The Cyber Toolchain — issue -018, January 31, 2025
THE CYBER TOOLCHAIN
NO. -018
Tail
THE DAILY RELEASE FIREHOSE
PUBLISHED JANUARY 31, 2025 · EVERY DAY
EDITIONStail|grep|head|ls|diff|uniq
The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
ChipWhiper 3.5.0 adds multi-scope capture, SPISPISerial Peripheral Interface, a synchronous communication bus standard used to connect microcontrollers to sensors, flash memory, and other peripherals at short range; cyber tools use it to read or write firmware on embedded devices./STM32 programmer targets, and module-level error severity defaults
└──▷ GET THIS VERSION
$ git clone --branch 3.5.0 https://github.com/newaetech/chipwhisperer.git
# already have the repo? check out this version:$ git checkout 3.5.0
Capture module now supports connecting multiple CW-Lite or CW-Pro scopes simultaneously.
v3.5.3 adds RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it./MBED TLS firmware examples, trace copy utility, and Trigger High measurement.
└──▷ GET THIS VERSION
$ git clone --branch 3.5.3 https://github.com/newaetech/chipwhisperer.git
# already have the repo? check out this version:$ git checkout 3.5.3
Adds FW RSA firmware example to the repository for breaking RSA tutorials
Adds FW MBED TLS crypto library support for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. targets
Adds SW utility function to copy traces to a new project
Adds ability to measure Trigger High length in number of samples during capture
ChipWhisperer 4.0.2 adds RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. firmware build for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. and smarter scope connection errors
└──▷ GET THIS VERSION
$ git clone --branch 4.0.2 https://github.com/newaetech/chipwhisperer.git
# already have the repo? check out this version:$ git checkout 4.0.2
Trying to access attributes of a not connected scope now raises intelligible error telling you that the scope is not connected.
Adds Windows installer support, PSOC62 HAL, LPC1114 Jupyter tutorial, and CW-Nano firmware source.
└──▷ GET THIS VERSION
$ git clone --branch 5.1.3 https://github.com/newaetech/chipwhisperer.git
# already have the repo? check out this version:$ git checkout 5.1.3
Adds a Windows installer for ChipWhisperer (requires Linux WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host. subsystem with make and compilers)
Adds PSOC62 HAL support alongside fixes for NRF52840 and SAM4L HALs
Adds new LPC1114 Jupyter tutorial based on existing wiki content
$ git clone --branch 5.3.0 https://github.com/newaetech/chipwhisperer.git
# already have the repo? check out this version:$ git checkout 5.3.0
└──▷ USE IT
Convert captured traces directly into a numpy array for analysis without intermediate steps.
code
import chipwhisperer as cw
from chipwhisperer.capture.targets.Traces import IndividualIterable
# Assuming 'traces' is an instance of IndividualIterable
trace_array = np.array(traces)
Adds a new glitch controller for improved glitch recording
Adds __array__() method to IndividualIterable to enable numpy conversion
Adds support for T-Table enc/dec leakage models
Adds documented API access to read the state of TIO1-4 on Lite and Pro hardware
Adds FPGA reprogramming support for Nano and CW305 via the new __array__() function
+2 moreshow less
Adds batch run capability for CW305 to accelerate capture
ChipWhisperer 5.5.1 adds a multi-logger system and correlation-vs-trace analysis
└──▷ GET THIS VERSION
$ git clone --branch 5.5.1 https://github.com/newaetech/chipwhisperer.git
# already have the repo? check out this version:$ git checkout 5.5.1
└──▷ USE IT
Configure specific logging levels for ChipWhisperer subsystems using the new multi-logger system.
python
import chipwhisperer as cw
cw.log.set_level('scope', 'DEBUG')
cw.log.set_level('naeusb', 'WARNING')
Perform correlation-vs-trace analysis on captured power traces.
python
import chipwhisperer as cw
cw.correlation_vs_trace(traces, key_guesses)
Add new logging system that uses multiple loggers instead of just the default/root one. Allows setting different levels for different parts of the chipwhisperer API (scope, target, naeusb, etc)
Adds Python API context manager support, SAM4S target/HAL and bootloader, list_devices, glitch setup functions, and OpenOCD scripts.
└──▷ GET THIS VERSION
$ git clone --branch 5.7.0 https://github.com/newaetech/chipwhisperer.git
# already have the repo? check out this version:$ git checkout 5.7.0
Add context manager support to ChipWhisperer
Add cw.list_devices() to list attached NewAE devices
Add SAM4S bootloader support - allows programming SAM4S target boards
Add cglitch_setup(), vglitch_setup(), and glitch_disable() to scopes for easy glitch setup/disable.
Add scope.reset_clock_phase() for CWNano
+5 moreshow less
New and improved GlitchController with glitch map support
Full Husky support for SCA101 and Fault101
Automatically setup husky_userio pins for MPSSE when enable_MPSSE() called
Add openocd/run_openocd.sh for easier JTAGJTAGA hardware debugging standard (IEEE 1149.1) that exposes a chip's internal state through a small set of pins, letting cyber tools read memory, set breakpoints, and flash firmware without touching the running OS./SWDSWDSerial Wire Debug, a two-pin ARM debug and programming interface that replaces JTAG on Cortex-M microcontrollers, letting cyber tools flash firmware or read memory with minimal hardware connections. programming and debugging
Add openocd/fe310.cfg to allow fe310 programming via MPSSE
A tool that detects cell site simulators (IMSI catchers) on a cheap mobile hotspot.
Rayhunter v0.2.4 adds NAS heuristics with --nas flag and --pcapify for rayhunter-check
└──▷ GET THIS VERSION
$ git clone --branch v0.2.4 https://github.com/EFForg/rayhunter.git
# already have the repo? check out this version:$ git checkout v0.2.4
└──▷ USE IT
Export captured data for offline analysis in a standard packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. format.
shell
rayhunter-check --pcapify
Adds --inbound and --outbound flags to the --nas option to specify direction for NAS heuristics.
Adds --pcapify flag to rayhunter-check command to export captured data as PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. file.
Predatory ESP32 firmware for M5Stack, Cardputer and LilyGo devices.
Bruce 1.8.2 adds t-display s3 power off menu item, WebUi text editor, and TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. listen error handling.
└──▷ GET THIS VERSION
$ git clone --branch 1.8.2 https://github.com/BruceDevices/firmware.git
# already have the repo? check out this version:$ git checkout 1.8.2
Adds a text editor feature to the WebUI
Implements error handling and quit functionality for the Listen TCP command
2 details in Everything
1 more release in this issue
· 2025-01-19 → 2025-01-31
Bruce 1.8.1 adds RF transmission GDO2 control, RFID NDEF emulation, iButton default support, and new JS interpreter functions.
└──▷ GET THIS VERSION
$ git clone --branch 1.8.1 https://github.com/BruceDevices/firmware.git
# already have the repo? check out this version:$ git checkout 1.8.1
Enables GDO2 pin for CC1101 to allow Serial Transmission on T-Embed-CC1101 devices
Adds Mifare Ultralight Read and Write support on PN532 BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems. adapters
Enables NDEF Emulation on PN532 over BLE for RFID interaction
Adds default iButton Support for compatible hardware interfaces
Adds new JavaScript interpreter functions: random, analogWrite, digitalRead, and analogRead
+7 moreshow less
Adds custom QrCode saving capability
Adds USB Mouse clicker functionality for devices with HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral. capabilities
Adds support for additional GPS Baudrates via configuration
Adds Mifare multiple keys support for RFID scanning
Makes loopSD open the /BruceRFID folder directly for RFID applications
Adds LilyGo T-Display S3 board support
Adds support for Animated Gifs in the display subsystem
A portable multi-tool for pentesters and geeks; this is its official firmware.
Flipper Zero 1.2.0 adds IR commands for NAD remotes, FuriThread stdin pipe support, and one-shot RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. signals
└──▷ GET THIS VERSION
$ git clone --branch 1.2.0 https://github.com/flipperdevices/flipperzero-firmware.git
# already have the repo? check out this version:$ git checkout 1.2.0
Adds IR command support for NAD DR2 D7050, D3020 universal remote profiles
Adds flipper_format_write_empty_line(...) function to the flipper format API
Flipper Zero Unleashed Firmware, an unlocked alternative firmware.
Unleashed Firmware unlshd-080 adds Jolly Motors SubGHz support, auto power-off timer, and new API functions for apps.
└──▷ GET THIS VERSION
$ git clone --branch unlshd-080 https://github.com/DarkFlippers/unleashed-firmware.git
# already have the repo? check out this version:$ git checkout unlshd-080
Adds Jolly Motors device support to SubGHz reception (requires manual addition).
Adds Power: Auto Power Off Timer feature to reduce battery drain when idle.
Adds ability to send an Infrared signal once via RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. in the Official Firmware.
Increases the maximum carrier limit for the Infrared transmitter.
Adds new API functions flipper_format_write_empty_line(...) for data formatting.
+1 moreshow less
Exposes FuriThread stdin access via a new API surface.
Feature-rich, stable and customizable Flipper Zero firmware.
Momentum Firmware mntm-009 adds Pinball and FlipWorld apps, Easy Learn IR, coverflow UI, CLI suggestions, and VCP break support
└──▷ GET THIS VERSION
$ git clone --branch mntm-009 https://github.com/Next-Flip/Momentum-Firmware.git
# already have the repo? check out this version:$ git checkout mntm-009
Adds Pinball0 game app to the Apps list
Adds FlipHTTP: FlipWorldGPIOGPIOGeneral-Purpose Input/Output pins on a microcontroller or SoC that firmware can individually control as digital signals, letting cyber tools interact directly with hardware interfaces like UART, JTAG, or SPI. extension app
Adds TEA5767 FM Radio GPIO extension app
Adds MetroflipNFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. app
Adds USB Game Controller USB app
+14 moreshow less
Adds Easy Learn mode to Infrared for quick button saving without typing
Moves Easy Learn and Learn RAW toggles inside the Learning/Receiving screen for quick access, removing the Debug requirement for RAW mode
Adds Archive setting to show dynamic path in file browser statusbar
Adds clear and cls CLI commands with 'did you mean ...?' command suggestion support
Adds coverflow menu style to the Main Menu
Adds Menu Style submenu in MNTM Settings for easier selection
Adds German Mac keyboard layout to BadKB app
Adds manual Jolly Motors (Sub-GHzSub-GHzRadio frequencies below 1 GHz (typically 300–900 MHz) used by IoT devices, key fobs, garage doors, and industrial sensors; cyber tools target this band to capture, replay, or analyze those wireless signals.) device support in UL settings
Adds winter animations to OFW Desktop
Adds canvas_draw_icon_animation_ex() API for drawing animated icons resized
Adds flipper_format_write_empty_line() API to OFW
Adds Furi Pipe support in OFW
Adds Thread stdin support in OFW
Adds RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. command to send a signal once in OFW
19 details in Everything
└──▷ BREAKING ON UPGRADE
!The Lockscreen Allow RPC While Locked setting is now separated for USB and BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems., each defaulting to OFF; users who enabled this previously must re-enable the desired interface.
The httpx-toolkit probes HTTP services in parallel to identify live hosts, technologies, status codes, titles, and other web metadata.
httpx v1.6.10 adds lazy-loaded screenshots in HTML summary reports and a CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. bottleneck fix via fastdialer v0.3.0.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.10 https://github.com/projectdiscovery/httpx.git
# already have the repo? check out this version:$ git checkout v1.6.10
Adds lazy loading to screenshot images in HTML summary reports, improving browser performance when reviewing large scan results.
Updates fastdialer to v0.3.0, resolving a CPU bottleneck in the dialer dependency that can improve throughput at scale.
brutespray v2.3.1 adds SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy support, interface selection, and centralized connection management.
└──▷ GET THIS VERSION
$ git clone --branch v2.3.1 https://github.com/x90skysn3k/brutespray.git
# already have the repo? check out this version:$ git checkout v2.3.1
Adds SOCKS5 proxy support for routing credential-spray traffic through a proxy.
Adds interface selection option to control which network interface is used for connections.
Introduces centralized connection management for improved control over concurrent service connections.
BloodHound v6.4.0 adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. auto-provisioning with role mapping and multi-sort support for the /details API.
└──▷ GET THIS VERSION
$ git clone --branch v6.4.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v6.4.0
Adds auto-provisioning support to the SSO auth flow, allowing users to be automatically created on first SSO login.
Adds role provisioning support for SSO providers, enabling automatic role assignment based on SSO identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. attributes.
Adds configurable SSO provider options, giving administrators more control over SSO provider configuration.
Enables the GET /details API to accept multiple sort_by query parameters simultaneously.
Updates default Tier Zero asset group membership (removes DnsAdmins from default Tier Zero).
+1 moreshow less
Adds backend redirect logic to send users back to the UI with a meaningful error when SSO login fails.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The Create SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Endpoint API is deprecated in this release.
!Requires SharpHound v2.5.13; earlier collector versions are not supported with this release.
Adds basic RISCV64 shellcode generation support via shellcraft
Enables concatenating multiple shellcraft templates on the command line using shellcraft A + B
Adds local libc database provider for libcdb to enable offline analysis without network requests
Adds offline parameter to libcdb.search_by_hash() and offline_only parameter to search_by_symbol_offsets()
Adds support for debugging processes on Windows in a cyber tool that previously lacked it
+6 moreshow less
Enables assembly/disassembly on Windows via the existing asm/disasm functions
Adds TTY escape function for file transfer capabilities
Adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support to shellcode socket generators
Adds none SSH authentication method option
Adds port, gdb_args, and gdbserver_args parameters to the gdb.debug() API
Adds functions for retrieving process mappings in the cyber tooling
Mend SAST is a static application security testing service that scans source code for vulnerabilities and helps teams prioritize remediation.
Mend SAST 25.1.1 adds Jinja2/Flask Python template scanning and automated remediation for five Python CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes..
Adds Jinja2 and Flask Templates support in the Python detection engine to scan templating frameworks for frontend vulnerabilities like cross-site scriptingcross-site scriptingCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session..
1 detail in Everything
3 more releases in this issue
· 2025-01-06 → 2025-01-27
Mend SAST v25.1.1 adds Jinja2/Flask template scanning and expanded Python remediation for specific CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes..
Adds detection of frontend vulnerabilities in Jinja2 and Flask templates for Python code
Extends Automated Remediation suggestions to CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-22, CWE-79, CWE-89, CWE-117, and CWE-601 findings in Python
Adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. claims analysis checks for GCP and Azure alongside AWS CKV_AWS_358 update.
└──▷ GET THIS VERSION
$ git clone --branch 3.2.355 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.355
└──▷ TRY IT
Scan Terraform configs specifically for the new GCP and Azure OIDC checks.
$ checkov -d ./ --check CKV_GCP_125,CKV_AZURE_249
Ensure AWS OIDC claims meet the updated CKV_AWS_358 requirements.
$ checkov -f main.tf --check CKV_AWS_358
Adds CKV_GCP_125 detection for OIDC claims in GCP terraform resources
Adds CKV_AZURE_249 detection for OIDC claims in Azure terraform resources
Updates CKV_AWS_358 rule to enhance OIDC claims analysis for AWS
Adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.0 scores and Exploit Maturity fields to the REST Issues API response for granular prioritization.
Adds data.severities[].level field to REST Issues API responses to support both CVSS 3.1 and CVSS 4.0 severity levels
Adds data.severities[].version field to indicate the CVSS version used for each severity entry
Adds Exploit Maturity (Threat Metrics) fields in the REST Issues API response
Provides access to all vector data and exploit details for each vulnerability via the REST Issues API
4 details in Everything
1 more release in this issue
· 2025-01-09 → 2025-01-23
Enhanced SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. reporting with threshold controls, filtering, column customization, and CSV export capabilities.
At Risk setting to define when an issue is approaching its SLA breach deadline
New SLA filters in the filter picker for SLA status, Time until breach, and Issue age
Column picker for Breached and at risk open issues table to add any issue attribute
CSV export functionality for report tables
Default date range removed (full history view instead of last 90 days)
Adds Reachability for .NET support in the Mend CLI and GitHub integration for C# projects using NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code.
Adds fix recommendations for both direct and transitive dependencies in Python projects across the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform, Developer Platform, and repo integrations (excluding self-hosted)
Veracode SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. agent backend API URL updated for EU and US Federal regions
SCA agent default backend API endpoint changed to https://sca-api.veracode.eu for European region customers.
SCA agent default backend API endpoint changed to https://sca-api.veracode.us for United States Federal region customers.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Legacy URL https://platform-backend.analysiscenter.veracode.eu will be retired after 12 months, requiring config updates for EU customers.
!Legacy URL https://platform-backend.analysiscenter.veracode.us will be retired after 12 months, requiring config updates for US Federal customers.
4 more releases in this issue
· 2025-01-13 → 2025-01-30
Adds sandbox ID filtering to Findings and Scans reports in Reporting REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. v1.4
Adds support for filtering Findings reports using development sandbox IDs
Adds support for filtering Scans reports using development sandbox IDs
Veracode CLI v2.37.0 adds Windows MSI installer, progress indicators, and new .NET autopackaging targets.
Adds a signed Microsoft Standard Installer (MSI) file for installing the CLI on Windows
Adds --progress indicator display during command execution
Expands veracode package autopackaging to cover .NET MAUI framework, .NET Blazor WebAssemblyWebAssemblyA binary instruction format that runs in browsers and server runtimes at near-native speed, letting developers compile C, Rust, or other languages into a portable, sandboxed module any compliant host can execute., Azure functions in .NET projects, and .publishproj file types
Openlayer adds SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. directory sync, Cohere/Vertex AI LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-as-judge models, and expand API query param.
Directory sync with SAML
Use Cohere, Vertex AI models as options for LLM-as-a-judge metrics
Add expand to inference pipeline GETs so projects and workspaces are included in the response body
New Viewer role in workspaces that doesn’t have write, update or delete permissions on resources
Infisical v0.106 adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Group Membership Mapping for automated role assignment.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.106.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.106.0-postgres
9 more releases in this issue
· 2025-01-02 → 2025-01-31
K8 Operator now supports multiple secret references per InfisicalSecret resource
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.105.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.105.0-postgres
InfisicalSecretCRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. accepts multiple secret references in a single spec entry
Introduces Secret Syncs feature to synchronize secrets across environments.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.104.4-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.104.4-postgres
Adds Secret Syncs capability to automatically synchronize secrets between environments
Updates UI validation for environment variables to match API limits (64 characters)
Infisical v0.104.0 adds Radar export and pagination, unique Group names, and S3 secret key visibility in sync errors.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.104.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.104.0-postgres
└──▷ TRY IT
Retrieve the second page of Radar signals using pagination controls.
Infisical v0.103.0 adds Radar data export, pagination/filtering for Radar views, unique group names, and improved AWS Parameter Store integration error reporting.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.103.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.103.0-postgres
Adds feat(radar): export radar data capability to allow exporting data from the Radar feature
Adds pagination and filtering support for Radar views (feat(radar): pagination and filtering)
Enforces unique names for groups (feat(groups): unique names)
Improves AWS Parameter Store integration sync errors by including the Secret Key in error messages
Infisical v0.102.0 adds custom CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. settings via API and audit logs for shared secrets.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.102.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.102.0-postgres
Infisical v0.101.2 adds Auth0 SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. support and clarifies enterprise plan UI
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.101.2-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.101.2-postgres
Adds Auth0 SAML integration support for authentication
Improves the User Group Feature Upgrade Modal to clarify Enterprise Plan requirements
Support for targeting specific Azure Key Vault tenants
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.101.1-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.101.1-postgres
Adds ability to target a specific Azure Key Vault tenant
Adds ssh issue and ssh sign commands with optional --addToAgent flag for automatic key loading
└──▷ GET THIS VERSION
$ git clone --branch infisical-cli/v0.33.0 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical-cli/v0.33.0
└──▷ TRY IT
Issue a short-lived SSH credential and inject it into your current session's ssh-agent for immediate use.
infisical ssh issue <name> [--path <path>] [--workspace-id <id>] --addToAgent: issues a new SSH credential and optionally loads it into the local ssh-agent.
--outFilePath <path> flag allows ssh issue to save the private key directly to a file instead of stdout.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The ssh issue command now requires either the --addToAgent or --outFilePath flag; omitting both will result in an error.
Adds --tenant-id flag to CLI auth command for Azure Key Vault integration.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.100.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.100.0-postgres
└──▷ USE IT
Use when your environment has multiple AAD tenants and you need to target a specific one for Key Vault access.
Enables authenticating against a specific Azure Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. tenant when using the Key Vault backend via the new --tenant-id CLI argument.
Adds ML-powered similar incident grouping to sidebar for bulk remediation on Business & Enterprise plans
Introduces ML-Powered Similar Incident Grouping that automatically groups related security incidents (e.g., rotating tokens, QA credentials) based on context beyond just detector types.
Adds a Similar Incidents section to the sidebar of any incident detail page to view grouped items and execute bulk actions for efficient remediation.
Improved token refresh reliability for Slack and Atlassian Cloud integrations with automatic retry on transient failures.
TruffleHog finds, verifies, and analyzes leaked credentials across Git, chat, wikis, cloud storage, and more
Custom detectors now support exclude regexes, excludewords, and entropy filters for fine-grained secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. control.
└──▷ GET THIS VERSION
$ git clone --branch v3.88.4 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.4
└──▷ USE IT
Suppress noisy custom detector matches by excluding test/placeholder values and low-entropy strings directly in your detector config.
yaml
# In your custom detector YAML config:
detectors:
- name: MyAPIKey
keywords:
- myservice
regex:
id: '[A-Za-z0-9]{32}'
excludewords:
- example
- placeholder
exclude:
- 'test[_-]?key'
entropy:
min: 3.5
Supports exclude regexes, excludewords, and entropy filters in custom detector configurations to reduce false positives.
1 detail in Everything
2 more releases in this issue
· 2025-01-09 → 2025-01-30
Gitleaks v8.23.0 lets rules define multiple allowlists with AND/OR conditions to cut false positives
└──▷ GET THIS VERSION
$ git clone --branch v8.23.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:$ git checkout v8.23.0
└──▷ USE IT
Suppress noisy findings in lockfiles only when the match text contains a known false-positive pattern — use AND so both path and regex must be satisfied.
Supports multiple [[rules.allowlists]] blocks per rule, so a finding is suppressed when ANY listed allowlist matches.
Adds condition field (OR / AND) to allowlist blocks, enabling precise control — OR to match any criterion, AND to require all criteria simultaneously.
Adds regexTarget field (secret, match, or line) to allowlist blocks, letting you apply regex checks against the full match or entire line instead of just the extracted secret.
Adds comma as a valid operator in GenerateSemiGenericRegex, broadening auto-generated pattern coverage.
Adds Microsoft Teams alerts, Slack secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it., SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. deprovisioning, and configurable scan limits in GitGuardian Self-Hosted 2025.1
Adds Jira Data Center auto-tracking to auto-create issues, sync custom fields, and auto-resolve incidents.
Deploys False Positive Remover v1 ML model to halve false positives in Self-Hosted scans.
Enables Slack secret scanning to detect leaked secrets in full history of public and private channels.
Enhances remediation tracking with precise location details and real-time progress monitoring.
Adds scan_after_push_force_rate_limit preference to adjust the file tracking engine's scan rate limit.
+7 moreshow less
Implements SCIM user deprovisioning to automatically remove users when they are deleted from the IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
Introduces v2.128 secrets detection engine with new Jenkins API, chpasswd, Nessus Agent, and Statsig Server detectors.
Introduces v2.129 secrets detection engine with a new GitLab OAuth detector and improved Base64 High Entropy, GitGuardian Test Token, MSSQL, and Zendesk detectors.
Adds automatic repository monitoring control via the redesigned navigation menu.
Supports Jira Data Center user picker custom fields for integration configuration.
Improves GitHub integration handling for large patches (>100 commits) and enables configurable commit length scanning via repo_scan_max_commit_length.
Merges secrets_checks queue with background validity checks queue to optimize performance.
12 details in Everything
└──▷ BREAKING ON UPGRADE
!PostgreSQL 13 and 14 are no longer supported. PostgreSQL 15 is the minimum; PostgreSQL 16 is recommended.
SPIKE v0.2.1 adds policy-based access control, Shamir root-key sharding, a Secret Metadata API, and a spike policy CLI command.
└──▷ GET THIS VERSION
$ git clone --branch v0.2.1 https://github.com/spiffe/spike.git
# already have the repo? check out this version:$ git checkout v0.2.1
└──▷ TRY IT
Retrieve an access policy by name using the new spike policy subcommand.
$ spike policy get
Fetch a secret using the renamed spike secret get command after upgrading from v0.2.0.
$ spike secret get
Adds spike policy subcommand (e.g. spike policy get) for policy-based access control, alongside the renamed spike secret get family of commands.
Implements a Secret Metadata API for retrieving metadata about stored secrets.
Splits the SPIKE Nexus root key into Shamir shards distributed across SPIKE Keepers, enabling recovery scenarios.
Adds exponential retries across several API-consuming methods.
Adds new capabilities and improvements to the SPIKE Go SDK.
+1 moreshow less
Implements several recovery scenarios for SPIKE Nexus.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!CLI commands are restructured: spike get (and similar) are renamed to spike secret get; all secret subcommands now live under spike secret, and a new spike policy command family is introduced.
Alert, Dependency, and Threat tables now use modals instead of sidebars for detailed inspection
Inspection of items in the Alert Table, Dependency Table, and Threat Feed Table opens a modal interface instead of a sidebar.
Alert modals now organize details into explicit sections: Alert details, Artifact details, and Installation details, with reorganized content hierarchy.
Triage notes within these tables gain an autosave feature and a sticky note visual style.
GA release of Used in code insight to filter dormant vs. active SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. risks via UI
Apiiro adds SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., API Security, and SSCS reports with daily open risk trend tiles for remediation tracking.
Adds SAST Report to track SAST risks and their remediation progress
Adds API Security Report to gain insights into API risks and monitor remediation efforts
Adds SSCS Report to track supply chain risks and their mitigation trends
LavaMoat git-safe-dependencies adds a GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflow validator to catch unsafe action dependencies.
└──▷ GET THIS VERSION
$ git clone --branch git-safe-dependencies-v0.2.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout git-safe-dependencies-v0.2.0
LavaMoat Core 16.3.0 adds policy debugging capabilities to the webpack integration.
└──▷ GET THIS VERSION
$ git clone --branch lavamoat-core-v16.3.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout lavamoat-core-v16.3.0
$ git clone --branch webpack-v0.8.0-beta.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout webpack-v0.8.0-beta.0
└──▷ USE IT
Opt in to context-module support during development without leaving them fully unrestricted — useful when testing dynamic require() patterns.
javascript
new LavaMoatPlugin({
__unsafeAllowContextModules: true
})
Adds __unsafeAllowContextModules flag to safely experiment with webpack context modules without leaving them exposed by default.
Suppresses emission of resource assets from packages by default, reducing unintended asset exposure.
Adds policy debugging capabilities for inspecting and troubleshooting LavaMoat policy resolution in webpack builds.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Resource assets from packages are no longer emitted by default; builds that relied on automatic resource asset emission will need to explicitly enable it.
Spectra Assure Community adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. export capability and improves incident sorting on the Overview page.
Adds a button on the Dependencies page to export package dependencies as CycloneDX files
Syft v1.19.0 adds NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. package cataloging and license parsing from vendor directories.
└──▷ GET THIS VERSION
$ git clone --branch v1.19.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.19.0
Adds license parsing from vendor directories, improving license detection coverage for vendored dependencies.
Supports cataloging NuGet packages, enabling SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation for .NET ecosystems.
humble 1.45 adds XML export, a new -c parameter, 8 new insecure header checks, and expanded CSV/XML detailed analysis support.
└──▷ GET THIS VERSION
$ git clone --branch 1.45 https://github.com/rfc-st/humble.git
# already have the repo? check out this version:$ git checkout 1.45
Adds XML export format for brief analysis results.
Extends XML export to support detailed analysis output.
Extends CSV export to support detailed analysis output.
Introduces new -c parameter.
Adds 8 new insecure header checks, including Refresh (Potentially Unsafe Header) and Cross-Origin-Opener-Policy unsafe value detections.
+1 moreshow less
Greatly improves OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. compliance checks coverage.
sslyze 6.1.0 adds Extended Master Secret detection, custom HTTP agent/SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. EHLO support, and configurable renegotiation attempts.
└──▷ GET THIS VERSION
$ git clone --branch 6.1.0 https://github.com/nabla-c0d3/sslyze.git
# already have the repo? check out this version:$ git checkout 6.1.0
New check: detects whether the Extended Master Secret TLS extension is supported by the target server.
Enables supplying a custom HTTP agent via the Python API for HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. scanning.
Enables supplying a custom SMTP EHLO hostname via the Python API for STARTTLSSTARTTLSA protocol command that upgrades a plaintext connection to an encrypted TLS session without changing ports, used in SMTP, IMAP, and LDAP so tools can negotiate encryption opportunistically on standard service ports. scanning.
Enables configuring the number of client renegotiation test attempts via the Python API.
Adds experimental support for aarch64-based Linux.
+1 moreshow less
Adds support for Python 3.13.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Support for Python 3.8 has been removed; setups running sslyze under Python 3.8 will break.
!Support for Intel-based Macs has been removed; sslyze will no longer run on that platform.
ZAP 2.16 adds Client Spider as standard, Site Tree export for CI differential scans, and new Automation Framework jobs.
Adds spiderClient job to the Automation Framework to run the new Client Spider integration.
Adds prune job to the Automation Framework to remove nodes from the Sites Tree using a file in Sites Tree Format.
Adds standard Sites Tree Export feature, allowing export of the Sites Tree in a text format for differential scans in CI/CD.
Includes Client Spider as standard via the Client Integration add-on, enabling DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime.-based crawling that supersedes AJAX Spider capabilities.
Adds sequence-activeScan job to the Automation Framework to perform active scanning on imported sequences.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!ZAP requires Java 17. Nashorn scripts automatically switch to Graal.js and may require migration to remain compatible.
testssl.sh v3.2rc4 adds ML-KEMML-KEMNIST's post-quantum key-exchange standard (FIPS 203), formerly Kyber. Two parties use it to agree on a shared secret, usually alongside X25519 in a hybrid TLS handshake./KyberKyberNIST's post-quantum key-exchange standard (FIPS 203), formerly Kyber. Two parties use it to agree on a shared secret, usually alongside X25519 in a hybrid TLS handshake.post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. cipher suites, LibreSSL 4 support, and RFC 9150 TLS 1.3 ciphers
└──▷ GET THIS VERSION
$ git clone --branch v3.2rc4 https://github.com/testssl/testssl.sh.git
# already have the repo? check out this version:$ git checkout v3.2rc4
SecP256r1MLKEM768, X25519MLKEM768, SecP384r1MLKEM1024, and X25519Kyber768Draft00 cipher suites are now tested
RFC 9150 cipher suites (TLS 1.3) are now supported
Support for LibreSSL up to version 4 is added
Stapled OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists. responses using SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. are now supported
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. for Apache adds platform support for CentOS Stream 10 and Ubuntu 26.04.
Added support for modifying application response headers
Fastly Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. for NGINX adds AmazonLinux 2023 and CentOS 9/10 platform support.
Added support for AmazonLinux 2023 (2026-04-21)
Added support for CentOS9 and CentOS10 (EL9-10) (2026-04-28)
Added support for Ubuntu 26.04 (Resolute) (2026-04-28)
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. for HAProxy 1.5.0 adds the ability to edit response headers received from the agent.
Fastly Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. for NGINX 1.2.0 adds response header editing and support for NGINX Plus R34
Added ability to edit response headers received from the agent
Added support for NGINX Plus Release 34 (R34) on Alpine Linux 3.13 - 3.20, Amazon Linux 2 LTS, Amazon Linux 2023, Centos 7 - 9, Debian 10, 11 & 12, Ubuntu 18.04 LTS - 24.04 LTS
Fastly Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. for Node.js 2.3.0 adds support for modifying application response headers
Fastly Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. for IIS 3.5.0 adds support for modifying application response headers.
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. agent 4.62.0 improves SQLI detection and updates Envoy base.
BunkerWeb v1.6.0-rc3 adds bulk reporting in BunkerNet, Kubernetes ConfigMap overrides via annotation, a new anonymized support page, and Fedora 41 support.
└──▷ GET THIS VERSION
$ git clone --branch 1.6.0-rc3 https://github.com/bunkerity/bunkerweb.git
# already have the repo? check out this version:$ git checkout 1.6.0-rc3
Adds bunkerweb.io/CONFIG_TYPE=settings annotation to Kubernetes ConfigMaps for easy setting overrides
Introduces an anonymized Support page in the UI for quick log and configuration sharing
Updates BunkerNet logic to send reports in bulk instead of one by one
Adds Fedora 41 as a supported platform
4 details in Everything
0 more releases in this issue2 more releases in this issue · 2025-01-10 → 2025-01-26
BunkerWeb 1.6.0-rc2 adds SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. plugin, bwcli plugin_list, and stream support for Kubernetes integration
└──▷ GET THIS VERSION
$ git clone --branch 1.6.0-rc2 https://github.com/bunkerity/bunkerweb.git
# already have the repo? check out this version:$ git checkout 1.6.0-rc2
└──▷ TRY IT
List all installed plugins and their available subcommands via the CLI.
$ bwcli plugin_list
Introduces the ssl plugin to manage SSL/TLS settings independently of the misc plugin
Adds the plugin_list command to the bwcli utility for listing available plugins and their commands
Enables stream support within the Kubernetes integration
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The MODSECURITY_CRS_PLUGIN_URLS setting is renamed to MODSECURITY_CRS_PLUGINS
BunkerWeb 1.6.0-rc1 adds multi-user Auth basic, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. toggle, country tracking bans, and new session/config flags.
└──▷ GET THIS VERSION
$ git clone --branch 1.6.0-rc1 https://github.com/bunkerity/bunkerweb.git
# already have the repo? check out this version:$ git checkout 1.6.0-rc1
CHECK_PRIVATE_IP config key added to manage session IP address changes for private networks
ALWAYS_REMEMBER functionality implemented for session persistence in login UI
New temporary UI service displays startup errors if any occur while web UI is starting up
Health check endpoint added and integrated into the scheduler for instance status monitoring
Country tracking added to bans data
+4 moreshow less
MODSECURITY_REQ_BODY_NO_FILES_LIMIT setting allows configuring SecRequestBodyNoFilesLimit in ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application.
Multi-user support added to Auth basic plugin
TCP toggle listening supported in server-stream configuration, ensuring UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. does not replace TCP when activated
LISTEN_STREAM_PORT and LISTEN_STREAM_PORT_SSL settings now accept multiples to allow listening on multiple ports
Adds pci_tree and idt commands for hardware/firmware inspection plus IDT export SDK API
└──▷ GET THIS VERSION
$ git clone --branch v0.12 https://github.com/HyperDbg/HyperDbg.git
# already have the repo? check out this version:$ git checkout v0.12
Added the pci_tree command to inspect PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. device topology
Added the idt command to interpret the Interrupt Descriptor Table (IDT)
Exported SDK APIs for getting Interrupt Descriptor Table (IDT) entries
ILSpy 9.0 adds WebCIL/WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. support, assembly diagramming, standalone ECMA-335 metadata reading, and C# 12 decompilation.
└──▷ GET THIS VERSION
$ git clone --branch v9.0 https://github.com/icsharpcode/ILSpy.git
# already have the repo? check out this version:$ git checkout v9.0
Supports reading WebCIL assemblies (IL embedded in WASM) for decompiling Blazor/WebAssemblyWebAssemblyA binary instruction format that runs in browsers and server runtimes at near-native speed, letting developers compile C, Rust, or other languages into a portable, sandboxed module any compliant host can execute. binaries.
Supports reading standalone ECMA-335 metadata blobs, including portable PDBs.
New Diagramming feature lets you visualize assembly relationships via the context menu or ilspycmd.
Adds Clear assembly list menu item for quick workspace cleanup.
Adds option to disable automatic assembly loading to give users explicit control over what gets resolved.
+13 moreshow less
Decompiles C# 12 primary constructors.
Decompiles C# 12 ref readonly parameters.
Decompiles switch statements on (ReadOnly)Span<char> using compiler-generated hash functions.
Decompiles types that provide DisposeAsync without implementing IAsyncDisposable.
Updated pattern detection to Roslyn 4.12 for improved C# output accuracy.
IL output now shows indentation level for custom attributes on interface implementations and prints metadata tokens for custom attributes.
TreeView now surfaces referenced types, members, and exported types under the References node.
Reads and uses tuple element names and dynamic type information from PDBs.
Activates Dynamic Adaptation To Application Sizes (DATAS) and RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. hardware acceleration for improved performance.
Allows collecting analyzers annotated with ExportAnalyzerAttribute.
New IFileLoader API enables easier extensibility of supported file formats.
Exposes IProjectFileWriter and IProjectInfoProvider APIs as public for plugin authors.
Moves non-UI analyzer API to the ILSpyX package for cross-platform reuse.
18 details in Everything
└──▷ BREAKING ON UPGRADE
!The PEFile class now has a MetadataFile base class in ICSharpCode.Decompiler; code referencing PEFile directly may need updates.
!IModule.PEFile is renamed to IModule.MetadataFile in ICSharpCode.Decompiler.
!The BAML decompiler is split into a library and an add-in; integrations depending on the original structure will break.
!Non-UI analyzer API is moved from ILSpy to ILSpyX; references to the old namespace/assembly will break.
!@file command-line support introduces breaking changes to existing command-line options.
!New single-instance handling changes behavior for existing single-instance integrations.
!IsRef, IsOut, and IsIn flags are removed from IParameter; code checking those flags will break.
!ParameterModifiers is replaced with ReferenceKind; all uses of ParameterModifiers will break.
0 more releases in this issue1 more release in this issue · 2025-01-06 → 2025-01-19
Frida 16.6.4 revives ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. BE8 support and improves module loading stability.
linux: Restores support for big-endian ARM (BE8) systems.
1 detail in Everything
1 more release in this issue
· 2025-01-09 → 2025-01-17
Frida 16.6.0 adds findSymbolByName()/getSymbolByName(), native instance Module APIs, and .gnu_debugdata fallback for symbol resolution.
gumjs: Adds findSymbolByName() and getSymbolByName() methods for direct native symbol lookup by name
module / ncm: Turns Module APIs into instance methods to allow multiple queries efficiently (e.g., no longer need to pass module path string to every query)
elf-module: Falls back to .gnu_debugdata section parsing when in-memory symbols are missing, decompressing the embedded ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. for symbol reuse
Pwndbg 2025.01.20 adds LLDB support, macOS/Mach-O debugging, TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. layout, jemalloc inspection, and 8 new commands.
└──▷ GET THIS VERSION
$ git clone --branch 2025.01.20 https://github.com/pwndbg/pwndbg.git
# already have the repo? check out this version:$ git checkout 2025.01.20
└──▷ TRY IT
Inspect jemalloc heap structures when exploiting a target that uses the jemalloc allocator.
$ jemalloc_heap
Redirect a process's file descriptor to a controlled file mid-session to intercept or inject I/O.
$ hijack-fd 1 /tmp/capture.txt
Profile a slow Pwndbg session to find which commands are causing the most overhead.
$ profiler start
continue
profiler stop
Adds LLDB backend via a new debugger-agnostic library (aglib), bringing most Pwndbg functionality to LLDB alongside GDB.
Supports macOS (Intel & Apple Silicon) and Mach-O binary debugging via LLDB.
Adds GDB Text User Interface (TUI) layout with tui layout pwndbg and tui layout pwndbg_code.
Adds context history navigation with new contextprev and contextnext commands.
New gdt <addr> command dumps Global Descriptor Table entries from a given address.
+11 moreshow less
New strings command searches memory for readable strings, similar to the strings CLI utility.
New jemalloc_heap, jemalloc_extent_info, and jemalloc_find_extent commands inspect jemalloc heap allocator structures.
New hijack-fd <fd> <newfile> command modifies a process file descriptor.
New kallsyms and klookup commands provide Linux kernel symbol table lookup helpers.
New profiler {start,stop} command benchmarks Pwndbg performance and identifies bottlenecks.
Improves embedded systems debugging with better vmmap detection and enhanced vmmap_add and vmmap_load commands.
The ropgadget command now scans all executable memory regions for gadgets.
context <section> gains --on|--off toggle to temporarily disable individual sub-sections.
plist gains --offset and --count options to limit the number of linked list elements printed.
Adds vmmap -C <N> <filter> to display N pages before and after a filtered vmmap entry.
Speeds up syntax highlighting via pygments and reduces Pwndbg startup time.
16 details in Everything
└──▷ BREAKING ON UPGRADE
!Python 3.8, Ubuntu 20.04, and Debian 11 are no longer supported.
iLEAPP v2.0.3 adds Foursquare Swarm artifact support and expands LAVA output to Wire, Splitwise, and Google Translate modules.
└──▷ GET THIS VERSION
$ git clone --branch v2.0.3 https://github.com/abrignoni/iLEAPP.git
# already have the repo? check out this version:$ git checkout v2.0.3
Adds Foursquare Swarm artifact parser for extracting location check-in data from iOS devices.
Adds LAVA output support to Wire, Splitwise, and Google Translate modules.
Improves KMLKMLAn XML-based file format maintained by the OGC for storing geographic data such as points, paths, and polygons. Cyber tools use it to visualize location-based intelligence on maps. generation in ilapfuncs.py for richer geolocation artifact output.
Updates build IDs database with expanded iOS version coverage.
Updates fsCachedData.py with new artifact handling improvements.
+1 moreshow less
Updates Files app parser (filesApp.py) with LAVA output support.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The does_table_exist function is renamed to does_table_exist_in_db; any custom modules or scripts calling does_table_exist will break.
!The does_view_exist function is renamed to does_view_exist_in_db; any custom modules or scripts calling does_view_exist will break.
!The version field is removed from artifact_v2 and replaced with last_update_date; any downstream tooling reading the version field from artifact metadata will break.
Adds Suspend() command for VM instances and container-explorer support in analysis VM startup
└──▷ GET THIS VERSION
$ git clone --branch 20250116 https://github.com/google/cloud-forensics-utils.git
# already have the repo? check out this version:$ git checkout 20250116
CrowdStrike Falcon analyzer gains custom base URL support for non-default API endpoints.
└──▷ GET THIS VERSION
$ git clone --branch 3.4.3 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.4.3
Volatility 3 v2.11.0 adds 14 new plugins spanning Linux eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic., hidden modules, ptrace, and Windows scheduled tasks, amcache, and more.
└──▷ GET THIS VERSION
$ git clone --branch v2.11.0 https://github.com/volatilityfoundation/volatility3.git
# already have the repo? check out this version:$ git checkout v2.11.0
New linux.boottime plugin to retrieve system boot time from a Linux memory image.
New linux.hidden_modules plugin to detect kernel modules hidden from the standard module list.
New linux.kthreads plugin to list kernel threads running on a Linux system.
New linux.pagecache plugin to inspect the Linux page cache.
New linux.pidhashtable plugin to enumerate processes via the PID hash table, aiding detection of hidden processes.
+7 moreshow less
New linux.ptrace plugin to identify processes being traced via ptrace.
New windows.debugregisters plugin to inspect hardware debug registers across processes.
New windows.orphan_kernel_threads plugin to detect kernel threads with no owning process — a common rootkit indicator.
New windows.pe_symbols plugin to resolve and display symbols from PE images in memory.
New windows.scheduled_tasks plugin to extract scheduled task definitions from Windows memory.
Improved output formatting and filtering in the CLI.
Additional architecture data files added for vmscan.
12 details in Everything
└──▷ BREAKING ON UPGRADE
!Python 3.8 is now the minimum supported version; environments running Python 3.7 or earlier will no longer work.
MVT v2.6.0 adds IP indicator support, APK cert hash IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself., new Android modules, and improved STIX2 directory scanning.
└──▷ GET THIS VERSION
$ git clone --branch v2.6.0 https://github.com/mvt-project/mvt.git
# already have the repo? check out this version:$ git checkout v2.6.0
Adds support for IP address indicators in IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. matching across MVT checks.
Adds support for checking APK certificate hash IOCs to detect tampered or malicious Android packages.
New packages module for androidqf acquisitions to analyze installed package data.
New files module for androidqf acquisitions to inspect file listings.
New parser for ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control. state within Dumpsys output to surface connected device info.
+6 moreshow less
New module to parse uninstalled apps from Dumpsys data, surfacing historically present applications.
Adds additional heuristic detections for suspicious Android packages.
SQLite database recovery now attempted automatically when a DB is found locked or open.
STIX2 indicator loading via MVT_STIX2 environment variable now recursively searches directories, not just individual files.
Improved STIX2 indicator support with broader indicator-type coverage and expanded test coverage.
Docker image now built with multistage builds and separate OS-specific images, reducing image size.
Prisma Cloud 25.1.1 adds Enhanced Remediation views, ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. build policy support, Azure Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. visibility, new compliance benchmarks, and the get-remediation-for-policy API
Enhanced Remediation for Critical and High alerts introduces a new Saved View and How to Fix tab with AI-assisted steps and options to remediate via Terraform Template or CLI Command.
Adds ARM framework support to custom build policies, allowing shared arguments/syntax between ARM and Bicep or restricting the policy to ARM only, including explicit and implicit dependencies.
Adds Microsoft Entra ID visibility in CIEM using the grantedby.level.type attribute to investigate permissions and identify entities with roles like Global Administrator.
Adds last-connected field to Defender stats logs, recording the last confirmed connection time in epoch seconds (UTC) even when the Connected flag is false.
Supports CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Azure Foundations Benchmark v3.0.0 (Levels 1 & 2) and CIS AWS Foundations Benchmark v4.0.0 compliance standards for automated governance.
+10 moreshow less
Adds NCSC - Cyber EssentialsCyber EssentialsA UK government-backed certification scheme that defines a baseline set of technical controls organizations must implement to defend against common cyber threats, giving cyber tools a compliance benchmark to assess or report against. and NCSC - Cloud Security Principles compliance benchmarks to the built-in standards library.
Adds TISAXTISAXA vehicle-industry information-security assessment standard, maintained by the ENX Association, that lets automotive suppliers prove their data-handling practices to OEMs without each OEM running its own separate audit. (Trusted Information Security Assessment Exchange) compliance framework support with structured maturity model assessments.
Adds HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. policy mappings update, which may vary existing compliance scoring due to new mappings.
Excludes NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. runtime-specific dependencies unrelated to the application in scanning to reduce false positive vulnerability alerts.
Adds new API ingestions for Amazon Athena, Amazon Fraud Detector entities/labels/variables, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Vaults, Azure Load Testing, Google Identity Aware Proxy settings, and others.
Adds multiple new security policies including AWS Connect contact flow logs check, Azure Container Registry anonymous/local admin/repository-scoped token checks, GCP Memorystore encryption/auth requirements, and more.
Updates IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy 'System/User-assigned managed identity with critical Entra ID permissions' to detect critical Graph APIGraph APIMicrosoft's unified REST API for accessing data across Microsoft 365 services — mail, calendar, users, files — letting cyber tools query or monitor cloud environments through a single authenticated endpoint. permissions for managed identities.
Adds new IAM policies identifying Entra ID users owning or impersonating service accounts with admin group privileges at subscription/management group level.
Implements rate limits on Config Search and Config Search v1 APIs (/search/config, /search/config/page, /search/api/v1/config) at 150 requests per minute.
15 details in Everything
└──▷ BREAKING ON UPGRADE
!Config Search APIs (/search/config, /search/config/page) and Config Search v1 API (/search/api/v1/config) now enforce a rate limit of 150 requests; exceeding this results in HTTP 429.
Multi-VSYS support for NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. clustering on PA-7500 Series firewalls enables up to 25 virtual systems per cluster.
Adds support for assigning virtual systems at the interface level, including MC-LAG and Aggregate Ethernet interfaces, in clustered PA-7500 deployments.
Central 2025.02 adds local admin password reset for AP6 and separates SSID creation workflows.
└──▷ HOW TO FIND IT
Clone an existing APX wireless configuration to a new AP6 device.
📍Go to My Products › Wireless › SSIDs, select an APX SSID, and click Clone for AP6.
Allows resetting the local administrator's password for AP6 access points directly from the Sophos Central control panel on the access point details page.
Separates SSID creation for AP6 and APX devices with dedicated Create AP6 and Create APX buttons at My Products > Wireless > SSIDs
Adds a Clone for AP6 button on the SSIDs page to duplicate APX SSID settings for AP6 access points
Sophos Switch 2.1.1791 adds MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. blocking via the local UI
└──▷ HOW TO FIND IT
Block traffic from a specific device identified by its MAC address using the local switch interface.
📍In the Sophos Switch UI, navigate to Monitor › MAC address table › MAC blocking and add the target MAC to the list.
Adds MAC address blocking across all VLANs via Monitor > MAC address table > MAC blocking, with a new Blocking list tab to view blocked addresses.
1 detail in Everything
1 more release in this issue
· 2025-01-16 → 2025-01-29
Configure per-port PoE power limits and enable keepalive for connected devices in the site interface.
📍In the Sophos Central console, navigate to Devices › Switches, select a switch, and open the PoE settings tab to configure the global budget and individual port states.
Configures global PoE power budget and adjusts individual power settings for each switch port via Sophos Central.
Malcolm v25.01.0 adds Omron FINS and PostgreSQL parsers, syslog-over-UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery./TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. ingestion, and Winlogbeat normalization with new config vars.
└──▷ GET THIS VERSION
$ git clone --branch v25.01.0 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v25.01.0
└──▷ USE IT
Enable encrypted syslog ingestion over TCP on port 6514 with RFC 5424RFC 5424The IETF standard that defines the Syslog protocol's message format, severity levels, and transport rules, giving cyber tools a common structured log schema to parse and forward system events reliably. formatting so firewalled OT devices can forward logs to Malcolm securely.
Enable the Omron FINS parser with verbose detail logging to capture granular PLC command/response data for ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. network forensics.
Adds FILEBEAT_SYSLOG_TCP_LISTEN and FILEBEAT_SYSLOG_UDP_LISTEN in ./config/filebeat.env to enable syslog ingestion over TCP and/or UDP respectively.
Adds FILEBEAT_SYSLOG_TCP_FORMAT and FILEBEAT_SYSLOG_UDP_FORMAT in ./config/filebeat.env to specify syslog message format as one of auto, rfc3164, or rfc5424 (default auto).
Adds FILEBEAT_SYSLOG_TCP_PORT and FILEBEAT_SYSLOG_UDP_PORT in ./config/filebeat.env to configure the ports on which Malcolm accepts syslog over TCP and/or UDP.
Adds FILEBEAT_SYSLOG_TCP_MAX_MESSAGE_SIZE and FILEBEAT_SYSLOG_UDP_MAX_MESSAGE_SIZE in ./config/filebeat.env to cap syslog message size (defaults: 10KiB for UDP, 20MiB for TCP).
Adds FILEBEAT_SYSLOG_TCP_MAX_CONNECTIONS in ./config/filebeat.env to cap the maximum concurrent TCP connections for syslog ingestion.
+8 moreshow less
Adds FILEBEAT_SYSLOG_TCP_SSL in ./config/filebeat.env to require TLS for syslog-over-TCP, with self-signed certs generated by ./scripts/auth_setup stored in ./filebeat/certs/.
Adds ZEEK_DISABLE_ICS_OMRON_FINS in ./config/zeek.env and control_vars.conf to toggle the new Omron FINS protocol parser.
Adds ZEEK_OMRON_FINS_DETAILED in ./config/zeek.env and control_vars.conf to enable verbose Omron FINS logging to omron_fins_detail.log.
Integrates the Omron FINS ICS protocol parser (icsnpp-omron-fins) with a corresponding dashboard.
Integrates the PostgreSQL parser (introduced in Zeek v7.1.0) with a corresponding dashboard.
Normalizes Winlogbeat events using Fluent Bit's winlog/winevtlog and evtx event schemas.
Clicking field values in Dashboards tables now pivots to Arkime or NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment..
Adds a navigation pane to all non-network dashboards.
Snort3 3.6.2.0 adds brute-force detection thresholds, pcre2pcre2A widely used open-source regular expression library maintained by the PCRE2 Project, offering Perl-compatible pattern matching that cyber tools embed for fast, expressive text and binary searching. migration, Geneve inner-header filtering, and multi-byte IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. content matching.
└──▷ GET THIS VERSION
$ git clone --branch 3.6.2.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.6.2.0
Adds configurable thresholds to AppID brute-force detection for tunable alerting sensitivity.
Supports multi-byte character matches in IPS content rules via new width and endian parameters.
Migrates IPS PCRE processing from legacy PCRE to PCRE2.
Filters Geneve-encapsulated packets using inner headers in pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. capture mode.
Adds per-thread instance ID dump support in the main engine.
+3 moreshow less
Implements header definitions for a shadow traffic aggregator in pub/sub.
Adds IPS access to Event references for richer rule evaluation context.
Evaluates TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. flush policy on asymmetric connections at connection close or session clear.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!tcp_pdu is renamed to tlv_pdu; any configuration, rules, or scripts referencing tcp_pdu will break.
!The unsubscribe methods have been removed from data_bus; any code or plugins calling those methods will fail to compile or function.
!Libpcre2 is now a required dependency (replacing PCRE for IPS); deployments without libpcre2 installed will fail to build or run.
bettercap v2.41.0 adds ZeroConf/Bonjour impersonation, DNS-over-TLSDNS-over-TLSA protocol that wraps DNS queries inside a TLS connection on port 853, preventing eavesdroppers from reading or tampering with hostname lookups. Cyber tools use it to keep reconnaissance and C2 traffic from leaking in plaintext. proxy, blacklist/whitelist filtering, and scripting API expansions.
└──▷ GET THIS VERSION
$ git clone --branch v2.41.0 https://github.com/bettercap/bettercap.git
# already have the repo? check out this version:$ git checkout v2.41.0
New zerogod module enables ZeroConf / Bonjour impersonation attacks on local networks.
api.rest now returns stdout data after executing a session command, enabling richer programmatic automation.
Adds addSessionEvent function to both DNS and HTTP proxy script environments for event-driven scripting.
Adds removeEventListener built-in function to scripting environments.
Implements named tickers for more precise, identifiable scheduled script execution.
+3 moreshow less
DNS proxy gains TLS support, allowing interception and inspection of DNS-over-TLS traffic.
DNS proxy adds blacklist and whitelist filtering logic, including wildcard support in blacklist configurations.
DNS proxy supports RFC3597 generic/unknown record types when the Rdata field is present.
policy_sentry 0.14.0 updates the IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. database and expands wildcard querying of the action table.
└──▷ GET THIS VERSION
$ git clone --branch 0.14.0 https://github.com/salesforce/policy_sentry.git
# already have the repo? check out this version:$ git checkout 0.14.0
└──▷ TRY IT
Query all actions across every service using the wildcard to quickly audit the full action table.
$ policy_sentry query action-table --service '*'
Updates the bundled IAM actions database to reflect the latest AWS service changes.
Expands the capability of * wildcard querying against the action table, enabling broader action lookups.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Python 3.8 is no longer supported; upgrading requires Python 3.9 or later.
Prowler 5.2.0 adds CIS KubernetesCIS KubernetesHardening benchmarks published by the Center for Internet Security for Kubernetes clusters, giving cyber tools a concrete, versioned checklist of configuration checks to run and report against./Azure frameworks, OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. resource metadata, configurable secrets plugins, and finding first-seen tracking.
└──▷ GET THIS VERSION
$ git clone --branch 5.2.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 5.2.0
└──▷ TRY IT
Inspect full resource metadata (ARN, region, config details) for every finding in OCSF format.
$ prowler --output-format json-ocsf
Adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. 1.10 Kubernetes compliance framework.
Adds CIS 3.0 Azure compliance framework.
OCSF output now includes a metadata JSON object under resource with full resource-level metadata for each finding.
Findings now carry a first_seen_at field to track when Prowler first observed each finding.
Secrets checks using detect-secrets can now be configured with a custom list of plugins via the Prowler config file.
+5 moreshow less
AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. Role External ID is now a mandatory field when configuring IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Role authentication.
UI: Finding details layout redesigned to include first_seen timestamp.
UI: CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. and Terraform templates available to deploy the ProwlerScan IAM Role.
UI: IAM Role setup now allows skipping static credentials when running inside AWS (EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware., ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping., EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves.), using default SDK credentials automatically.
API DB Manager upgraded to psycopg3 with connection pooling for improved reliability.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!The IAM Role External ID is now a mandatory field when configuring IAM Role authentication — existing setups that omit this field will fail.
1 more release in this issue
· 2025-01-14 → 2025-01-23
Prowler 5.1.0 adds RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., 4 new checks, 30 AWS auto-fixers, CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. 3.0 for GCP, and a new gen-ai check category.
└──▷ GET THIS VERSION
$ git clone --branch 5.1.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 5.1.0
└──▷ TRY IT
Auto-remediate publicly exposed EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. SSH ports across your AWS account in one pass.
List every available auto-fixer before running remediation to audit what will be changed.
$ prowler aws --list-fixers
Adds Role-Based Access ControlRole-Based Access ControlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC): assign roles and privileges to users and create cloud provider groups to scope visibility.
Adds 4 new security checks: ec2_launch_template_imdsv2_required, stepfunctions_statemachine_logging_enabled, cloudformation_stack_cdktoolkit_bootstrap_version, and sqlserver_recommended_minimal_tls_version.
Adds 30 new AWS auto-fixers for Lambda, SQS, ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure., Glacier, OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions., S3, EC2, CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions., and CodeArtifact — run with --fixer to automatically remediate public-exposure misconfigurations.
Adds CIS BenchmarkCIS BenchmarkConsensus-based configuration hardening guidelines published by the Center for Internet Security, covering OSes, cloud platforms, and software; cyber tools use them as a ready-made ruleset to audit or enforce secure system baselines. 3.0 compliance framework support for GCP.
Adds new gen-ai check category to group and run checks for Generative AI, ML, and LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. services.
+3 moreshow less
Adds GET /overviews/services API endpoint for service-level overviews.
Adds compliance report generation for GCP scans via the API.
Adds configurable broker visibility timeout setting for the Celery task queue.
Inspektor Gadget v0.36.0 adds OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. logs export, richer DNS/exec tracing fields, and uniform gadget filtering.
└──▷ GET THIS VERSION
$ git clone --branch v0.36.0 https://github.com/inspektor-gadget/inspektor-gadget.git
# already have the repo? check out this version:$ git checkout v0.36.0
└──▷ TRY IT
Capture DNS queries with working directory and executable path to attribute queries to specific scripts or binaries.
$ ig trace dns --paths
Adds OpenTelemetry logs (otel-logs) support for exporting gadget output to OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor.-compatible backends.
Adds cwd and exepath fields to trace_dns via the --paths flag for richer process context on DNS events.
Adds file field to trace exec to capture the interpreter path for script executions.
Introduces uniform filtering across gadgets for consistent field-based event filtering.
Allows configuring otel-metrics via Helm charts for Kubernetes deployments.
+1 moreshow less
Enforces unique instance names in kubectl-gadget, preventing duplicate named gadget instances.
kube-bench v0.10.0 adds CIS KubernetesCIS KubernetesHardening benchmarks published by the Center for Internet Security for Kubernetes clusters, giving cyber tools a concrete, versioned checklist of configuration checks to run and report against. 1.10 benchmark for k8s v1.28–v1.31 and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline.EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. 1.5.0 support.
└──▷ GET THIS VERSION
$ git clone --branch v0.10.0 https://github.com/aquasecurity/kube-bench.git
# already have the repo? check out this version:$ git checkout v0.10.0
Adds CIS Kubernetes CIS-1.10 benchmark covering Kubernetes v1.28 through v1.31.
Adds CIS EKS 1.5.0 benchmark support for Amazon EKS cluster auditing.
Adds direct-volume auto-creation and mem-agent for improved resource isolation
└──▷ GET THIS VERSION
$ git clone --branch 3.13.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:$ git checkout 3.13.0
kata-ctl direct-volume now automatically creates the KATA_DIRECT_VOLUME_ROOT_PATH directory if it does not exist
Adds mem-agent support to kata-containers to enable memory-specific agent operations
Grype v0.87.0 adds CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale. custom vulnerability sources and richer VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. product identifiers with package names.
└──▷ GET THIS VERSION
$ git clone --branch v0.87.0 https://github.com/anchore/grype.git
# already have the repo? check out this version:$ git checkout v0.87.0
Supports CSAF as a custom vulnerability source, enabling teams to feed their own CSAF advisories into Grype scans.
Adds package name to VEX product identifiers, improving accuracy when applying VEX statements to matched vulnerabilities.
KubeHound v1.6.4 embeds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. techniques and tactics into every attack-path edge.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.4 https://github.com/datadog/kubehound.git
# already have the repo? check out this version:$ git checkout v1.6.4
Embeds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. technique and tactic metadata directly into graph edges, binding each attack to a TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind..
Removes Docker library dependency from the KubeHound binary.
Trivy is a comprehensive security scanner that finds vulnerabilities, misconfigurations, secrets, and SBOM in containers, Kubernetes, code repositories, and clouds
Trivy 0.59.0 adds --distro flag, registry mirrors, and support for ignoring misconf violations in Dockerfile and Helm via inline comments.
└──▷ GET THIS VERSION
$ git clone --branch 0.59.0 https://github.com/aquasecurity/trivy.git
# already have the repo? check out this version:$ git checkout 0.59.0
└──▷ TRY IT
Scan a container image while forcing the vulnerability database to treat it as Debian Bookworm, regardless of the base image metadata.
Falco 0.40.0 migrates key CLI flags to falco.yaml config options, adds plugin output format hints, and reintroduces static builds.
└──▷ GET THIS VERSION
$ git clone --branch 0.40.0 https://github.com/falcosecurity/falco.git
# already have the repo? check out this version:$ git checkout 0.40.0
└──▷ USE IT
Capture all syscalls (equivalent to the old -A flag) using the new config key so operator intent is version-controlled in falco.yaml.
yaml
base_syscalls:
all: true
Set packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. snap length (equivalent to the old -S/--snaplen flag) persistently in falco.yaml.
yaml
falco_libs:
snaplen: 512
Encode alert output fields in base64 (equivalent to the old -b flag) via falco.yaml for structured log pipelines.
yaml
buffer_format_base64: true
Adds buffer_format_base64 option to falco.yaml, replacing the deprecated -b flag for base64-encoded output.
Adds base_syscalls.all option to falco.yaml, replacing the deprecated -A flag for enabling all syscalls.
Adds falco_libs.snaplen option to falco.yaml, replacing the deprecated -S/--snaplen flag for capture snap length.
Supports plugin-exposed suggested output formats, letting Falco automatically honor the output format a plugin recommends.
Adds ability to entirely disable plugin hostinfo support via configuration.
+3 moreshow less
Reintroduces static builds of Falco, available as tgz-static-x86_64 packages.
Switches release artifacts to use the jemalloc allocator by default, improving memory performance under high event load.
Streamlines official Docker images with a simplified image layout.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Deprecated CLI options removed — any working setup passing the old deprecated flags will break on upgrade.
Falco v0.40.0 adds YAML config keys for buffer format, syscalls, and snaplen while deprecating CLI flags.
└──▷ TRY IT
Configure base64 encoded output for Falco events instead of the default format
$ # In falco.yaml:
buffer_format_base64: true
# Then restart Falco service
Capture all raw syscalls for deep forensic analysis without using command-line flags
$ # In falco.yaml:
base_syscalls.all: true
# Then restart Falco service
Limit the snaplen (capture length) for network events via configuration
$ # In falco.yaml:
falco_libs.snaplen: 4096
# Then restart Falco service
buffer_format_base64 option allows base64 output formatting in falco.yaml, replacing the deprecated -b flag
base_syscalls.all option enables capturing all syscalls via config file, replacing the deprecated -A flag
falco_libs.snaplen option sets packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. length via config file, replacing the deprecated -S / --snaplen flags
ESET PROTECT 6.1 adds new reports for vulnerability scans and patches, extends webhook variables, and enables direct patching from Vulnerabilities section.
Adds Report informing about performed vulnerability scans to track scan results
Adds Report informing about applied patches to track remediation status
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The Cancelled closed incident resolution option is no longer available
!32bit variants of ESET Management Agent are removed and must be replaced with 64bit variants
$ git clone --branch 3.8.0 https://github.com/ossec/ossec-hids.git
# already have the repo? check out this version:$ git checkout 3.8.0
Adds support for AIX 7.x on POWER architecture (generations 8, 9, and 10).
Enforces chroot and privilege separation for the authd daemon, which now runs as the ossec user by default.
Updates rootkit detection signatures for 1stmile rootkit.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The authd daemon now runs as the ossec user by default and enforces chrooting — deployments relying on authd running as root or outside a chroot may need reconfiguration.
Sync MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. case info from Trend Vision One to ServiceNow via new ticket profile and automation toggle.
Adds MDR case as a selectable case type in the TrendAI Vision One™ for ServiceNow Ticketing System third-party integration profile.
Enables automatic creation of ServiceNow tickets for MDR cases via the XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Threat Investigation > Managed Services > Settings > Cross-App Management UI toggle.
Enhanced risk assessment for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. applications now categorizes discovered apps into public cloud, connected SaaS, and local groups.
Applications tab in Attack Surface Discovery now organizes apps into three new categories: public cloud apps, connected SaaS apps, and local apps.
Trend Vision One ZTS On-prem Gateway v1.0.59 adds macro file ML support, explicit auth token blocking pages, and ICAP memory leak fixes.
Enhanced Predictive Machine Learning integration to support Office with Macro files
Show a blocking page to an endpoint for traffic forwarded by the SA module either with an invalid authentication token or without an authentication token
Updated content inspection for Copilot AI service due to protocol change
Context menu now triggers restorative response actions across Attack Surface Discovery, Endpoint Inventory, Workbench, Observed Attack Techniques, and Search.
Adds Resume Container action for isolated containers
Adds Restore Connection action for isolated endpoints
Adds Enable User Account action for disabled user accounts
Adds Remove from Zscaler Restricted User Group action for added user accounts
Trend Vision One DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. now scans email headers and supports incoming message policies for Exchange Online.
Adds scanning of email header fields as a target in Cloud Email and Collaboration Protection DLP policies.
Enables applying DLP policies to incoming messages for Exchange Online, extending beyond previous Sent messages only and All messages scopes.
Server & Workload Protection adds hypersensitive mode and firewall username event fields on Linux.
Server & Workload Protection Activity Monitoring now supports hypersensitive mode on Linux platforms to provide improved MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. coverage
Trend Vision One Identity Inventory now supports Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. (on-premises) as an IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
Sophos Central adds GeoDNS for DNS Protection, PDF Account Health reports, ConnectWise/Autotask firewall sync, and ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. mgmt in new regions.
└──▷ HOW TO FIND IT
Export your security posture report for sharing with auditors or management.
📍Navigate to Account Health Check › Export › Select PDF
Configure monthly sync for firewall licenses in ConnectWise PSA.
📍Go to Integrations › ConnectWise PSA › Sync Settings › Set frequency to Monthly
Adds support for improved GeoDNS responses in DNS Protection to target networks by geographical location
Adds AP6 Series MR5 access point support for Guest Network NAT mode and power statistics in Sophos Central
Adds loopback detection, DoS, and log settings management for Switch devices from Sophos Central
Adds the ability to export a PDF report of the Account Health Check dashboard for external stakeholders
Adds Let's Encrypt support for automated gateway certificate management in ZTNA (available mid-January)
+3 moreshow less
Expands ZTNA management availability on Sophos Central to tenants in Australia, Brazil, Canada, India, and Japan
Adds monthly firewall product sync capability to ConnectWise PSA and Autotask usage sync integrations
Adds configurable sync frequency for ConnectWise PSA integration to align license quantities with the invoice
New-Scale platform introduces Attack Surface Insights directory, Threat Detection Management hub, advanced playbooks with actions/loops, and Site Collector multi-template sup
Adds Attack Surface Insights as a new directory for organizational resources (entities) linked by contextual data.
Adds Threat Detection Management as a centralized interface for creating, testing, and tuning correlation and analytics detection rules.
Introduces advanced playbooks in Automation Management that support actions, branches, loops, manual execution, draft deployment, and run history viewing.
Enables creation of No Trigger Playbooks that can only be manually run on specific cases or alerts without automatic triggers.
Adds deep integration of Automation Management into Threat Center, including the Automation tab in case/alert Overview showing recent playbooks/actions and full history.
+32 moreshow less
Introduces Box Cloud Collector for ingesting user and enterprise events from Box.
Adds Cisco Meraki Cloud Collector (Early Access) for security events, alerts, and config changes via Cisco Meraki APIs.
Adds Recorded Future Cloud Collector for ingesting API Alerts.
Introduces ServiceNow Cloud Collector (Early Access) ingesting data from Incident, Task, Change Request, Syslog Transaction, and other source types.
Updates Context Management to support Custom, Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments., CrowdStrike, and Microsoft Entra ID context tables for device data.
Adds New-Scale Analytics pre-built context tables in Context Management for supporting the New-Scale Analytics engine and Attack Surface Insights.
Adds Show Results in Search option to dashboard visualizations for rule-triggered events, enabling pivoting to Search.
Renames all dashboards activity types from report to dashboard in audit logs and adds specific event types: dashboard-create, dashboard-delete, dashboard-download, dashboard-export, dashboard-import, dashboard-modify, dashboard-publish, folder-create, folder-delete, folder-modify, scheduled_task-create, scheduled_task-delete, scheduled_task-modify.
Adds Dependencies column to Log Stream Parsers Overview tab to show parser completeness and quality.
Introduces Enrichments tab in Log Stream for viewing, managing, enabling/disabling, editing, exporting, and importing enrichment rules.
Adds Event Filtering tab in Log Stream to filter events routed to New-Scale Analytics detection engine or Attack Surface Insights application.
Allows device context tables (Active Directory, CrowdStrike, Microsoft Entra ID) in both Basic and Advanced search queries.
Introduces Relative time range option for Search queries allowing custom start/end relative dates.
Adds guardrails/warnings for pipe operator misuse in Advanced Search mode suggesting AND or WHERE alternatives.
Introduces Timeline view for Search results to visualize investigation timelines of detection events.
Adds Rule Details panel in Search showing raw logs, parsed fields, and associated rules for detection events.
Adds Insights tab in Event Details panel for visualizing surrounding context (assets, countries, files) for user/device events.
Adds Entities tab to Basic Search pre-built lists for searching user/entity accounts with enriched data.
Adds multi-template support for Windows File Collector and Linux File Collector allowing different log conditions per template.
Adds configurable Splunk fetch interval options in the Splunk collector.
Adds support package generation command via PowerShell for Windows Event Log, File, and Archive Collectors.
Adds support for Ubuntu 24.04 operating system for Site Collector installation.
Adds SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. connection option with custom security certificates to Kafka Collector (Early Access).
Enables investigation of triggered analytics rules as detections in Threat Center for New-Scale portfolio license holders.
Updates risk score calculation in Threat Center to use behavioral analytics rarity scores and confidence factors.
Adds ability to manually create cases from scratch without an associated alert in Threat Center.
Enables AI-generated case names (Copilot Case Names) for cases converted from alerts in Threat Center.
Enhances entity display in Threat Center showing full name/email for users and hostname for devices.
Allows viewing device entity details from Attack Surface Insights directly within Threat Center.
Adds User Entity Search capability via Entities tab to find cases/alerts grouped by specific user entities.
Adds new SCOPE column in Threat Center listing counts of Rules, Users, Endpoints, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. tactics/techniques, and Use Cases.
Enhances investigation timeline navigation to automatically filter Search events by assigned risk score.
37 details in Everything
└──▷ BREAKING ON UPGRADE
!Correlation rules in test mode no longer create Threat Center cases or alerts; events now have activity typerule-trigger-test.
Hunters Pathfinder AI January 2025 (2): New Netskope V2 integration with two detectors and EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. detection logic.
└──▷ HOW TO FIND IT
Connect Netskope V2 to ingest findings as leads.
📍Regenerate your Netskope API token as a V2 token. Edit the connection settings on Hunters to reflect the new token.
Adds Netskope Audit Events and Netskope Application Events detections via the updated Netskope V2 integration
Adds aws_unusual_amount_of_ec2_access detector to identify suspicious EC2 access patterns including password enumeration
Hunters Pathfinder AI adds multi-tenant SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. queue, new Fortinet/Zscaler integrations, custom scoring API, and AWS/gSuite detectors
Adds like wildcard operator for asset tagging rules and renames exact value to equals
Exposes the Leads Scoring API endpoint for programmatic creation of custom scoring rules
Integrates Fortinet FortiMail logs into the data lake with IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search mapping
Integrates Fortinet FortiAnalyzer logs into the data lake with IOC Search mapping
Integrates Zscaler Nanolog Streaming Service (NSS) logs into the data lake with Web Requests schema mapping
+7 moreshow less
Adds edr_anomalous_ssm_startsession_command_execution detector for anomalous AWS SSMAWS SSMAWS Systems Manager, an Amazon service that lets operators manage EC2 instances and on-premises servers without opening inbound ports, replacing SSH with API-driven session and command execution. commands
Adds aws_console_login_by_federated_user detector for federated console logins
Adds edr_manual_credentials_gathering_using_aws_imds detector for manual IMDS credential harvesting
Adds gsuite_phishing_by_container_bound_script detector for Google Workspace phishing via container-bound scripts
Adds aws_access_key_compromised_policy_attatched detector for AWSCompromisedKeyQuarantine policy activation
Adds generic_password_spray_successful_model_v2 scoring layer for high-probability spray attacks
Adds Large number of failed logins custom rule with a 150-attempt threshold for brute force leads
Adds Beta Subscriptions page for unified subscription management and MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions. community allocation
Adds Settings > Subscriptions page to view and manage all subscriptions
Enables MSSPs to allocate purchased subscriptions directly from the product interface
Sekoia.io adds six new integrations (Olfeo, Ubika, ESET, Bitsight, EfficientIP, 1Password) and changes Mimecast auth error handling.
Adds olfeo intake for network security monitoring in GA
Adds ubika_cloud_protector_traffic intake for traffic analysis in GA
Adds eset_protect intake for endpoint protection monitoring in GA
Adds bitsight_spm intake for supply chain risk monitoring in GA
Adds efficientip_solidserver_ddi intake for DDI monitoring in GA
+1 moreshow less
Adds 1password_epm intake for enterprise password manager data in GA
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Mimecast Email Security intakes now treat authentication errors as CRITICAL level (previously ERROR) and automatically stop the intake after 5 failed attempts, with a 30-minute grace period for counter reset.
!Fortinet Fortigate events using the timestamp field now use native timezone for calculations; the eventtime field is prioritized as the primary timestamp source if available.
New feature environment groups for MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions. management and IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. email mapping support
Introduces Feature Environment groups to group environments for MSSP use cases
Adds capability to map individual user emails on the IdP group mapping page for Cloud Identity Provider customers
Adds instructions and capability to create SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents.-only or SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions.-only user permissions
3 details in Everything
1 more release in this issue
· 2025-01-07 → 2025-01-28
Databricks on AWS GovCloud DoD reaches GA for DoD agencies with FedRAMP HighFedRAMP HighA US federal authorization tier for cloud services, managed by GSA, certifying that a provider meets the strictest NIST 800-53 controls required to handle the most sensitive unclassified government data. and IL5 requirements.
Makes Databricks on AWS GovCloud DoD generally available.
Databricks Clean Rooms GA introduces management APIs, single-metastore self-collaboration, Azure output tables, HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. profiles, and federated sharing preview.
Adds Management APIs to automate Clean Rooms setup, orchestration, and monitoring
Adds Self-Collaboration feature to create Clean Rooms in a single metastore for testing
Extends Output Tables support to central Clean Rooms hosted on Azure (previously AWS only)
Adds HIPAA compliance security profile option when creating a Clean Room
Introduces Federated Sharing (Preview) to collaborate across clouds and data platforms via query federation
Mosaic AI Agent Framework adds streaming output and automatic AI Gateway inference tables for custom Python agents.
Adds streaming output support for deployed custom Python agents to improve time to first tokentime to first tokenTime to first token, the wait between submitting a request and receiving the first generated token. It includes delays such as queuing and processing the prompt.
Enables AI Gateway inference tables automatically for custom Python agents to provide enhanced logging metadata
Databricks supports notebooks as workspace files, enabling programmatic creation, reading, and deletion via the filesystem API.
Adds notebook type to workspace files, allowing programmatic write, read, and delete operations on .ipynb files via the standard workspace filesystem API.
Notebook output improvements for Databricks notebooks include column filtering, copy-as formats, and cell download naming.
Adds Is one of column filtering in notebook result tables via the column menu
Supports copying result tables as CSV, TSVTSVA plain-text format storing tabular data with fields separated by tab characters, making it easy for cyber tools to parse and exchange structured records without a CSV parser's quoting complexity., or Markdown via right-click context menu
Changes default download name for cell results to match the notebook filename
Databricks JDBCJDBCA Java standard API for connecting applications to relational databases, maintained as part of the Java SE platform, letting tools query any compliant database through a single consistent interface. driver 2.7.1 adds OAuth port overrides, refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API., and system trust store support.
Adds OAuthEnabledIPAddressRanges property to override default OAuth callback ports for restricted networks
Adds Auth_RefreshToken property to enable automatic token refresh
Adds UseSystemTrustStore property (value 1) to verify connections using the system's trusted store certificates
Adds UseServerSSLConfigsForOAuthEndPoint property to share SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. configuration for the OAuth endpoint
Changes default authentication to disable BASIC auth; requires allowBasicAuthentication=1 to re-enable
5 details in Everything
└──▷ BREAKING ON UPGRADE
!BASIC authentication is now disabled by default; clients must set allowBasicAuthentication=1 to use it
Mosaic AI Gateway Public Preview adds provisioned throughput for model serving endpoints with governance features.
Adds provisioned throughput support to Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves. on model serving endpoints (Public Preview).
Enables permission and rate limiting governance on endpoints using provisioned throughput.
Enables payload logging via inference tables for audit on endpoints using provisioned throughput.
Enables usage tracking via system tables for operational monitoring on endpoints using provisioned throughput.
Enables AI Guardrails for request/response filtering on endpoints using provisioned throughput.
+1 moreshow less
Enables traffic routing capabilities on endpoints using provisioned throughput.
Wazuh v4.10.0 adds RESTful API endpoint for agent uninstall, new Windows Server 2012 SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. policy, and self-recovery for indexer connector CA files
└──▷ GET THIS VERSION
$ git clone --branch v4.10.0 https://github.com/wazuh/wazuh.git
# already have the repo? check out this version:$ git checkout v4.10.0
Creates new RESTful API endpoint to trigger the agent uninstall process.
Allows multiple Certificate Authority files in the indexer connector.
IntelOwl v6.2.0 adds phishing analysis framework, Elasticsearch GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands., new analyzers, and VirusTotal sample download
└──▷ GET THIS VERSION
$ git clone --branch v6.2.0 https://github.com/intelowlproject/IntelOwl.git
# already have the repo? check out this version:$ git checkout v6.2.0
└──▷ HOW TO FIND IT
Enable the bundled Elasticsearch container to index all IntelOwl job results and query them via the new Search page
📍In the console, go to the IntelOwl deployment and start the Elasticsearch container via the provided compose profile, then navigate to the UI Search page to query historical job data by observable, job_id, or analyzer result.
Create a custom analyzer tailored to an internal API without editing config files
📍In the IntelOwl UI, go to Plugins › Analyzers and click Create Custom Analyzer, fill in the endpoint, authentication, and observable types, then save and use it in a new scan.
New URL phishing analysis framework with concurrency support for automated phishing page inspection
New LoadFileSamePlaybook pivot enables chaining file-based analysis within the same playbook
New Androguard analyzer for Android APK static analysis
New MobSF_Service analyzer for mobile application security analysis via MobSF
New NERD observable analyzer for IP reputation lookups via CESNET's NERD service
+10 moreshow less
New DShield observable analyzer for IP threat intelligence via SANS DShield
New urlDNA.io observable analyzers for URL threat intelligence
New NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. CVE analyzer for querying NIST's National Vulnerability Database
New document URL extraction analyzer to pull URLs embedded in documents
New VirusTotal suspicious-files detection capability and ability to download VT samples directly
Adds DataModel Plugin layer to normalize and index analyzer report output across plugins
Elasticsearch integration now ships as a bundled container with Kibana-ready index mappings, including job_id field
New Elasticsearch-backed search page in the frontend UI for querying historical job data
Enables creating Custom Analyzers directly from the GUI without editing config files
New Visualizer download button to export visualizer output
Watcher v2.1 introduces TheHive, Citadel, and Slack notification integrations plus SMTPS email support.
└──▷ GET THIS VERSION
$ git clone --branch v2.1 https://github.com/thalesgroup-cert/Watcher.git
# already have the repo? check out this version:$ git checkout v2.1
SMTPS replaces SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. for email notifications to enhance transport security.
The TheHive integration enables automatic alert creation via TheHive APIs.
The Citadel integration delivers notifications through the Citadel enterprise application APIs.
Slack notifications are now supported, allowing direct delivery via Slack APIs.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Email notifications now require SMTPS; existing SMTP configurations will fail without updating the SMTPS endpoint/credentials in .env.
MISP v2.5.6 adds the Threatmon MISP Community and delivers correlation engine performance improvements via split queries.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.6 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.6
Adds the Threatmon MISP Community to the platform's community integrations.
Improves correlation engine performance by splitting attribute correlation lookups into two distinct queries on value1 and value2 for optimized MySQL performance.
Reduces memory usage when fetching index data from Redis cache.
MISP v2.5.5 adds misp_stix_converter support for STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. testing.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.5 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.5
Cyberbro v0.3.0 adds permissive CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. support for browser-based API usage.
└──▷ GET THIS VERSION
$ git clone --branch v0.3.0 https://github.com/stanfrbd/cyberbro.git
# already have the repo? check out this version:$ git checkout v0.3.0
Adds basic CORS support to allow the API to be called from web browsers
1 detail in Everything
2 more releases in this issue
· 2025-01-20 → 2025-01-29
First release of Cyberbro service with 18 engines, URLscan integration, OpenCTI support, and advanced GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. configuration.
└──▷ GET THIS VERSION
$ git clone --branch v0.1.0 https://github.com/stanfrbd/cyberbro.git
# already have the repo? check out this version:$ git checkout v0.1.0
└──▷ HOW TO FIND IT
Run a scan using only specific engines like URLscan and OpenCTI by filtering the available list in the UI.
📍In the Cyberbro GUI, access Advanced config and select only URLscan and OpenCTI from the 18 available engines before running the scan.
Adds URLscan engine for IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. lookups with IP and hash capabilities to identify related domains
Adds OpenCTI engine to the available scan engines
Introduces Advanced config feature accessible via the GUI to choose which of the 18 engines are displayed/used
Tenzir is a data pipeline engine for security teams that collects, transforms, enriches, and routes telemetry.
Tenzir v4.27.0 adds TQL2 chart operators, retention settings and AWS MSK IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. auth
tenzir.retention.metrics and tenzir.retention.diagnostics config keys added to control metric and diagnostics retention time.
chart_line, chart_area, chart_bar, and chart_pie operators added to TQL2 for visualizations in the Tenzir Platform.
unroll operator now supports record fields in addition to lists.
AWS MSK IAM authentication enabled via new aws_iam options on load_kafka and save_kafka operators.
Platform plugin supports self-signed TLS certificates via new skip-peer-verification and cacert options.
+1 moreshow less
Input/output operator metrics now include a batches field under input and output records.
6 details in Everything
4 more releases in this issue
· 2025-01-08 → 2025-01-30
New caf metrics endpoint, merge and to_asl TQL functions, write_tql operator, and refined timestamp/duration formatting.
Adds metrics "caf" section exposing actor framework performance insights for benchmarking
Adds merge(foo, bar) TQL function as shorthand for {...foo, ...bar} to combine two records
Adds string.match_regex(regex:string) TQL function to check partial regex matches against strings
Adds to_asl operator to send OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. normalized events to Amazon Security Lake
Adds write_tql operator to print events as TQL expressions
+5 moreshow less
Adds strip options to write_json and write_ndjson operators to remove null fields, empty records, or empty lists
Improves pipeline startup error rendering for configured pipelines and packages
Default implicit event sink now writes TQL values instead of JSON
Timestamp printer now adds Z suffix for UTC and adjusts fractional digit precision (3, 6, or 9 digits) based on resolution
Durations printed as minutes now use min suffix instead of m with full precision
10 details in Everything
└──▷ BREAKING ON UPGRADE
!Default implicit event sink writes TQL values instead of JSON, requiring consumers to parse TQL format rather than raw JSON
Tenzir v4.25.0 adds TQL2-only mode, new sink operators, and expanded expression support.
└──▷ TRY IT
Enable TQL2-only mode for a node to enforce new syntax and deprecate legacy pipelines.
$ tenzir-node --tql2
Introduces --tql2 CLI flag and TENZIR_TQL2=true environment variable to enable TQL2-only mode, deprecating TQL1 in favor of the legacy operator.
Adds to_opensearch and to_elasticsearch sink operators for sending data to OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions.-compatible Bulk API providers.
Adds to_snowflake sink operator to write events into a Snowflake table.
Implements in subnet and subnet in subnet expressions (e.g., 1.2.3.4 in 1.2.0.0/16) for IP/subnet containment checks.
Adds float(number|string) function to convert numbers and string expressions into float type values.
+8 moreshow less
Adds duration(string) -> duration function to parse string expressions as duration values.
Adds string.parse_leef() function to parse a string as a LEEF message.
Enhances load_http and save_http operators with new options: data, json, form, skip_peer_verification, skip_hostname_verification, chunked, and multipart.
Adds user-defined operator support in TQL2, requiring the // tql2 comment prefix or --tql2 flag.
Porting deduplicate to TQL2 with expression-based common keys and granular timeout control.
Adds context::erase operator for selectively removing entries from contexts.
Implements TQL2 from and to operators that auto-deduce load/save operators, compression, and format from URLs (e.g., to "ftps://example.com/file.json.gz").
Enables custom quote characters, doubled quote escaping, multi-character separators, and empty string list_sep in read_csv, read_kv, read_ssv, read_tsv, and read_xsv operators.
13 details in Everything
└──▷ BREAKING ON UPGRADE
!The array version of from that allowed you to create multiple events has been removed.
!The compress and decompress operators have been deprecated in favor of separate operators for each compression algorithm (e.g., compress_gzip).
!TQL2-only mode will eventually be enabled by default and the legacy operator and TQL1 support will be removed entirely.
Kunai v0.5.0 adds user/group name resolution, per-CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. FS event rate limiting, and three new event types: start, error/log, and event_loss.
└──▷ GET THIS VERSION
$ git clone --branch v0.5.0 https://github.com/kunai-project/kunai.git
# already have the repo? check out this version:$ git checkout v0.5.0
Adds user and group name resolution so events include human-readable user/group context for richer audit and security analysis.
New start event surfaces detailed agent startup information and system metadata at launch time.
New log event (refactored from error event) distinguishes informational, warning, and error messages from the agent.
New event_loss event reports when kernel-to-userland event drops occur, giving visibility into data loss under high load.
New per-CPU filesystem event rate limiting (configurable task-level and global limits) prevents event floods and improves resource management.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The config key max_eps_io is renamed to max_eps_fs; existing configs using max_eps_io will break.
!Event IDs have been redefined (change: redefine new event ids); any detection rules or pipelines that match on numeric Kunai event IDs may break.
Beelzebub v3.3.1 adds support for custom prompts in the LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. honeypot plugin.
└──▷ GET THIS VERSION
$ git clone --branch v3.3.1 https://github.com/mariocandela/beelzebub.git
# already have the repo? check out this version:$ git checkout v3.3.1
Supports custom prompts in the LLM honeypot plugin, enabling tailored AI-driven deception personas per honeypot service.
1 detail in Everything
1 more release in this issue
· 2025-01-14 → 2025-01-16
Beelzebub v3.3.0 lets LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. honeypots use custom prompts for tailored attacker deception.
└──▷ GET THIS VERSION
$ git clone --branch v3.3.0 https://github.com/mariocandela/beelzebub.git
# already have the repo? check out this version:$ git checkout v3.3.0
└──▷ HOW TO FIND IT
Define a custom LLM prompt in your honeypot config to simulate a specific system (e.g., a vulnerable legacy SSH server) and make attacker interactions more convincing.
📍In the honeypot service configuration, set the custom prompt field for the LLM honeypot to a scenario-specific instruction, such as: "You are a vulnerable Linux SSH server running OpenSSH 6.6. Respond as if you are compromised and cooperative."
Supports custom prompts for LLM-powered honeypots, enabling operators to tailor AI-generated responses to specific attacker personas or environments.
ESCU v5.0.0 adds 52 new detections, 9 analytic stories, a Deprecation Assistant Dashboard, and an Analytic Story Onboarding Assistant.
└──▷ GET THIS VERSION
$ git clone --branch v5.0.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v5.0.0
New Deprecation Assistant Dashboard lets ESCU users identify and manage deprecated detection analytics currently enabled in their Splunk environment before removal in v5.2.0.
New Analytic Story Onboarding Assistant (preview) streamlines enabling detections from multiple analytics stories where data is available in the Splunk environment.
Redesigned home page with enhanced UI provides direct access to release notes, analytics counts, latest Splunkbase version, and a timeline of STRT blogs and updates.
Adds 9 new analytic stories covering Backdoor Pingpong, Cleo File Transfer Software, Crypto Stealer, SDDL Tampering Defense Evasion, Derusbi, Earth Estries, Nexus APT Threat Activity, WinDealer RAT, and XorDDos.
Adds 52 new detections spanning AWS cloud abuse (access keys, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. brute force, snapshot exfiltration, S3 lifecycle evasion), Azure AD/O365 service principal enumeration and privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., Microsoft Intune abuse, Windows SDDL/service descriptor tampering, Office product exploitation chains, network scanner behavior, and more.
+1 moreshow less
Replaces the observables key with an RBARBARisk-Based Authentication, an approach that adjusts login challenge strength based on contextual signals like location or device, letting cyber tools step up verification only when anomaly scores cross a threshold. key in YAML configurations to align with Enterprise Security standards and simplify risk attribution.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The observables key in YAML configurations is replaced with the RBA key; existing content referencing observables will need to be updated.
Cribl Stream 4.10 adds Zscaler NSS source, IPFIXIPFIXAn IETF standard protocol for exporting network flow records from routers and probes to a collector, giving cyber tools a vendor-neutral stream of structured traffic metadata without full packet capture. parsing, PIV auth, new CLI diag commands, and socket management settings.
Adds Zscaler Cloud NSS Source for receiving log data from Zscaler’s Nanolog Streaming Service
Adds support for IPFIX messages in the renamed NetFlow & IPFIX source, including template records and options templates
Adds Personal Identity Verification (PIV) authentication using smart cards for on-prem deployments
Adds decrypt function in the CLI to decrypt configuration secrets such as encryption keys and passwords
Adds diag subcommands (perf, cpuprofile, heapsnapshot) to generate CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. profiles or heap snapshots from the CLI
+9 moreshow less
Adds persistent queue usage notification triggers for Sources when disk usage exceeds a threshold
Adds new socket management settings for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it.-based Sources: Socket idle timeout, Socket max lifespan, and Forced socket termination timeout
Adds Partitioning scheme drop-down option for DDSS in the S3 Collector
Adds Blob access tier selection for the Azure Blob Storage Destination
Adds Compression levels support for the Amazon S3 Destination
Adds additional realms (us2, eu1, eu2, au0, jp0) to the SignalFx Destination
Adds Max active connections setting under Advanced Settings in the Syslog Source UI
Adds Delete files setting on the File Monitor Source for Manual Discovery mode
Adds mapping of Teams to multiple IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. groups in Cribl.Cloud
New Surface Command connectors, NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0 pack, GuardDuty attack sequence detection, InsightVM alert enrichment, Microsoft Defender auto-triage, and User Management redesi
Integrates Cisco Umbrella DNS, Claroty xDome, ManageEngine ServiceDesk Plus Asset Catalog, Honeywell SCADAfence, Nozomi Vantage, and SpecterOps BloodHound Enterprise into Attack Surface Management (Surface Command)
Adds NIST Cybersecurity FrameworkNIST Cybersecurity FrameworkThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. (CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals.) 2.0 compliance pack for AWS and Azure
Leverages Amazon GuardDuty's new attack sequence findings in Cloud Detection and Response
Enriches SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. (InsightIDR) alerts with InsightVM risk context to view exploitable vulnerabilities within alerts
Automatically identifies benign activity and real threats for Microsoft Defender alerts using advanced AI models
+1 moreshow less
Redesigns User Management interface to support tailored access per organization, conflict prevention logic, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. integration via User Group and Group Sync
DefectDojo 2.42.2 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. range filters, image tag parsing for AWS findings, ALBA vuln ID support, and verified status granularity.
└──▷ GET THIS VERSION
$ git clone --branch 2.42.2 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.42.2
Adds range filters for EPSS scores, enabling filtering findings by EPSS probability ranges.
Adds imageTags extraction to AWS SecurityHub and Inspector2 parsers for richer finding context.
Adds ALBA as a supported vulnerability ID type in settings.
Adds granularity to the Verified Status Toggle via a new database-backed capability.
Adds Kubernetes resource annotations support across different resources.
DefectDojo 2.42.0 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scoring to generic CSV parser, new Request/Response API CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. endpoints, and expanded JIRA/finding filters.
└──▷ GET THIS VERSION
$ git clone --branch 2.42.0 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.42.0
└──▷ TRY IT
Retrieve HTTP request/response evidence attached to a finding for triage or reporting.
$ curl -X GET 'https://<defectdojo>/api/v2/request_response/?finding=<finding_id>' \
-H 'Authorization: Token <token>'
Adds EPSS score and percentile fields (epss_* parameters) to the generic CSV parser for vulnerability prioritization data.
New Request/Response API CRUD endpoints for managing HTTP request/response data on findings.
Adds ordering support to the Test_Import API endpoint.
Allows None as an option for Active/Verified status on Import/Reimport API calls, mirroring UI behavior.
New filter for findings by Has Any JIRA (covering both grouped and single JIRA issues).
+10 moreshow less
Adds filters to the Products list under View Product Type.
Updates the Dashboard Reported Finding Severity by Month chart to aggregate by month instead of by day.
Adds CGA vulnerability ID support to the dedupe/vuln-ID settings.
Adds DTSA vulnerability ID support.
Adds GLSA (Gentoo) vulnerability ID support.
Updates JIRA for Finding Groups when a Risk Acceptance expires.
Adds Horusec Scan to hashcode deduplication settings.
Sets deduplication configuration for Qualys Hacker Guardian parser.
Disallows multiple single-use notes on a single object (enforced via API).
FedRAMP ModerateFedRAMP ModerateA US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts. release adds Weakness Tab, Tags, Exposure Cards, Asset Classes view, and Score Toggle to Inventory and Lumin views.
[Weakness Tab] Access a comprehensive view of all weaknesses associated with your asset for better risk management
[Tags] Explore asset-related tags to understand their context and relationships with other assets
[Exposure Cards] View all Lumin Exposure View associated with an asset
[Devices] (Restricted By Asset Class) View devices associated with an account or identity's class asset
[Score Toggle] Toggle Asset Exposure Score and Asset Criticality Rating scoring options in Inventory Asset and Exposure Views
Tenable One Identity Exposure 3.86 adds Hybrid Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. IoE, CSV export separator control, and trust attribute support
└──▷ HOW TO FIND IT
Configure object ownership rules for security principals via group membership
📍Permitted Object Owner (by Group Membership)
Adds Hybrid Entra ID Information Indicator of Exposure to provide insights into Microsoft Entra ID data replicated to on-premises Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments.
Adds Permitted Object Owner (by Group Membership) option to allow security principals to be designated as object owners through their group membership
Adds Permitted Trustees List (by Group Membership) option to enable assignment of special permissions to security principals based on their group membership
Adds ability to choose CSV export separator (comma or semicolon) in the export function
Introduces Identity 360 for unified identity inventory and risk ranking across AD and Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments..
Adds Identity 360, a new identity-centric view that unifies inventories of Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. and Entra ID identities ranked by risk.
Enables drilling down into contextual lenses such as accounts, weaknesses, and devices associated with each identity within Identity 360.
Tenable introduces Data Stream for continuous AWS S3 export and custom role recasting of Host Audit findings
Adds Data Stream integration to continuously send vulnerability data (assets, findings, tags payloads and manifest) to a configured AWS S3 bucket in JSON format as an alternative to export APIs.
Enables custom roles to recast or accept Host Audit data for Tenable One Vulnerability Management, Tenable One Web App Scanning, and Host Audit findings.
faraday-agent-dispatcher 3.6.0 adds option to retrieve all completed scans from Tenable SC.
└──▷ GET THIS VERSION
$ git clone --branch 3.6.0 https://github.com/infobyte/faraday_agent_dispatcher.git
# already have the repo? check out this version:$ git checkout 3.6.0
Brinqa 11.29.138 adds multi-value paste in VQB, NOT relationships in Data Warehouse BQL, and OR with IsCurrentUser piped attributes.
Enable pasting a list of values directly into multi-value fields in the Visual Query Builder (VQB), allowing multiple CVE IDs to be input at once.
Support BQL queries in Data Warehouse using NOT in a relationship.
Support using the OR operator with IsCurrentUser conditions, each with piped attributes, in Data Warehouse BQL queries.
Remove Calculation as a mandatory field for category attributes.
Update the Data Exporter role to restrict access to only exports created by that user.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The NIST NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. connector is no longer supported in Brinqa Platform version 11.28 or later.
An asset discovery and inventory platform that identifies and maps all devices on networks without requiring agents.
runZero 4.0 adds multi-dashboard support with organizational sharing, profile-level preferences, and default dashboards for admins.
Adds ability to create multiple dashboards, share them to organizations where you have User privileges or higher, and set a preferred dashboard in profile settings
Adds organization-level setting allowing administrators to set a default dashboard per organization from shared or runZero managed dashboards
Updates dashboard query links to respect the Search live assets attribute
Makes the change report visible on the Task Details page
4 details in Everything
6 more releases in this issue
· 2025-01-06 → 2025-01-29
runZero 4.0.250113.0 adds Matter IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. and SLP fingerprinting, MAC recording in Tenable integration, flatten_json module, and API role persistence
Matter IoT protocol support added for device fingerprinting.
SLP (Service Location Protocol) added for device probing.
Tenable integration now records MAC addressesMAC addressesA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. without associated IP addresses.
Asset details page groups unmapped MACs by interface in the Layer2 information section.
Custom integration scripts can import and use flatten_json module with its flatten method.
+1 moreshow less
Organization roles are persisted when creating or updating a group via the API.
Custom integration scripts run on Explorers and trigger via tasks; adds Inside Out ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. and shared key misuse vulnerability records.
Adds capability to execute custom integration scripts directly on runZero Explorers and trigger them via runZero tasks
Creates vulnerability records for inside-out attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. management of internal assets
Creates vulnerability records for misuse of shared encryption keys
Fleet 4.62.0 adds label-scoped software deployment, Fleet secrets in scripts/profiles, and macOS 15 CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmark support.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.62.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.62.0
└──▷ TRY IT
Filter a query's host results to only those belonging to a specific team when viewing an inherited query.
Adds support for Fleet secrets ($FLEET_SECRET_YOURNAME) in scripts and software installer scripts and profiles, with validation on ingestion and automatic profile re-push when a secret value changes.
Adds new /fleet/spec/secret_variables API endpoint for managing Fleet secret variables.
Adds label-based scoping for Fleet-maintained apps and custom packages, controllable via UI, API, and CLI (labels_include_any / labels_exclude_any).
Adds automatic skipping of software installs when the software is not scoped to the host via labels.
Adds automatic generation of trigger policies for custom software packages.
+13 moreshow less
Updates fleetctl gitops to support scoping software installers by labels using labels_include_any or labels_exclude_any conditions.
Updates fleetctl gitops to detect and save Fleet secrets found in scripts and profiles to the Fleet server.
Adds macOS 15 CIS benchmark support alongside updated macOS 13 and 14 benchmarks.
Updates the queries API to support platform-targeted filtering, pagination, and now returns count and meta pagination fields.
Adds searchable query targets with improved UI for environments with many teams or labels.
Adds optional team_id parameter to the queries report endpoint (GET /api/latest/fleet/queries/{query_id}/report) to filter results by team.
Allows software uninstalls and script-based host lock/unlock/wipe to run even when global scripts are disabled.
Allows maintainers to manage install software or run scripts on policy automations.
Adds SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. alerting for scheduled cron job errors, with a dedicated cron_job_failure_monitoring key in sns_topic_arns_map to route alerts to a separate topic.
Changes the script upload endpoint (POST /api/v1/fleet/scripts) to automatically normalize CRLF line endings to LF.
Adds ability to click a software row on the My Device page to view that software's installation details on the host.
Adds service annotation field to the Helm Chart and additional Helm chart customization options (e.g., Google cloud_sql_proxy in the fleet-migration job).
Increases maximum installer URL length in GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. configurations to 4,000 characters.
Installomator v10.7 adds 97 new application labels and updates 37 existing ones for automated macOS software deployment.
└──▷ GET THIS VERSION
$ git clone --branch v10.7 https://github.com/Installomator/Installomator.git
# already have the repo? check out this version:$ git checkout v10.7
Adds new labels for Ableton Live 12 variants: abletonlive12intro, abletonlive12lite, abletonlive12standard, abletonlive12suite, and abletonlive12trial.
Adds new labels for 34 Cherry Audio synthesizer products including cherryaudiosync, cherryaudiovoltagemodular, cherryaudiominiverse, and others.
Adds new labels for cinema4d2023, cinema4d2024, and cinema4d2025.
Adds expiry date alerts and passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. search support in 1Password for Android.
Allows setting expiry alerts on items via Edit mode > Date > Set expiry alert dropdown
1 detail in Everything
7 more releases in this issue16 more releases in this issue · 2025-01
Improved password strength list display, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. loading indicators, and SSH agent compatibility for older servers.
Selecting a password strength in Watchtower shows a filtered item list
Shows loading indicator during SSO/passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. sign-in on desktop
Expiry alerts for items, passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. search syntax, and Windows ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. SSH signing support
└──▷ TRY IT
Quickly find all passkey-based items in your vault without scanning the list manually.
$ =passkey
Adds expiry date fields and configurable alert schedules for items via the edit mode +add more > Date workflow
Adds =passkey as a new search query prefix to filter items containing passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices.
Enables the op-ssh-sign-wsl commit signing helper on Windows ARM64 platforms
1Password for iOS 8.10.58 adds expiry alerts, passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. search via =passkey, and QR sign-in with offline items
└──▷ HOW TO FIND IT
Filter search results to only show credentials stored as WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in./PasskeysPasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices.
📍=passkey
Adds expiry date field and Set expiry alert dropdown to item edit mode for scheduling notifications
Enables filtering AutoFill password suggestions by category in app or website fields
Adds =passkey search syntax in the search bar to filter items containing passkeys
Allows signing in via QR code even when local storage is empty (offline items)
Updates VoiceOver accessibility to spell out characters (including case and punctuation) for passwords
Adds expiry alert configuration and passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. search syntax to 1Password for Linux
Allows setting expiry alerts on items via the Date field with a selectable alert schedule
Enables searching for all items containing passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. using the =passkey query syntax
1Password SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Manager Jan 2025 adds Entra/Google Workspace/JumpCloud IdPs, workflow copy-paste, and Podio integration
Workflow editor supports Copy & Paste of steps via clipboard
Access requests can now be processed using Entra, Google Workspace and JumpCloud as Identity Providers
Access grants allow specifying separate group membership settings per application
Approvers can edit the requested access level after an access request is raised
Automatic provisioning can be triggered manually via a button on the manual task step
+1 moreshow less
New integration with Podio added to supported connectors
Adds =passkey search operator, passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. on Windows ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead., and enhanced Watchtower filtering.
Adds the =passkey search operator to filter items containing passkeys
Enables the commit signing helper (op-ssh-sign-wsl) for Windows ARM64
Adds Watchtower password strength bar interaction to list items by strength category
1Password for iOS adds passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. search filter and QR code sign-in for offline items
Adds =passkey search syntax to filter items containing a passkey
Enables QR code sign-in for accounts with offline items
1Password Android beta adds passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. search via =passkey query and refined sign-in UX.
Adds =passkey search operator to filter items containing passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices.
Adds Scan QR code option on the sign-in screen alongside Enter account details
Updates label fields to remain blank when no custom label is provided
1Password for Linux 8.10.58-31 adds passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. search, enhanced Watchtower filtering, and LastPass private key support.
└──▷ HOW TO FIND IT
Quickly find all passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. stored in your vault without manually checking each item.
📍=passkey
=passkey search operator added to Quick Find to filter items containing passkeys
Watchtower Overall Password Strength bar now drills down to list items of the selected strength when clicked
LastPass importer updated to handle newer private key encodings
JumpCloud adds Application Restriction, Custom MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. (OMA-URI), and Windows Time Service policies in Jan 14, 2025 update
Adds Application Restriction policy to allow or block specific applications on devices/groups
Adds Custom MDM (OMA-URI) policy for precise control via OMA-URIs outside pre-built templates
Adds Windows Time Service Configuration policy to set NTP server synchronization targets
Adds Config Refresh policy to enable frequent evaluation of policy updates for compliance
JumpCloud adds Android EMMEMMEnterprise Mobility Management: a category of software for enforcing policies on mobile devices, apps, and data, giving cyber tools a hook to monitor or control endpoints without managing the full OS. support for Authenticate Using Google enrollment integration
Authenticate Using Google setting added to Android Enrollment flow, linking user identity to device during enrollment for seamless Google services access.
New app-to-app integrations table to visualize access sharing across SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. entities.
Adds the app-to-app integrations table to uncover how apps share access via API keys, service accounts, OAuth grants, and other non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls.
Acronis Cyber Protect combines backup, disaster recovery, and endpoint protection in one platform for businesses and managed service providers.
Agentless backup for Nutanix AHVAHVAcropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license. VMs, support for Linux kernels 6.10/6.11, and new ticket mapping flow for HaloPSA and Kaseya BMS integrations.
Adds agentless backup support for Nutanix Acropolis Hypervisor (Nutanix AHV) virtual machines with flexible storage options (Acronis Cloud, Nutanix Objects, or Nutanix Files).
Extends Linux workload backup to support kernel versions 6.10 and 6.11.
Introduces a new ticket mapping flow in cloud integrations that groups alert types by application for HaloPSA and Kaseya BMS.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!/api/ams/ REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. is deprecated with a one-year notice period; users must migrate to the new public REST API.
Druva is a SaaS data protection platform that backs up enterprise workloads, endpoints, and SaaS applications and restores them after ransomware.
Adds IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Library for threat intel management and Microsoft Sentinel integration with Druva Events Data Connector and Quarantine Playbooks
Adds IOC Library for creating and storing multiple IOC Sets for malware and ransomware scans
Adds Druva-published IOC Sets sourced from trusted sources like CISA advisories
Adds Quarantine Playbooks for managing ransomware response by quarantining infected backup snapshots
3 details in Everything
6 more releases in this issue
· 2025-01-03 → 2025-01-30
Druva Enterprise Workloads adds disk exclusion for Nutanix AHVAHVAcropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license., KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. NAS auth, and granular Archive retention formats.
Adds disk exclusion option in Nutanix AHV backup configuration to skip specific virtual disks
Enables Kerberos V5 authentication for NAS proxies alongside existing basic authentication
Adds support for Daily, Weekly, Monthly, and Yearly retention formats in Archive policies
New legalHoldTypeIds filter for Legal Hold Policy API and eDiscoveryeDiscoveryA legal process for identifying, collecting, and producing electronically stored information in response to litigation or investigation; cyber tools integrate with it to extract and preserve forensic evidence in legally defensible formats. Download Client v2.0.9
List Legal Hold Policies v4 API gains a legalHoldTypeIds filter to search by policy type ID.
eDiscovery Download Client updates to version 2.0.9 for Cloud.
The eDiscoveryeDiscoveryA legal process for identifying, collecting, and producing electronically stored information in response to litigation or investigation; cyber tools integrate with it to extract and preserve forensic evidence in legally defensible formats. Download client has been updated to version 2.0.9 with minor enhancements for inSync GovCloud users.
Kopia is an open-source backup tool for Windows, macOS, and Linux with incremental snapshots, client-side end-to-end encryption, compression, and deduplication, with both a CLI and a GUI.
Kopia v0.19 adds desktop notifications, snapshot report alerts in UI/server, and JSON notification output to stderr under KopiaUI.
└──▷ GET THIS VERSION
$ git clone --branch v0.19.0 https://github.com/kopia/kopia.git
# already have the repo? check out this version:$ git checkout v0.19.0
└──▷ TRY IT
Enable authentication event logging on a Kopia server to audit successful logins without flooding logs during normal operation.
$ kopia server start --log-server-requests
Emits notifications as JSON to stderr when running under KopiaUI, enabling structured consumption of backup events by external tooling.
Emits snapshot report notifications from the UI and server, so operators receive backup summaries without running a separate client.
Adds support for desktop notifications in the KopiaUI app.
Adds support for defining notification profiles directly in the web UI/desktop app via the Preferences tab.
Gates successful authentication event logging behind --log-server-requests, reducing noise in server logs.
+1 moreshow less
Adds AppArmorAppArmorA Linux kernel security module, maintained as part of the kernel, that confines programs to a declared set of files, capabilities, and network access — letting cyber tools sandbox processes without writing custom kernel code. support for KopiaUI on Ubuntu 24.04.
Ubiq Security Jan 2025: PHP 2.0 & Go 2.2 libraries, Okta SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. sync, community Java samples
└──▷ TRY IT
Install the new PHP library via Composer.
$ composer require ubiq/php-client-lib:^2.0
Released version 2.0 of the PHP Client Library with structured data encryption, key caching with TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. management, and Composer support
Released version 2.2.0 of the Go Client Library adding runtime configuration override for key caching/logging and custom config file path support
Enabled SCIM-based identity auto-provisioning for Okta IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. to sync identities seamlessly
Netskope expands its reporting capabilities by introducing a pre-configured dashboard template for analyzing authenticated user activity across SWGSWGA Secure Web Gateway is a network proxy that inspects outbound web traffic, enforcing policy by blocking malicious sites, filtering content, and decrypting TLS — giving cyber tools a choke point for all user HTTP/S sessions. and CASBCASBA Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. inline deployments.
2 more releases in this issue
· 2025-01-09 → 2025-01-31
Netskope 122.1.0 adds Slack/MS Teams SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications., device cert checks, and pinned app decryption
SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management now supports monitoring for Slack Enterprise with new predefined rules and entities
SaaS Security Posture Management now supports monitoring for MS Teams with new predefined rules and entities
Device Classification Certificate check option now supports Check UPN to compare UserPrincipalName against certificate fields
Device Classification Certificate check option now supports Check Smart Card to validate certs on the card and Smart Card PIN
Device Classification Certificate check option now supports Check CRL to fail posture checks for revoked certificates
+2 moreshow less
New steering exception Steer and Decrypt at Netskope Cloud allows decryption of certificate-pinned app traffic (initially Google Drive on Windows Intel)
SSPM Reports dashboard in NAA now includes ability to filter Findings by SSPM Policy
Netskope adds CCI Gen AI Attributes to Application Events, Alerts, and Incidents data streams for AI risk visibility.
Uses GenAI, Disable GenAI, Customer data for learning, Data sharing with GenAI vendor, Tenant isolation or private instances for GenAI, AI risk regulations and compliance, GenAI usage policy, and Security assessment of GenAI vendor fields are now available in Application Events, Page Events, Alerts, and Incidents data collections.
VNS3 6.7.2 adds custom branding framework for partners and new route update notifications for clientpacks.
ENHANCEMENT Custom branding framework for reseller partners and ISPs allows standardized builds with partner logo, CSS, and color scheme.
ENHANCEMENT New route update process for clientpack notification sends multicast (openvpn) or unicast (wireguard) packets to connected clients upon routing changes.
shadowsocks-rust v1.22.0 adds outbound UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. fragmentation support and specific port binding for ConnectOpts
└──▷ GET THIS VERSION
$ git clone --branch v1.22.0 https://github.com/shadowsocks/shadowsocks-rust.git
# already have the repo? check out this version:$ git checkout v1.22.0
ConnectOpts::bind_local_addr now supports binding to a specific port
EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. adds scan evidence display for findings on the Finding Details page to support attestation and self-validation.
Adds full scan results and specific matching evidence portions to the Finding Details page in EASM
1 detail in Everything
31 more releases in this issue
· 2025-01-06 → 2025-01-31
ZIA raises admin department limit to 2048, adds country filters/logs, new Sandbox API quota, IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. report enhancements, and POST /exportPolicies API.
Increases the maximum number of departments selectable for a Department Scope admin from the previous limit to 2,048
Adds Destination IP Countries, Source IP Countries, Is Destination IP Country Risky?, and Is Source IP Country Risky? filters and columns to Web Insights Logs
Adds %s{srcip_country}, %s{dstip_country}, %s{is_src_cntry_risky}, and %s{is_dst_cntry_risky} fields to the NSS Feed Output Format for web logs
Increases Sandbox Detail Report API quota to 3,000 requests per day with rate limits of 2/sec and 1,000/hour
Enhances the IoT Report to include policy status, statistics, and domain/IP action impact details in Discovered Devices views
+1 moreshow less
Adds POST /exportPolicies endpoint to export policy rules to JSON files
ZIA now supports case-sensitive URL logging for select domain shorteners.
Web Insights Logs and NSS feeds retain original case for URLs from domains like bit.ly and tinyurl.com.
Added case-sensitive URL support for a set of shortener domains including adf.ly, cutt.ly, goo.gl, link.ly, ow.ly, rebrand.ly, snip.ly, t.ly, tiny.cc, and tinyurl.com.
ZDX adds tabular Data Explorer views and packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. disk space limits
Adds a tabular view format option to the Data Explorer, allowing customized views in addition to charts
Adds a new Disk Space Limit configuration option for Packet Capture diagnostics sessions on Windows devices running ZDX Module version 4.5+
ZIA adds Zoom/ShareFile/Slack SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications., Gmail Outbound DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., Extranet support, new HTTP methods, DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring. path config, and expanded API/DLP capabilities.
└──▷ TRY IT
Manage extranet resources via the Cloud Service API
$ GET /extranet
POST /extranet
PUT /extranet
GET /extranet/lite
GET /extranet/{id}
DELETE /extranet/{id}
Adds GET /extranet, POST /extranet, PUT /extranet, GET /extranet/lite, GET /extranet/{id}, and DELETE /extranet/{id} API endpoints to manage Extranet resources
Adds Extranet option in the Tunnel Type filter for NSS Feeds (including Cloud NSS feeds) to limit Tunnel Insights Logs by tunnel type
Adds Extranet Resources on the Extranet page, configured with traffic selectors and DNS servers, available as a Location Type in ZIA locations
Adds new HTTP request methods PROPFIND, PROPPATCH, COPY, MOVE, MKCOL, LOCK, UNLOCK, and PATCH to URL Filtering rules (Policy > URL & Cloud App Control > URL Filtering Policy)
Adds Gmail as an option when configuring Email Tenants in Administration > Email Tenants for Outbound Email DLP
+14 moreshow less
Adds Advanced SSPM support for Zoom, ShareFile, and Slack tenants via the SSPM Scan checkbox during onboarding or under existing tenant settings
Adds Extranet Insights (Analytics > Extranet Insights) to monitor IPSec tunnel health and status
Adds Extranet Name column and filter to Tunnel Insights Logs
Adds DLP detection for addresses, first names, last names, and full names in Japan; and US Driver's Licenses with 2-letter state codes
Adds new page and drill-down links for Instance Discovery Report (Analytics > Instance Discovery Report) including Resource Discovery Report logs
Adds columns App Instance Level 1/2/3 and types, plus corresponding filters, to Web Insights Logs (Analytics > Insights > Web Insights)
Adds Cloud Application column to Step 2 Request Review in Site Review page
Adds option to include subdomains in Email Profiles (Administration > Email Profiles > Domain Profiles)
Increases custom bandwidth classes limit to 245 for Cloud Applications (Administration > Bandwidth Classes)
Increases custom domains per domain profile from 32 to 1,024
Adds pageSize and page request parameters with default pageSize of 100 to GET /pacFiles API endpoint
Updates Advanced Sandbox Submission API quota to 100 file submissions per day by default
Adds File Type Control and DLP support for .xla, .odt, .pub, and .bin file types across Microsoft Office, Open Office Files, and Other Documents categories
Adds customized URL path configuration for DNS servers using DNS over HTTP (DoH) in DNS Gateways
Workflow Automation now supports custom email domains for incident notifications.
Adds the ability to configure custom email domains in the Data Protection integration, allowing Workflow Automation to use them as the sender for email notifications.
Enables admins to set up custom email domains via the Custom Email Domain page in the Zscaler Automation UI.
Client Connector 4.5 adds ZPA VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. for Legacy Apps, new trusted network conditions, and UI auth options.
Adds support for VPN (for Legacy Apps) to provide secure access for call centers or server-to-client applications using Network Connectors and VPN Service Edges
Adds the following trusted network conditions in the Zscaler Client Connector Portal: Network Range, Default Gateway IP Addresses, and DHCP Server
Adds the Authenticate option to the taskbar menu, allowing users to authenticate Zscaler Client Connector without opening the app
ZIA adds Atlassian Label for Data at Rest DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. and new file types to File Type Control
Adds Atlassian Label option in the Add DLP Rule window (Policy > Data at Rest Scanning) to apply labels during Data at Rest scanning for Atlassian Confluence users.
Expands File Type Control and DLP policies with support for Microsoft Outlook Mac Data (.olm), Publisher (.pub), TNEF (.tnef), LZH/CPIO archives, Binhex (.hqx), QuarkXPress (.qxd/.qxp), AutoCAD (.dxf/.dwg), and Domino Server Database (.dxl) file types.
ZIA Advanced SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. posture controls report now exports Description, Tenant Name, Platform, and Severity columns in CSV.
ZIA adds Gmail outbound email DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., ShareFile/Slack/Zoom SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. support, extensive Cloud Service API endpoints, and advanced DLP/Sandbox capabilities.
Adds SSPM Scan checkbox in the onboarding section to enable Advanced SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management for ShareFile tenants
Adds SSPM Scan checkbox in the onboarding section to enable Advanced SaaS Security Posture Management for Slack tenants
Adds SSPM Scan checkbox in the onboarding section to enable Advanced SaaS Security Posture Management for Zoom tenants
Adds Gmail as a selectable tenant option under Administration > Email Tenants for Outbound Email Data Loss Prevention policies
Supports new predefined DLP dictionaries: Addresses (Japan), First Names (Japan), Last Names (Japan), Full Names (Japan), and US Driver's Licenses with 2-letter state codes
+9 moreshow less
Adds support for .xla, .odt, .pub, and .bin file types in File Type Control & DLP policies
Increases the limit for custom bandwidth classes to 245 via Administration > Bandwidth Classes
Increases custom domains allowed per domain profile from 32 to 1,024
Adds a new Trace ID value to Audit Logs and the traceId field in the AuditLogEntryRequest model for the /auditlogEntryReport endpoint via Zscaler OneAPI
Supports customized URL paths for DNS servers using DNS over HTTP (DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring.) in DNS Gateways
Adds pagination parameters pageSize and page to the GET /pacFiles Cloud Service API endpoint
Adds new Cloud Service API endpoints for programmatic management of Malware Protection, Advanced Threat Protection, File Type Control, Sandbox Policy, URL Filtering, DNS Control, IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, Cloud Applications, Proxy Gateways, Authentication Settings, and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection
Adds Instance Discovery Report page under Analytics with drill-down to Resource Discovery Report logs
Adds columns for App Instance Levels (1-3) and their Types to Web Insights Logs under Analytics > Insights > Web Insights
ZPA updates system metrics for invalid listen IP configurations and releases new RPM packages for RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence..
App Connector 24.692.8 adds support for AppProtection OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. predefined control exceptions
Releases updated App Connector RPM packages for Red Hat Enterprise Linux 7.x, 8.x, and 9.x
Zscaler DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Compliance dashboard, DynamoDB custom policies, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. logging posture, Azure PostgreSQL scanning, and local MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone..
Adds Compliance dashboard to view breaches against CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline., NIST, PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers., HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against., GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., DPDP, CCPA, RBI, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, and SOC2 benchmarks with remediation steps
Adds support for deploying Orchestrator and Scanner instances in a custom network during Cloud Accounts onboarding
Adds Azure Diagnostic Logs Storage config option to specify an existing or new Azure storage account for diagnostic logs
Adds entitlements for AWS DynamoDB, allowing custom policies and investigation queries that reference DynamoDB permissions
Adds Logging security posture state predicate for AWS EC2 instances in policy and investigation queries
+3 moreshow less
Adds MFA for local users, sending a 10-minute valid verification code to the registered email address upon login ID entry
Adds scan settings option for Azure-Managed PostgreSQL Flexible Server
Adds Data Sampling Scan and Full Scan options to database scanning configuration
ZIA expands DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. and sandbox support for new file types and ML-based dictionaries.
Adds ID Card, Medical Imaging, Satellite Data, and Schematic Data as new predefined ML-based DLP dictionaries.
Extends File Type Control and DLP policies to detect .olm, .pub, .tnef, .lzh, .lha, .cpio, .hqx, .qxd, .qxp, .dxf, .dwg, and .dxl file types.
DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Compliance Dashboard, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for local users, and new DynamoDB/PostgreSQL capabilities
Adds a Compliance dashboard to visualize breaches against regulations like CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline., NIST, PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers., HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against., GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., DPDP, CCPA, RBI, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, and SOC2.
Enables MFA for local users by sending a 10-minute verification code to their registered email address upon login.
Adds support for custom policies and investigation queries using entitlements predicates for AWS DynamoDB tables.
Adds the Logging security posture state and corresponding predicate for querying AWS EC2 instance logging status.
Adds scanning support for Azure-Managed PostgreSQL Flexible Server with dedicated predefined policies.
+1 moreshow less
Introduces new database scan options: Data Sampling Scan and Full Scan to control scan scope and cost.
Zero Trust Branch 7.8 adds Zero Touch Provisioning, ZIA over GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation., Site-to-Site WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer., and default custom templates.
Adds Zero Touch Provisioning via single URL click for remote/branch onboarding
Adds default and custom Device Segmentation templates for ZT800 and VM form factors
Adds ZIA connectivity over GRE with policy-based routing configuration
Adds source-based traffic selection using user, port, IP, network, MAC, or device attributes
Adds Site-to-Site VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. support via WireGuard connections between isolated networks
+1 moreshow less
Adds dedicated high-availability link for faster failover times
ZIA adds OCROCROptical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. for DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. on image files, new Device Control policy rules, Inventory views, and Timeline analytics
Adds Optical Character Recognition (OCR) scanning of PNG, JPEG, TIFF, and BMP files to Endpoint DLP for subscriptions with the ZS-DP-CLASS-ADV SKU
Adds Device Control policy rules in the UI for regulating removable storage devices and printers via intercept
Adds Inventory view in Analytics showing visibility into removable storage, printers, and portable device usage with DLP activity analysis
Adds file attribute columns (Last Modification Time, Last Accessed Time, Creation Time) to exported data on the Endpoint Data Scan page
ZIA adds Zoom SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. onboarding, new API endpoints for policies/EUNs, DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring. path support, and Trace ID in audit logs
SSPM Scan checkbox enables Advanced SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management for Zoom tenants during or after onboarding
traceId field added to AuditLogEntryRequest model in the /auditlogEntryReport endpoint and Audit Logs
New API endpoints GET /eun and PUT /eun for retrieving and updating browser-based end user notification configuration
Comprehensive new Cloud Service API endpoints for programmatic management of Malware Protection, ATP, File Type, Sandbox, URL Filtering, DNS Control, IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection policies, cloud apps, proxy gateways, auth settings, remote assistance, NSS feeds, org info, and advanced settings
DNS Gateways support a customized URL path for DNS servers using the DNS over HTTP (DoH) protocol
+2 moreshow less
New URL categories Newly Registered and Observed Domains in the Miscellaneous section of File Type Control and Sandbox Policies
ZPA application segment limit increased to 2,000 segments when configuring Source IP Anchoring in the ZIA Admin Portal
ZPA adds STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against.-compliant RHEL9 images for Azure and bulk Application Segment Import.
Adds Red Hat Enterprise Linux 9 Private Service Edge image with Security Technical Implementation Guide (STIG) support on Microsoft Azure
Adds Application Segment Import feature to upload and merge application data in bulk
ZIA adds Extranet Application Support for partner IPSec access with new API endpoints and UI locations
Adds GET /extranet, POST /extranet, PUT /extranet, GET /extranet/lite, and GET /extranet/{id} API endpoints for managing extranet resources via the Zscaler Cloud Service API
Adds DELETE /extranet/{id} API endpoint to remove configured extranet resources
Adds new attributes extranet, extranetIpPool, extranetDns, defaultExtranetTsPool, and defaultExtranetDns to the Location model for mapping extranet configuration
Adds Extranet as a selectable Location Type in the Admin Portal UI to assign partner resources to locations
Adds Extranet Insights view under Analytics > Extranet Insights to monitor IPSec tunnel health and status
+2 moreshow less
Adds Extranet Name column and filter to Tunnel Insights Logs for filtering log data by extranet
Adds Extranet option in the Tunnel Type filter when configuring NSS or Cloud NSS feeds for Tunnel logs
New Obfuscation settings for phone numbers and SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. email retrieval in Account Settings page
Adds Retrieve User Email from Primary Data Source option to the Incident Management section of the Account Settings page to fetch user emails from SCIM or CSV attributes for incidents.
Adds phone number obfuscation setting on the Account Settings page that affects admin visibility on Incidents, Incident Details, and workflow pages, with override capability on the Admin Assignment page.
Sophos ZTNA 2025.02 adds Let's Encrypt certificate generation via Sophos Central and expands to all Sophos Central regions.
└──▷ HOW TO FIND IT
Provision and auto-renew a Let's Encrypt TLS certificate for a ZTNA gateway without managing certificate lifecycle manually.
📍In Sophos Central, navigate to your ZTNA gateway settings, select Get a certificate, and choose Let's Encrypt to generate and automatically renew the certificate.
Adds Let's Encrypt certificate generation for ZTNA gateways via Sophos Central, with automatic management and renewal.
Extends ZTNA support to all Sophos Central regions.
OpenVPN v2.6.13 adds OS version reporting to servers, Windows credential memory protection, and removes systemd password timeouts on Linux.
└──▷ GET THIS VERSION
$ git clone --branch v2.6.13 https://github.com/OpenVPN/openvpn.git
# already have the repo? check out this version:$ git checkout v2.6.13
Sends the client OS release string via IV_PLAT_VER to the server on non-Windows platforms (macOS, Linux, Unix), enabling server-side tracking of client OS versions.
Protects cached usernames, passwords, and tokens in Windows client memory using the CryptProtectMemory() Windows API.
Passes --timeout=0 to systemd-ask-password on Linux, removing the previous 90-second default timeout for console credential prompts.
Uses a new non-exclusive control device API to retrieve the dco-win driver version on Windows.
Headscale v0.24.0 hardens OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. identity with iss/sub claims, adds PKCEPKCEProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier., SSH agent forwarding, and a new dns.extra_records_path option.
└──▷ GET THIS VERSION
$ git clone --branch v0.24.0 https://github.com/juanfont/headscale.git
# already have the repo? check out this version:$ git checkout v0.24.0
└──▷ USE IT
After upgrading, let legacy OIDC users log in automatically while migration runs, then lock it down once all accounts are migrated.
yaml
# In your headscale config.yaml — keep migration on until all users have logged in:
map_legacy_users: true
# Once all users have authenticated, disable legacy matching:
map_legacy_users: false
Serve custom DNS records (e.g. internal service entries) by pointing Headscale to an external records file.
yaml
# In your headscale config.yaml:
dns:
extra_records_path: /etc/headscale/extra_records.json
Automatically syncs OIDC profile fields (email, name, preferred_username, picture) to Headscale user records on every login.
Adds map_legacy_users config option to automatically migrate existing OIDC accounts to the new iss/sub identity model.
Adds PKCE (Proof Key for Code ExchangeProof Key for Code ExchangeProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier.) verifier support for OIDC authentication flows.
Allows nodes to use SSH agent forwarding.
Adds dns.extra_records_path configuration option for supplying additional DNS records.
+3 moreshow less
Supports client certificate verification for DERP connections.
Improves built-in DERP server compatibility with clients connecting over WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output..
CLI user management commands now accept --identifier in addition to --name for referencing users by ID.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!The dns.use_username_in_magic_dns configuration option has been removed; usernames in Magic DNS are no longer possible.
!Tailscale client versions older than 1.56 are no longer supported.
!GET /api/v1/user/{name} and the GetUserRPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. have been removed; use ListUsers with an ID parameter instead.
!RenameUser and DeleteUser now require a user ID instead of a name.
!On OIDC migration, Headscale renames the account's username to preferred_username, which may break ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. or policies that match by username.
!map_legacy_users will default to false in v0.25.0 and the migration mechanism will be removed in v0.26.0; unmigrated users will receive new accounts.
Teleport v17.2.0 adds native GitHub access, per-session MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. via IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., and Toad client support.
└──▷ GET THIS VERSION
$ git clone --branch v17.2.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.2.0
Adds native GitHub access with RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. and audit logging
Enables per-session MFA checks using an external identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.
Adds Oracle Toad GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. client support for database access
Teleport v17.1.5 adds multi-port TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. support to tsh proxy app, user_agent to audit events, and improved Oracle database agent compatibility.
└──▷ GET THIS VERSION
$ git clone --branch v17.1.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.1.5
Adds multi-port TCP application proxy support via the --remote-ports flag in tsh proxy app
Includes the user_agent field in db.session.start audit events for database session auditing
Drata adds full support for the ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 42001 compliance framework.
Custom fields now display in the Asset Drawer even when data is blank.
Custom fields are now visible upon opening the Asset Drawer, displaying a dash for empty values to ensure consistency across objects like assets, controls, vendors, and risks.
Adds Govern function grouping to UCF controls aligned with NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0
Scrut adds Dashlane and KiteCyber MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. integrations; GCP proof generation in Scrut Monitor.
Adds Dashlane support for password manager detection
Adds GCP support in Scrut Monitor for automated proof generation
CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. framework mapping updated to v8.1 with reduced controls and policies.
New Sensitivity Flag column on Documents table, streamlined control mapping via UI button, and ability to transition flagged evidence back to ready status.
Adds a new Sensitivity Flag column in the documents table to indicate if a document is sensitive
Adds an Add Controls button directly on the Policy details page for streamlined control mapping
Enables users to transition flagged evidence back into ready for audit status
3 details in Everything
1 more release in this issue
· 2025-01-20 → 2025-02-03
Vanta adds auditor evidence filtering and view-only RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. permissions
Adds auditor-created evidence filter to the evidence list for users
Enables view-only permission option in custom role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. roles
Displays risk ID when mapping risk scenarios to a control
Panorays Q4'24 adds SIG 2025 mapping, inherent risk question selection, centralized task management, and live dashboard supplier breakdowns.
Configure panoramic surveys with the new SIG 2025 model mapped to DORA and NIS2NIS2EU directive that expands mandatory cybersecurity requirements to more sectors and member states than its predecessor, giving cyber tools a compliance framework to map controls and reporting obligations against. regulations for third-party evaluations
Select specific questions within Panorays’ questionnaires to define which items are included in the business impact assessment (Inherent Risk Questions)
Track and manage all tasks assigned to suppliers and internal teams from one centralized Task Management location
Drill down into Live Dashboard widgets to see detailed supplier breakdowns for report types and monitor critical findings
View user login activities in a new security events category within the Activity Center audit trail page
Adds BSI elementary threats library, risk scenario filtering, and extra environment variables for CISO Assistant v2.1.2
└──▷ GET THIS VERSION
$ git clone --branch v2.1.2 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.1.2
feat: expose extra env variables enables flexible infrastructure tuning via new environment variables.
feat: add a filter on current and residual risk levels on risk scenarios allows filtering risk scenarios by risk level.
feat(lib): add library for BSI elementary threats (german and english) adds support for the BSI elementary threats framework in both German and English.
3 details in Everything
7 more releases in this issue
· 2025-01-11 → 2025-01-29
Adds task runner with huey and new settings for mail notifications
└──▷ GET THIS VERSION
$ git clone --branch v2.1.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.1.0
Adds task_runner with huey for asynchronous tasks management requiring a new container
Adds extra settings to enable mail notifications and matrix aggregation
$ git clone --branch v2.0.12 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.0.12
feat(lib): mitre d3fend integration available
Parametric ebios radar support added via feat: parametric ebios radar
Automatic loading of required libraries during domain import enabled by feat: allow automatic loading of required libraries when performing a domain import
CISO Assistant v2.0.10 adds CSV export for assets and Helm chart support
└──▷ GET THIS VERSION
$ git clone --branch v2.0.10 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.0.10
Adds a new production-ready Helm chart for Kubernetes deployment via pull #1224
Adds CSV export capability for assets to pull #1392
Adds warning for credentials when importing a backup in pull #1387
Adds cyclic check on parent_folder to prevent circular references in pull #1388
Adds ability to filter loaded libraries by updatable status and displays their count in pull #1396
CISO Assistant v2.0.9 adds is_third_party column to user list and maturity scoring/translations to Word export.
└──▷ GET THIS VERSION
$ git clone --branch v2.0.9 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.0.9
└──▷ HOW TO FIND IT
Quickly filter or identify external partners/vendors within the user management interface.
📍Navigate to User Management in the UI; the new is_third_party column indicates vendor status.
Generate an assessment report with maturity levels and proper language handling.
📍In Export settings, select Word format; the output now includes maturity scores and respects i18n/fallback rules.
Adds is_third_party column in user list to distinguish third-party vendors from internal users
Adds maturity scoring to the Word export, including support for managed internationalization (i18n) with English fallback
Adds domain export/import, documentation maturity assessments, and a guided tour UI flow
└──▷ GET THIS VERSION
$ git clone --branch v2.0.8 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.0.8
Adds feat: export/import domain to move full domains with objects in pro version
Adds support for documentation maturity assessment in audit configuration
Adds a new guided tour feature accessible from the more button near the user email
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The Business Value field is removed from Assets; information is now only available in the detail view.
CISO Assistant v2.0.7 adds SOC2SOC2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. 2022 library support, a new documentation score metric, and fixes lang choice persistence
└──▷ GET THIS VERSION
$ git clone --branch v2.0.7 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.0.7
Adds soc2 rev 2022 as a separate library for compliance assessments
Introduces a new documentation score metric for control evaluation coverage
CISO Assistant v2.0.6 adds score column to table mode, library publication dates, and question-only requirements
└──▷ GET THIS VERSION
$ git clone --branch v2.0.6 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.0.6
└──▷ HOW TO FIND IT
View risk scores directly in the assessment table instead of hovering for details.
📍In the Console, navigate to Assessments › [Your Assessment] and switch view mode to Table to see the new Score column.
Check when a specific compliance library was officially published.
📍In the Console, go to Libraries and select a framework; the publication date is now displayed in the library details header.
Create requirements that are just yes/no questions without needing control mappings.
📍In the Console, go to Requirements › New Requirement and define it as a question-only type during creation.
Adds score column to assessments rendered in table mode
Displays the date of publication for a library in the UI
Supports requirements that consist solely of questions (no mapping needed)
Portkey Enterprise Gateway 1.10.4 adds PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. Redaction Guardrails, Replicate proxy support, and request-level metadata logging.
Adds PII Redaction Guardrails through Portkey Managed, AWS Bedrock, Pangea, Patronus, and Promptfoo providers with a transformed flag in the guardrail result object
Adds Replicate provider support for proxy (passthrough) requests
Logs workspace metadata at the individual request level
3 details in Everything
3 more releases in this issue
· 2025-01-03 → 2025-01-29
Extended unified finetuning APIs to support the AzureOpenAI provider
Added AWS Bedrock Guardrails support for request/response checks
Allowed configuring custom host and custom headers directly in virtual keys for custom models/providers
Renamed Prometheus label llm_request_duration_seconds to llm_request_duration_milliseconds and added new metric portkey_request_duration_milliseconds
Supported Milvus DB as a passthrough provider
+2 moreshow less
Added logprobs and top_logprobs support for VertexAI and Google providers compatible with OpenAI format
Added support for experimental Gemini Thinking Models in VertexAI/Google provider
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The Prometheus label llm_request_duration_seconds is renamed to llm_request_duration_milliseconds, which may break dashboards or alerts relying on the old label name.
Garak scans language models and applications for vulnerabilities including prompt injection and data leakage.
Adds configuration-based REST proxy and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. suppression, startswith StringDetector matching, and a StringDetector.case_sensitive fix
└──▷ GET THIS VERSION
$ git clone --branch v0.10.2 https://github.com/NVIDIA/garak.git
# already have the repo? check out this version:$ git checkout v0.10.2
Adds configuration-based REST proxy support via config settings for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. probing
Adds configuration-based REST SSL suppression setting in the tool's configuration file
Adds startswith matching mode to StringDetector base class for string comparison
gh pr view and gh pr status now respect branch.<branchName>.pushremote, remote.pushDefault configs and the @{push} revision syntax to work in triangular workflows.
gh secret list, gh secret set, and gh secret delete now require explicit repository selection via -R, --repo when multiple git remotes are present.
Extension update notices can be disabled globally by setting the GH_NO_EXTENSION_UPDATE_NOTIFIER environment variable.
Windows MSI installers now support the arm64 architecture, enabled via new build targets.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!gh secret list, gh secret set, and gh secret delete will fail with an ambiguity error if multiple remotes are configured and -R, --repo is not explicitly provided.
1 more release in this issue
· 2025-01-06 → 2025-01-30
Adds gh repo edit security_and_analysis flag and gh run list pending status support in v2.65.0
└──▷ GET THIS VERSION
$ git clone --branch v2.65.0 https://github.com/cli/cli.git
# already have the repo? check out this version:$ git checkout v2.65.0
└──▷ TRY IT
Enable secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. and code security analysis on an existing repository via CLI.
New Web viewer plugin, Hide my changes sync option, new commands for footnotes and attachments
Web viewer, a new core plugin, lets you open external links within Obsidian. This makes it easier to read linked content without leaving the app and improves multitasking for web research. The plugin is disabled by default and must be enabled manually in settings.
Sync now has a new view option, “Hide my changes,” which hides your own file changes in a shared Obsidian sync vault.
Added the Download attachments for current file command, which downloads all externally embedded images and replaces the external links with internal embeds.
Added the Insert footnote command. Footnote autocomplete now provides a fallback to create a new footnote if no match is found.
Obsidian Publish now includes a new command, “Open in live site,” to open the current live version of a note.
SysReptor 2025.12 adds find-and-replace in markdown, improved sharing, and per-user profile colors.
└──▷ GET THIS VERSION
$ git clone --branch 2025.12 https://github.com/Syslifters/sysreptor.git
# already have the repo? check out this version:$ git checkout 2025.12
Adds find-and-replace functionality across markdown fields in reports and notes.
Enables searching within findings and sections.
Supports configuring individual user profile colors.
Adds option to disable archiving for specific project members.
Renders markdown preview in a web worker for improved editor responsiveness.
+5 moreshow less
OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.: uses preferred_username as login_hint during re-authentication.
Accepts username from environment variable in the createorupdateuser command.
Improves project design selection by ordering choices by usage count.
Shows tooltips on list action buttons when permissions are missing.
No longer automatically logs users in via OIDC (or other SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.) immediately after logout.
10 details in Everything
1 more release in this issue
· 2025-01-14 → 2025-01-27
Helm v3.17.0 adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. digest installs, --take-ownership flag, toYamlPretty, richer metadata output, and credential support for push/dependency commands.
└──▷ GET THIS VERSION
$ git clone --branch v3.17.0 https://github.com/helm/helm.git
# already have the repo? check out this version:$ git checkout v3.17.0
└──▷ TRY IT
Take ownership of existing cluster resources (e.g. pre-created by Terraform) without errors during install.
Ghostty 1.1 adds performable keybindings, SSD support on Linux, new split/divider configs, and macOS alpha blending controls
└──▷ USE IT
Prevent ctrl+c from interrupting the shell if there is no text to copy
text
keybind = performable:ctrl+c=copy_to_clipboard
Force server-side decorations on Linux for a more native look on KDE/GNOME
env
window-decoration = auto
Configure macOS alpha blending to use the new linear-corrected mode for better text appearance
env
alpha-blending = linear-corrected
keybind now supports the performable: prefix to only consume input if an action has a meaningful perform state (e.g., copy)
The window-decoration configuration option accepts new values auto, server, and none alongside client to control Server-Side Decorations (SSD) on Linux Wayland
New keybinding actions: copy_url_to_clipboard to copy URLs under the cursor, and close_tab to close a tab and its splits
The alpha-blending configuration option is added on macOS with values native, linear, and linear-corrected to control color blending behavior
The quick-terminal-space-behavior configuration option controls whether the quick terminal follows or remains on a macOS space when switched
Workers now supports Node.js DNS, Net, and Timer APIs when nodejs_compat flag is enabled
Adds node:net API support (including net.Socket, net.BlockList, net.SocketAddress) for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections in Workers with nodejs_compat compatibility flag.
Adds node:dns API support for DNS resolution via Cloudflare DNS at 1.1.1.1 in Workers with nodejs_compat compatibility flag.
Adds node:timers API support (setTimeout, setInterval, setImmediate) for scheduling functions in Workers with nodejs_compat compatibility flag.
WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. release 2025-01-21 updates managed rules to block Command Injection and Web Shell Activity
Cloudflare Managed Ruleset rule 100303 (Command Injection - Nslookup) now blocks requests that were previously only logged.
Cloudflare Managed Ruleset rule 100534 (Web Shell Activity) now blocks requests that were previously only logged.
This release introduces new telemetry capabilities by enabling SSH command log export for Access for Infrastructure through the existing Logpush integration.
Adds the ability to send SSH command logs from Access for Infrastructure to Logpush destinations
Smart Tiered Cache now automatically selects the optimal Upper Tier data center for all origins in a Load Balancing Pool to improve cache hit rates and reduce origin load.
THE CYBER TOOLCHAIN