrator roles.
Adds geolocation tracking of devices via Remote management plans, supporting OS-based and IP geolocation for Windows, macOS, and Linux.
+2 moreshow less
Introduces Enforce automatic update for unsupported versions option in Agent Update settings to auto-update outdated agents to the second-to-last stable version.
Allows partner-level visibility and management of customer agents within the Cyber Protect console, removing the need to switch to the management portal or individual customer tenants.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!/api/ams/ REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. is deprecated and will be removed one year after Phase 1 announcement (May 2024), requiring migration to the new public REST API.
Veeam Kasten is a Kubernetes-native platform for backing up, restoring, and migrating containerized applications and their persistent data.
Kasten K10 7.5.3 adds policy visibility in the app details panel and NetApp ONTAP-NAS-Economy snapshot export support.
└──▷ HOW TO FIND IT
Quickly identify which backup policies cover a namespace without leaving the application view.
📍In the Veeam Kasten dashboard, navigate to Applications, select an application, and open its details panel to see the list of policies selecting that namespace.
Adds support for exporting NetApp ONTAP-NAS-Economy volume snapshots created using Trident CSICSIAn ambiguous acronym spanning Container Storage Interface, Crime Scene Investigation, and other expansions — without more context about which domain this tool operates in, a reliable definition cannot be given. v24.10.0 or later.
Improves the Application details panel in the Veeam Kasten dashboard to show which policies are selecting that namespace.
Druva is a SaaS data protection platform that backs up enterprise workloads, endpoints, and SaaS applications and restores them after ransomware.
Druva MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. adds centralized restore activity reports for Endpoints and multiple SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. workloads in Managed Services Center
Adds Endpoints Restore Activity Report to the Managed Services Center (MSC) for centralized monitoring.
Adds Hybrid Workloads Restore Activity Report to the Managed Services Center (MSC) for centralized monitoring.
Adds Microsoft 365 Restore Activity Report to the Managed Services Center (MSC) for centralized monitoring.
Adds Microsoft 365 SharePoint Online Restore Activity Report to the Managed Services Center (MSC) for centralized monitoring.
Adds Microsoft 365 Teams Restore Activity Report to the Managed Services Center (MSC) for centralized monitoring.
+4 moreshow less
Adds Microsoft 365 Groups Restore Activity Report to the Managed Services Center (MSC) for centralized monitoring.
Adds Microsoft 365 Public Folder Restore Activity Report to the Managed Services Center (MSC) for centralized monitoring.
Adds Google Workspace Shared Drive Restore Activity Report to the Managed Services Center (MSC) for centralized monitoring.
Adds Google Workspace User Restore Activity Report to the Managed Services Center (MSC) for centralized monitoring.
9 details in Everything
8 more releases in this issue
· 2025-02-08 → 2025-02-28
Druva adds API access for six Salesforce backup activity reports and optimizes backups to exclude non-creatable/updatable system objects
Adds API support for Backup Activity (sfdcBackupActivity), Data Restore Activity (sfdcDataRestoreActivity), Archival Activity (sfdcArchivalActivity), Archival Restore Activity (sfdcArchivalRestoreActivity), and Sandbox Seeding Activity (sfdcSandboxSeedingActivity) reports in the Druva Cloud Platform Console.
Optimizes SFDC backup by excluding Non-creatable and Non-updatable system objects from the backup dataset.
inSync Client v7.5.6 adds proxy activation support; eDiscoveryeDiscoveryA legal process for identifying, collecting, and producing electronically stored information in response to litigation or investigation; cyber tools integrate with it to extract and preserve forensic evidence in legally defensible formats. API gains legalHoldTypeIds filter; Cyber Resilience UI refreshed
activate inSync Client using proxy details allows proxy configuration during manual activation to eliminate delays
legalHoldTypeIds filter available on List Legal Hold Policies v4 API for targeted policy search
Druva MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. adds AWS Native Workloads backup support and direct Power BI template download in MSC Console
Enables seamless backup and restore of AWS Native Workloads, including cross-region and cross-account capabilities.
Adds the ability to download the MSP Power BI Template directly from the MSC Console's Downloads section.
Acronis Cyber Infrastructure is hyperconverged software that pools storage, compute, and networking on commodity servers, often as a backup storage target.
Acronis Cyber Infrastructure 6.3 Update 1 adds dynamic chunk allocation, pre-update storage warnings, and five new guest OS families.
└──▷ HOW TO FIND IT
Apply the 6.3.1-91 update and receive pre-update storage/redundancy warnings before any node is released.
📍In the admin panel, go to SETTINGS › UPDATES, then initiate the update. If storage space or redundancy thresholds are at risk, a warning is displayed before the update proceeds.
Adds dynamic allocation of a new chunk when the current chunk's server runs out of space, reducing write failures during data streaming.
Introduces a proactive warning before node release or cluster update if the operation would leave insufficient storage space or compromise data redundancy.
Adds guest OS support for Ubuntu 24.04 LTS, Debian 11.x and 12.x, CentOS 9.x Stream, and Oracle Linux 8.x and 9.x (Unbreakable Enterprise Kernel and Red Hat Compatible Kernel).
Strengthens SSH remote access security by enforcing restrictions on key configuration parameters to reduce brute-force and unauthorized-access risk.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Kubernetes 1.27 is no longer supported; update to version 1.29 or newer.
!The Compute API HTTP status code for failures has changed: 502 is now returned instead of 521.
Netskope Private Access Publisher 123.0.0.9194 now supports Ubuntu 22-based container images and AliCloud hosting.
Provides an OVA/VHDX Hosting on the Alicloud with downloadable publisher images for OVAOVAAn Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. and VHDX formats from AliCloud OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees..
1 detail in Everything
4 more releases in this issue
· 2025-02-03 → 2025-02-10
NPA Publisher v134 adds Global Attributes UI, prelogon multi-CA cert check, and dynamic PoP reconnection via GSLB.
Adds a Global Attributes button in Settings > Security Cloud Platform > Publishers to toggle supported NPA feature flags directly from the Tenant UI.
Enables Private Access Pre-logon validation of device certificates against multiple Certificate Authorities (CAs) within a single Client configuration.
Introduces Dynamic Reconnection based on relative latency, using the GSLB API service to steer traffic away from Publishers during maintenance or outages.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The manual auto-reconnect feature has been deprecated; publishers now rely on GSLB-managed thresholds instead of customer-configured manual settings.
Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. V2 support for additional user attribute imports in Netskope Adapter 212.251.11.
Adds Active Directory V2 mode to the Directory Importer for importing additional user attributes
Netskope 123.0 adds Next Gen API protection for ChatGPT Enterprise, SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. NGL where expressions, and OS family criteria in Real-Time Policies.
Adds where expression support in Netskope Governance Language (NGL) for SSPM rules to target specific resources more efficiently.
Enables manual remediation actions (Quarantine, Delete, Restrict Access) directly from the DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Incident page in Next Generation API Data Protection.
Extends Next Generation API Data Protection to ChatGPT Enterprise, supporting policy creation, DLP, and threat protection for this app.
Allows real-time protection policies to use custom Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. attributes synced via the directory importer as policy criteria.
Adds Source IP as a valid policy criterion for NPA Browser Access applications.
+7 moreshow less
Enables DLP policy application for NPA Browser Access method through real-time policies.
Expands RBI isolation scope to allow admin-defined isolate policies for any web destination without error/warning prompts.
Allows exporting Muted By, Muted Until, and Muted Justification fields from the SSPM Findings page.
Adds a DEM Dashboard for Email DLP service health visibility (Controlled GA).
Supports SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.memberof values to auto-populate group memberships, create pre-defined groups, or map friendly names in NG SWGSWGA Secure Web Gateway is a network proxy that inspects outbound web traffic, enforcing policy by blocking malicious sites, filtering content, and decrypting TLS — giving cyber tools a choke point for all user HTTP/S sessions..
Introduces the nsdiag -e command option with return code support (0 for success) and error messaging for secure enrollment troubleshooting.
Provides a new Device Status Page Read Operation via APIv2 for devices.
12 details in Everything
└──▷ BREAKING ON UPGRADE
!Deprecated OS criteria in Real-Time Policies will be eventually removed; admins must migrate to OS family manually.
!Dedicated Real-time policies for Microsoft Docs.com, GCC Docs.com, Sway, StaffHub, Skype for Business, GCC Skype, Office 365lync Online, GCC Yammer, and GCC Office Delve will not function from R124.
Cyera adds direct email sending from issue pages to accelerate data risk remediation
Enables security teams to send in-app email notifications directly from an issue page within the Cyera platform, removing the need to manually contact data owners.
Adds Direct Send Emails capability for accelerated data risk remediation workflows.
ZIA adds Admin/Role, User, Traffic Forwarding API endpoints; supports ED25519 for Incident Receiver and HTTP/2 in SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection by default.
Adds GET /adminRoles, POST /adminRoles, PUT /adminRoles/{roleId}, and DELETE /adminRoles/{roleId} to the Cloud Service API for admin role management
Adds GET /departments, POST /departments, PUT /departments/{departmentId}, and DELETE /departments/{departmentId} to the Cloud Service API for department management
Adds GET /groups, POST /groups, PUT /groups/{groupId}, and DELETE /groups/{groupId} to the Cloud Service API for group management
Adds GET /subclouds and PUT /subclouds/{id} to the Cloud Service API for subcloud configuration
Enables the Enable HTTP/2 option by default in SSL Inspection rules where available
+1 moreshow less
Adds ED25519 support to Zscaler Incident Receiver configuration
Adds Claroty xDome Healthcare connector for OT/IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. vulnerability data.
Adds Claroty xDome Healthcare connector to retrieve security posture and vulnerability data for OT/IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. assets
Adds support for the Claroty xDome Healthcare connector integration to retrieve asset inventory and risk scores.
ZIA adds DNS Block with Response Code action/API, Webex Teams real-time DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., NSS country log fields, and POST /exportPolicies API endpoint.
└──▷ TRY IT
Export all configured policy rules to JSON files for backup or migration.
$ POST /exportPolicies
Adds BLOCK_WITH_RESPONSE action to DNS Control policy and new Response Code field for selecting the response value sent to the client
Updates Cloud Service API with new POST /exportPolicies endpoint to export policy rules to JSON files
Adds new attributes blockResponseCode to the FirewallDnsRule model in the Cloud Service API to specify the DNS response code
Enables real-time DLP support for messages and file attachments sent via Webex Teams
Adds SSH key support for ED25519 in Zscaler Incident Receiver configuration
+8 moreshow less
Increases maximum department scope limit for ZIA admins and super admins to 2,048 departments
Enables HTTP/2 by default when configuring an SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection rule
Expands predefined Credit Card dictionary and EDM data type to support China UnionPay and Maestro formats
Adds Web Insights Logs filters and columns for Source IP Countries, Destination IP Countries, and their risk indicators
Adds NSS Feed Output Format fields %s{srcip_country}, %s{dstip_country}, %s{is_src_cntry_risky}, and %s{is_dst_cntry_risky} for web logs
Enhances IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Report to include IoT policy status, statistics, and deep-dive into action impact on domains/IPs for discovered devices
Increases Sandbox Detail Reports API quota to 3,000 requests per day with rate limits of 2/sec and 1,000/hour
Adds firewall control and logging capabilities for tenant-to-tenant roaming guest user scenarios
Zscaler DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Azure AI Foundry visibility, new data posture policies for PostgreSQL and SQL, unmanaged MSSQL scanning, and granular Azure onboarding.
Adds data inventory visibility for sensitive data exposed to Azure AI Foundry Hub and machine learning workspaces via storage accounts.
Introduces 27 new data posture policies for Azure PostgreSQL Flexible Server, covering public exposure, authentication, logging, VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. access, backup redundancy, and ransomware susceptibility.
Adds four new data posture policies for Azure SQL Server addressing insecure web app access, deprecated runtimes, insecure FTP/SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. credentials, and VNET integration gaps.
Adds support for onboarding and scanning unmanaged Microsoft SQL Server (MSSQL) databases hosted on Azure virtual machines to identify misconfigurations and posture issues.
Enables onboarding of Azure Management Groups during tenant setup to scan subscriptions when tenant-level restrictions exist.
+1 moreshow less
Allows selective onboarding of specific Azure services (e.g., storage accounts, databases) to minimize permissions during the onboarding process.
DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Azure AI data exposure visibility, unmanaged MSSQL scanning, Management Group onboarding, and new posture policies.
Adds Azure AI Foundry and Storage Account association visibility to the Data Inventory page for sensitive data exposed to Azure AI services.
Adds unmanaged Microsoft SQL Server (MSSQL) database support for onboarding and scanning via DSPM, with results displayed on the Data Inventory page.
Adds Onboard Management Groups capability during Azure onboarding to scan subscriptions within them when tenant-level onboarding is restricted.
Adds Onboard Azure Services option to select a subset of supported services (e.g., storage accounts, databases) for minimal-permission monitoring.
ZIA adds Complexity column, filter, and Failed Controls Remediation graph to Advanced SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. Posture page.
Adds a Complexity column to the Advanced SSPM Posture page table, displaying the complexity level of each control in the Control Panel header.
Adds a Complexity filter to the Advanced SSPM Posture page, allowing users to filter displayed controls by their complexity level.
New integration allows Zscaler Cloud Connector to use HashiCorp Vault for secret management on GCP
Adds HashiCorp Vault as a supported secret store option for new Zscaler Cloud Connectors on Google Cloud Platform (GCP), replacing the requirement for GCP Secret Manager.
Updates GCP Terraform scripts to version v0.2.0 to support the HashiCorp Vault integration workflow.
Introduces a new Cloud Connector image (zs-cc-ga-02022025) in Google Cloud Marketplace containing the updated code for HashiCorp Vault support.
Zscaler Client Connector Portal 4.3.2 adds M365/AVD bypass for Z-Tunnel 2.0, language selection, and macOS posture intervals
Supports application bypasses for Microsoft 365 and Azure Virtual Desktop to bypass traffic for Zscaler Tunnel (Z-Tunnel) 2.0.
Adds the ability for users to select their preferred language in the Zscaler Client Connector Portal including German, Japanese, Spanish, French, and Simplified Chinese.
Supports configurable posture check intervals for macOS devices.
ZIA adds DC exclusion API endpoints, Block with Response Code DNS action, country-based log filtering, and SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. asset export
Adds GET /datacenters, GET /dcExclusions, POST /dcExclusions, PUT /dcExclusions, and DELETE /dcExclusions endpoints to the ZIA Cloud Service API for managing data center exclusions.
Adds BLOCK_WITH_RESPONSE action value and blockResponseCode attribute in the FirewallDnsRule model to send response codes when blocking DNS traffic.
Adds Source IP Countries, Destination IP Countries, Is Source IP Country Risky?, and Is Destination IP Country Risky? filters and columns in Web Insights Logs.
Adds %s{srcip_country}, %s{dstip_country}, %s{is_src_cntry_risky}, and %s{is_dst_cntry_risky} fields to NSS Feed Output Format for web logs.
Adds POST /exportPolicies endpoint to the ZIA Cloud Service API for exporting policy rules as JSON files.
+3 moreshow less
Adds CSV export of the assets report, asset evidence copying, and JSON download of asset evidence in the Advanced SSPM Control Panel Assets tab.
Increases administrator scope department limit to 2,048 departments for ZIA admins and super admins.
Enhances IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Report to display IoT policy status and statistics for discovered devices.
Zscaler Business Insights adds application contract upload and scheduled workplace report distribution
Adds support for uploading application contracts to view insights such as annual contract value (ACV), total contract value (TCV), spending overview, and deadlines.
Adds ability to schedule attendance reports with various criteria for distribution to multiple email recipients.
Zscaler ZIA adds real-time DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. for Webex Teams messages and files.
Enables real-time Data Loss Prevention (DLP) for messages and file attachments sent via Webex Teams
Zscaler Client Connector Portal 4.3.2 adds app bypasses, language selection, and macOS posture intervals
Adds application bypass support for Microsoft 365 and Azure Virtual Desktop to prevent traffic loss in Zscaler Tunnel (Z-Tunnel) 2.0.
Adds the ability for users to select their preferred language in the Zscaler Client Connector Portal including German, Japanese, Spanish, French, and Simplified Chinese.
Adds configurable posture check intervals for macOS devices.
ZIA adds tenant firewall logging for roaming guests, ED25519 incident receiver keys, OCROCROptical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. for email DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., and policy export API.
POST /exportPolicies endpoint to export rules to JSON files
Support for ED25519 SSH key in Zscaler Incident Receiver configuration
New columns in Web Insights Logs: Source IP Countries, Destination IP Countries, Is Source IP Country Risky?, and Is Destination IP Country Risky?
New NSS Feed Output Format fields for web logs: %s{srcip_country}, %s{dstip_country}, %s{is_src_cntry_risky}, and %s{is_dst_cntry_risky}
OCR support enabled in DLP Advanced Settings for Outbound Email DLP, inline DLP, and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API
+2 moreshow less
Atlassian Label option added to Data at Rest Scanning DLP Policy configuration
Default enablement of HTTP/2 in SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection rules
ZIA adds real-time DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. for Webex Teams and case-sensitive URL logging for select domains.
Adds real-time Data Loss Prevention (DLP) support for messages and file attachments sent via Webex Teams
Adds case-sensitive URL logging for select domains (including bit.ly, tinyurl.com, and others) in Web Insights Logs and NSS feeds
Breach Predictor adds Unified UI for attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., CrowdStrike endpoint data ingestion, and Jira/ServiceNow ticket creation integrations.
└──▷ HOW TO FIND IT
Navigate to the new Events page to investigate attack paths for a specific threat.
📍Breach Predictor Portal › Events
Adds the Events page (Breach Predictor Portal > Events) to display context around attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., users, and events in a unified view
Adds CrowdStrike log integration for endpoint data ingestion and enrichment alongside existing ZIA and Sandbox logs
Adds the ability to create Request tickets in Jira and Support tickets in ServiceNow directly from the Breach Predictor Portal
$ git clone --branch v0.25.0 https://github.com/juanfont/headscale.git
# already have the repo? check out this version:$ git checkout v0.25.0
Registering a node with a new user now creates a distinct new node instead of reusing an existing one.
A logged-out node re-authenticating with the same user replaces the existing node entry.
Pre-auth keys belonging to a user are no longer deleted when the user is deleted.
Pre-auth keys actively used by a node can no longer be deleted.
Outdated nodes now display their Tailscale version instead of raw capability version numbers.
+3 moreshow less
HTTP error responses overhauled to return more accurate status codes and descriptive messages.
Minimum hostname length reduced to 2 characters.
OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.-managed users can no longer be renamed via OIDC.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Tailscale clients older than version 1.62 (capability version 87) are no longer supported and will not be able to connect.
!oidc.map_legacy_users now defaults to false; existing deployments relying on legacy OIDC user mapping must explicitly set oidc.map_legacy_users: true to preserve prior behaviour.
!A node re-registered with a different (new) user is now registered as a brand-new node rather than updating the existing node record — existing node identities tied to user changes will be affected.
Aembit adds Vault private network access and CrowdStrike Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. for Windows.
Adds support for accessing HashiCorp Vault Credential Providers on private networks via the colocated Agent Proxy
Adds AWS Role Trust Provider support on Agent Proxy for ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. Fargate deployments
Aembit adds Azure Entra Workload Identity Federation support, auto user creation via SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., and configurable TLS leaf cert lifetime
Adds Azure Entra Workload Identity Federation as a Credential Provider, with Aembit acting as a third-party federated IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. to obtain credentials for Azure Entra resources.
Enables Automatic User Creation triggered by SSO login requests.
Enhances the Identity Provider configuration page to map SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. attributes from external IdPs to Aembit Tenant roles during automatic user creation.
Allows changing the leaf certificate lifetime when using the TLS Decrypt feature.
SPIRE v1.11.2 adds multi-region GCP Secret Manager support, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Discovery Provider config flexibility, and optional trust_domain metrics labeling.
└──▷ GET THIS VERSION
$ git clone --branch v1.11.2 https://github.com/spiffe/spire.git
# already have the repo? check out this version:$ git checkout v1.11.2
Adds multi-region support to the gcp_secretmanager SVIDStore plugin, letting operators specify which regions secrets are created in.
Supports environment variable expansion in the OIDC Discovery Provider configuration.
Enables an optional trust_domain label on all metrics for finer-grained observability.
Allows the JWKSJWKSA JSON Web Key Set, a published collection of cryptographic keys. Applications use it to find the public key needed to verify a token's signature. URI returned in the OIDC Discovery Provider discovery document to be explicitly configured.
Adds support for specifying a server path prefix in the OIDC Discovery Provider.
Adds autoupdate agent resource types and teleport-update binary for automatic agent version control
└──▷ GET THIS VERSION
$ git clone --branch v17.3.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.3.0
└──▷ USE IT
Enable automatic updates on an existing agent via the CLI
shell
teleport-update enable
Introduces autoupdate_config and autoupdate_versionCRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. resources to define desired Teleport versions for agents
Ships the new teleport-update binary to handle opt-in, package-manager-agnostic automatic updates for Teleport agents
Enables Oracle Cloud Infrastructure join method without static tokens via the Oracle agent join plugin
Provides stable UIDs when creating host users across the entire Teleport cluster
Makes VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. available on Windows for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. application access within the same network
+7 moreshow less
Supports IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. authentication and hybrid identity setups for AWS Identity Center integration
Allows updating Okta integration settings (sync configuration, group filters) without recreating the integration
Changes readiness probe semantics: Auth Service checks backend storage connectivity and Proxy Service checks Auth API connectivity
Adds tctl edit support for Identity Center plugin resources
Adds Oracle join method to web UI provision token editor
Adds auto-importing of Oracle Cloud tags for agents
Adds support for X509X509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. revocations in Workload Identity
12 details in Everything
└──▷ BREAKING ON UPGRADE
!The Okta plugin must be reinstalled if the cluster is downgraded after upgrading to v17.3 with the new enrollment flow
5 more releases in this issue
· 2025-02-14 → 2025-02-28
Adds TBOT_* environment variable support for configuring tbot at runtime
Adds new tctl installer command/plugin for AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. Identity Center integration
Enables application/json response format on the /webapi/auth/export public certificate API endpoint
Adds filter drop-downs and pinning controls to the Enroll a New Resource page in the web UI
Tbot gains credential_ttl override and allow_reissue output support; env var for non-FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. AWS endpoints
└──▷ GET THIS VERSION
$ git clone --branch v17.2.8 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.2.8
└──▷ USE IT
Connect to non-FIPS AWS endpoints when running a FIPS-compliant Teleport binary
Configure tbot to output identities that support reissuance via tsh
📍# In tbot config.yml for the relevant identity output:
outputs:
- type: file
path: /etc/tbot/creds
allow_reissue: true
Override default TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. and renewal intervals for tbot credentials
📍# In tbot config.yml:
# credential_ttl: 24h
# renewal_interval: 12h
Adds TELEPORT_UNSTABLE_DISABLE_AWS_FIPS=yes environment variable to allow Teleport FIPS binaries to connect to non-FIPS AWS endpoints for IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. and STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets.
Introduces allow_reissue property in the tbot identity output to enable compatibility with tsh based reissuance workflows
Adds support for overriding credential_ttl and renewal_interval on most tbot outputs and services
3 details in Everything
└──▷ BREAKING ON UPGRADE
!tctl no longer loads the default configuration file on Windows
Adds TELEPORT_UNSTABLE_DISABLE_AWS_FIPS env var, debug socket control via debug_service.enabled, continuous Pyroscope profiling, and audit stats in tctl top.
└──▷ GET THIS VERSION
$ git clone --branch v15.4.29 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v15.4.29
└──▷ USE IT
Disable FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. restrictions for AWS services when running a Teleport FIPS build in a non-FIPS compliant environment.
Teleport v17.2.7 adds workload_identity resource, tsh workload-identity issue-x509x509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. command, and Azure Discovery Service integration.
└──▷ GET THIS VERSION
$ git clone --branch v17.2.7 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.2.7
└──▷ USE IT
Configure a new Workload Identity resource definition.
Bypass FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. restrictions for AWS endpoints when using a FIPS binary.
shell
export TELEPORT_UNSTABLE_DISABLE_AWS_FIPS=yes
Introduces tsh workload-identity issue-x509 as the replacement to tsh svid issue
Backports new Azure integration functionality allowing the Discovery Service to fetch Azure resources and send them to the Access Graph
Adds Audit Log statistics to tctl top
Adds support for caching Microsoft Remote Desktop Services licenses
Adds an escape hatch environment variable TELEPORT_UNSTABLE_DISABLE_AWS_FIPS=yes to allow non-FIPS AWS endpoints on FIPS binaries
+4 moreshow less
Adds ability to disable path-style S3 access for third-party endpoints
Adds support for multiple active CAs in the /auth/export endpoint
Adds support for continuous profile collection with Pyroscope
Teleport v16.4.16 adds tsh workload-identity issue-x509, workload_identity resource, and more granular SSH port forwarding audit logs
└──▷ GET THIS VERSION
$ git clone --branch v16.4.16 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v16.4.16
└──▷ USE IT
Use the new workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. command to issue X509X509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. certificates for workloads.
shell
tsh workload-identity issue-x509 <workload-id>
Added ability to disable path-style S3 access for third-party endpoints
Added Audit Log statistics to tctl top
Introduced the new workload_identity resource for configuring Teleport Workload Identity
Added support for multiple active CAs in /auth/export endpoint
Added support for multiple active CAs in tctl auth export
+6 moreshow less
Added securityContext value to the tbot Helm chart
Include the format and session_type fields for the session.recording.access audit event
Teleport agents always create the debug.sock UNIX socket. The configuration field debug_service.enabled now controls if the debug and metrics endpoints are available via the UNIX socket
Added an escape hatch to allow non-FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. AWS endpoints on FIPS binaries (TELEPORT_UNSTABLE_DISABLE_AWS_FIPS=yes)
Introduced tsh workload-identity issue-x509 as the replacement to tsh svid issue and which is compatible with the new WorkloadIdentity resource
Added more granular audit logging surrounding SSH port forwarding
step CLI v0.28.3 adds KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. support to ca renew and ca rekey commands
└──▷ GET THIS VERSION
$ git clone --branch v0.28.3 https://github.com/smallstep/cli.git
# already have the repo? check out this version:$ git checkout v0.28.3
└──▷ USE IT
Renew a certificate using a KMS-backed key instead of local files.
shell
step ca renew cert.pem cert.key --kms <kms-id>
Rekey a certificate using a KMS-backed key for cryptographic agility.
Mondoo adds CrowdStrike and SentinelOne integrations with priority asset customization.
└──▷ HOW TO FIND IT
Configure specific assets as high priority in Mondoo dashboards via the UI.
📍In the Mondoo console, go to Integrations › CrowdStrike and enable the connection. Then navigate to Settings › Priority Assets and define your custom rules.
Adds integrations for CrowdStrike and SentinelOne to connect asset data directly into Mondoo's platform.
Introduces priority_asset_customization settings to allow users to define which assets are treated as high priority within the dashboard views.
Vanta adds Merge.dev multi-tenancy, framework-scoped JumpCloud resources, questionnaire row deletion, AI vendor summaries, and vendor status migration
Adds Merge.dev Multi-Tenancy Support to manage multiple instances of the same integration
Allows scoping JumpCloud resources by framework for MDMsMDMsMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.
Enables deleting individual rows after importing a questionnaire response
Organizes Vendor AI answers in bullet points
Lets users move a vendor from Discovery into Procurement
5 details in Everything
3 more releases in this issue
· 2025-02-03 → 2025-03-02
Vanta adds an approval workflow to Questionnaire Automation with status tracking.
Adds approval workflow support within Questionnaire Automation, allowing approvers to be assigned and notified when a questionnaire is ready for review.
Scrut adds configurable digest summaries with module and frequency selection to Slack integration
Adds digest summary configuration for admin-defined module activities in the Scrut platform, allowing selection of specific modules and frequency settings (daily or weekly).
Enables hyperlinks within Slack notifications and digests to redirect directly to specific task, vendor control, or policy pages on the Scrut platform.
Improves notification filtering and ordering for risks, vendor management, and audit center modules by displaying only relevant statuses prioritized by urgency (e.g., overdue tasks, due soon, pending approvals).
Adds audit asset management and requirement linking in action plans
└──▷ GET THIS VERSION
$ git clone --branch v2.2.4 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.2.4
└──▷ HOW TO FIND IT
Attach an infrastructure asset to a specific audit scope via the UI
📍In the Audit view, create or edit an audit and use the Assets section to add existing assets
Link a compliance requirement to a remediation task in an action plan
📍In the Action Plan view, edit an item and use the Requirements field to select linked requirements
View the hierarchy of assets under a parent entity during an audit
📍Navigate to Assets › Details for a parent asset and scroll to the Children section
Adds ability to attach assets to audits, enabling asset-based audit planning
Enables linking specific requirements directly to action plan items for traceability
Shows child assets within the detailed view of a parent asset
3 details in Everything
4 more releases in this issue
· 2025-02-03 → 2025-02-28
CISO Assistant v2.2.3 adds Docker compose config builder, evidence selection in table mode, findings implementation, and full controls list on word reports
└──▷ GET THIS VERSION
$ git clone --branch v2.2.3 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.2.3
Adds config builder for Docker Compose to generate service configuration files.
Enables evidence selection in table mode for bulk handling of assessment artifacts.
Implements findings as a new capability within the platform.
Adds full controls list support when exporting reports in Word format.
CISO Assistant v2.2.2 adds asset ref_ids, compliance status filtering, deprecation tasks, and Helm external secrets support
└──▷ GET THIS VERSION
$ git clone --branch v2.2.2 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.2.2
Adds ref_id field to assets for unique identification
Enables filtering by status/result in the compliance assessment page
Introduces a deprecation task with common send notification mail capability
Allows Helm chart secrets to be provided via external secret
Parses and supports EBIOS RMEBIOS RMA French risk-management method published by ANSSI for analysing cyber threats and selecting countermeasures; tools use it to structure risk assessments that satisfy French and EU regulatory expectations. v3.1 framework labels
New security exceptions model and guided first-login modal
└──▷ GET THIS VERSION
$ git clone --branch v2.2.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.2.0
security_exceptions feature adds the ability to manage security exceptions within the tool
$ git clone --branch v2.1.3 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.1.3
Adds the ability to create a draft for risk acceptances
Data Service 1.1.1 adds S3 encryption headers, SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. upload support, and log export filtering with limits.
Adds S3 encryption header support for finetunes and batches
Adds mutation capability to the existing webhook plugin via Mutator Webhooks for BYO-PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. redaction guardrails
Introduces timeout parameter for all guardrails that make internal fetch calls, with a default of 5 seconds
Enables storing timeout values in the control plane when creating/updating a Guardrail on UI
Portkey Enterprise Gateway 1.10.5 adds JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. auth and VertexAI batch support
Adds JWT Auth support with configurable JWKS endpoint or JWKS JSON for authentication and authorization
AI-Infra-Guard v0.0.6 adds POST fingerprint probing, websocket server, and /show route.
└──▷ GET THIS VERSION
$ git clone --branch v0.0.6 https://github.com/Tencent/AI-Infra-Guard.git
# already have the repo? check out this version:$ git checkout v0.0.6
Adds POST request support for sending fingerprints (指纹发包)
Adds a WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. server to the tool's webserver
curl 8.12.0 adds PKCS#11PKCS#11The standard programming interface software uses to ask an HSM, smart card or token to sign or decrypt with a key it holds. Supporting it lets a tool keep its keys in hardware. provider support and QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. 0RTT for gnutls
└──▷ TRY IT
Send Early Data for QUIC connections with GnuTLSGnuTLSAn open-source TLS/SSL library maintained by the GNU Project that implements secure communications protocols, giving cyber tools a portable, LGPL-licensed alternative to OpenSSL for encrypted connections. to reduce latency.
Ghostty 1.1.1 adds X11 Server-Side Decorations via window-decoration = server and fixes critical regressions.
window-decoration = server now enables Server Side Decorations (SSD) on Linux X11, allowing Ghostty to use native window chrome on more desktop environments.
macos-icon configuration option added to macOS builds to select alternate artist-drawn icon choices.
WINDOWID environment variable is now set by the GTKGTKA cross-platform widget toolkit maintained by the GNOME project for building graphical user interfaces in C, with bindings for many languages, giving cyber tools a native desktop UI without writing platform-specific rendering code. backend containing the X11 window ID.
Joplin 3.3.1 adds Cmd+Option+N to open notes in new window and enables OCROCROptical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. by default
Adds Cmd+Option+N shortcut and menu command to open a note in a new window
Cloudflare Browser Rendering REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. enters open beta with endpoints for screenshot, PDF, content, snapshot, and scrape
Adds POST /client/v4/accounts/<accountId>/browser-rendering/screenshot endpoint to capture web page screenshots
Adds POST /client/v4/accounts/<accountId>/browser-rendering/pdf endpoint to convert web pages into PDFs
Adds POST /client/v4/accounts/<accountId>/browser-rendering/content endpoint to retrieve full HTML from a page
Adds POST /client/v4/accounts/<accountId>/browser-rendering/snapshot endpoint to capture HTML and screenshot in one request
Adds POST /client/v4/accounts/<accountId>/browser-rendering/scrape endpoint to extract specific elements from a page
Workers AI adds JSON modeJSON modeForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. for structured outputstructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. via the response_format API parameter.
Enables typed extraction of data from AI models without manual parsing, using OpenAI SDK compatibility
Cloudflare adds DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Assist for M365 email, enabling policy-based alerts and delivery prevention in Outlook.
Adds DLP Assist integration with Microsoft 365 to allow deploying an Email DLP solution for free.
Enables configuring DLP policies in Cloudflare to trigger behaviors like banners, pre-send alerts, or delivery prevention in Outlook.
Expands availability of this feature to Enterprise and Enterprise + PhishGuard email security packages.
Cloudflare introduces the Agents SDK for building and deploying AI Agents on Workers.
Adds the agents npm package to enable building AI Agents with tool callingtool callingA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions. and state syncing.
Super Slurper now supports migrations from all S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. storage providers including MinIO and Wasabi
Enables Super Slurper to migrate data from any S3-compatible object storage provider to Cloudflare R2
Adds support for migration sources such as MinIO, Wasabi, Backblaze B2, and DigitalOcean Spaces
Adds per-custom-hostname certificate bundling via the API
Adds custom_cert_bundle array and bundle_method: "force" support in the POST /zones/$ZONE_ID/custom_hostnames API to upload RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. and ECDSAECDSAThe elliptic-curve signature algorithm behind most TLS certificates, blockchains and many hardware keys. It is one of the algorithms post-quantum signatures are meant to replace. certificates simultaneously for a single custom hostname
Cloudflare increases limits for Bulk Redirects, Connectors, Custom Errors, Snippets, and Rules across all plans
Increases Cloudflare Bulk Redirects limit to 10,000 (Free), 25,000 (Pro), 50,000 (Business), or 1,000,000 (Enterprise)
Increases Cloud Connector limit to 10 (Free) or 300 (Enterprise)
Increases Custom Errors limit to 25 (Pro), 50 (Business), or 300 (Enterprise)
Increases Snippets limit to 25 (Pro), 50 (Business), or 300 (Enterprise)
Increases Cache Rules, Configuration Rules, Compression Rules, Origin Rules, Single Redirects, and Transform Rules limits to 300 for Enterprise accounts
New Workers dashboard workflow to create and auto-deploy from Git repos or templates
Adds the ability to import an existing GitHub/GitLab repository directly into the Workers dashboard to enable automatic builds on branch pushes.
Adds a new selection of production-ready template examples (e.g., Astro, Remix, Next) that provision required resources like D1 or Workers AI upon deployment.
AI Gateway adds configurable request timeouts and retries via new headers for improved reliability
Adds cf-aig-request-timeout header to set request timeout thresholds directly to a provider.
Adds cf-aig-max-attempts, cf-aig-retry-delay, and cf-aig-backoff headers to enable automatic request retries with constant, linear, or exponential backoff strategies.
Cloudflare CSAM Scanning Tool now onboards with a verified email instead of external reporting credentials.
Replaces the previous requirement for external reporting credentials with a simple verified email address to enable the CSAM Scanning Tool.
The tool hashes images as they enter the Cloudflare cache and checks them against a database of known abusive images, automatically blocking matched content URLs.
Cloudflare DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Gateway HTTP policies now block password-protected or unscannable file types via traffic selectors
Download and Upload File Types traffic selectors in HTTP policies can now match Password-protected Microsoft Office document, Password-protected PDF, Password-protected ZIP archive, and Unscannable ZIP archive for blocking.
Gateway HTTP policies automatically block these unscannable file types when the corresponding traffic selector is applied, extending existing DLP capabilities to previously bypassed content.
Wrangler v4 RC adds modern JS features and local-datastore defaults
Adds support for the using keyword from Explicit Resource Management
Adds support for Import attributes (e.g., import data from "./data.json" with { type: "json" })
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Deprecated features removed: legacy_assets config property, node_compat config property, wrangler version subcommand (use wrangler --version), and getBindingsProxy() (use getPlatformProxy()) no longer work
THE CYBER TOOLCHAIN