The Cyber Toolchain — issue -022, September 30, 2024
THE CYBER TOOLCHAIN
NO. -022
Tail
THE DAILY RELEASE FIREHOSE
PUBLISHED SEPTEMBER 30, 2024 · EVERY DAY
EDITIONStail|grep|head|ls|diff|uniq
The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
Impacket 0.12.0 adds 5 new example scripts, Sapphire tickets, KerberoastingKerberoastingAn attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access. via AS-REQ, S4U2self abuse flags, GKDI protocol support, and more.
└──▷ GET THIS VERSION
$ git clone --branch impacket_0_12_0 https://github.com/SecureAuthCorp/impacket.git
# already have the repo? check out this version:$ git checkout impacket_0_12_0
└──▷ TRY IT
Abuse S4U2self and service substitution to impersonate a user and obtain a ticket for an alternate service.
New describeTicket.py script for KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ticket description and decryption.
New GetADComputers.py script to query a DC via LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. for computer objects and attributes including DNS name and OS version.
New GetLAPSPassword.py script to extract LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet. passwords from LDAP.
New dacledit.py script to read, write, remove, backup, and restore ACEs in an object's DACL.
New owneredit.py script to abuse WriteOwner (ADS_RIGHT_WRITE_OWNER) access rights and edit an object's DACL.
+24 moreshow less
Adds [MS-GKDI] Group Key Distribution Protocol implementation to the library.
ticketer.py supports creating Sapphire tickets.
GetUserSPNs.py and getTGT.py support Kerberoasting without pre-authentication and ST requests through AS-REQ.
getST.py adds -self, -altservice, and -u2u flags for S4U2self abuse, S4U2self+u2u, and service substitution.
getST.py adds ability to set the RENEW ticket option to renew a TGT.
secretsdump.py doubles DC Sync performance for DCs supporting SID lookups.
secretsdump.py adds ability to skip dumping SAM or SECURITY hives during remote operations.
secretsdump.py adds ability to specify users to skip when dumping NTDS.
ntlmrelayx.py adds creation of new machine accounts through SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments..
ntlmrelayx.py adds --keep-relaying flag for multirelay target handling.
ntlmrelayx.py improves ability to continue relaying to ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. web enrollment endpoint to request multiple certificates for different users.
ntlmrelayx.py writes certificates to file instead of outputting base64 to console.
reg.py supports adding Binary and REG_MULTI_SZ values, and can start the remote registry as an unprivileged user.
smbclient.py adds ability to write commands and output to a specified output file.
smbserver.py adds -outputfile parameter to set the log file.
DumpNTLMInfo.py supports execution on non-default ports.
findDelegation.py adds a new column showing whether an SPN exists.
mssqlclient.py adds -target-ip parameter to allow Kerberos authentication without DNS configuration changes.
ldap_shell.py adds support for dirsync and whoami commands.
lookupsid.py now supports Kerberos authentication.
samrdump.py fetches AdminComment via MSRPC.
tstool.py adds support for Kerberos authentication and SID resolution.
getTGT.py adds principalType as a new parameter.
SMB Server adds query information level 0x0109 (SMB_QUERY_FILE_STREAM_INFO) for SMB1.
29 details in Everything
1 more release in this issue
· 2024-09-01 → 2024-09-16
Impacket 0.12.0 adds DACL/ownership abuse scripts, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory.LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet. extraction, Sapphire ticket support, and KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. improvements across many tools
└──▷ GET THIS VERSION
$ git clone --branch 0.12.0 https://github.com/fortra/impacket.git
# already have the repo? check out this version:$ git checkout 0.12.0
└──▷ USE IT
Generate a Sapphire ticket for testing Kerberos infrastructure resilience.
shell
python ticketer.py -sapphire <username> <domain>
Extract LAPS passwords from an LDAP directory for auditing workstations.
Adds [MS-GKDI] Group Key Distribution Protocol implementation in the library
Adds -outputfile parameter to smbclient.py to write commands and output to a file
Adds -outputfile parameter to smbserver.py to set the log file path
Adds --self, --altservice, and --u2u flags to getST.py for S4U2self abuse, S4U2self+u2u, and service substitution
Adds ability to skip dumping SAM or SECURITY hives in secretsdump.py via a new skip option
+22 moreshow less
Adds ability to specify users to skip when dumping NTDS in secretsdump.py
Adds support to create Sapphire tickets in ticketer.py
Adds KerberoastingKerberoastingAn attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access. without pre-authentication and ST request through AS-REQ support in GetUserSPNs.py and getTGT.py
Adds principalType parameter to getTGT.py
Adds new machine account creation through SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. in ntlmrelayx.py
Adds --keep-relaying flag to ntlmrelayx.py for multirelay status
Adds configuration of SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. address and port in ntlmrelayx.py via a new option
Adds Write certificates to file functionality in ntlmrelayx.py
Adds improved ability to continue relaying to ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. web enrollment endpoint in ntlmrelayx.py
Adds domain and username to interactive Ldap shell message in ntlmrelayx.py
Enhanced MSSQLShell in NTLMRelayX leveraging TcpShell & output messages
Allows adding Binary values in reg.py
Allows adding REG_MULTI_SZ values in reg.py
Adds -target-ip parameter to mssqlclient.py for Kerberos authentication
Adds support for dirsync and whoami commands in ldap_shell.py
Now supports kerberos auth in lookupsid.py
Added support for kerberos auth and resolves SIDs in tstool.py
New script describeTicket.py for ticket description and decryption
New script GetADComputers.py to query DC via LDAP for COMPUTER objects
New script GetLAPSPassword.py to extract LAPS passwords from LDAP
New script dacledit.py to read, write, remove, backup, restore ACEs in object DACL
New script owneredit.py to abuse WriteOwner access rights to take ownership
BloodHound v6.0.0 adds Citrix RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. analysis, expanded ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. abuse info, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. feature flag, dark mode on by default, and prune TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. support.
└──▷ GET THIS VERSION
$ git clone --branch v6.0.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v6.0.0
Adds Citrix CanRDP post-processing and a Citrix RDP Configuration UI for analyzing Citrix-based remote access paths.
Adds abuse info for generic ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. edges against ADCS nodes, improving ADCS attack-path guidance.
Expands ESC9b and ESC10b abuse info with improved detail for certificate-based attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..
Adds more general abuse info entries for additional edge types.
Introduces SchannelAuthenticationEnabled property support, enabling detection of Schannel-based authentication configurations.
+6 moreshow less
Adds support for prune TTLs and moves the reconciliation feature flag to parameters, enabling data lifecycle management.
Adds preMigrationDaemons support for running pre-migration tasks during startup.
Introduces a feature flag for the OIDC initiative, laying groundwork for OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication.
Enables dark mode by default and removes the dark mode feature flag toggle.
Grants SavedQueriesRead permission to the ReadOnly role, allowing read-only users to access saved queries.
Normalizes files to UTF-8 when extracting ZIP files during ingest, broadening compatibility with non-ASCII data sources.
11 details in Everything
1 more release in this issue
· 2024-09-10 → 2024-09-30
Detects Write gPLink abuse as a new attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. edge.
Introduces the LoginURL Azure AD property for app objects.
Collects additional Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. properties for richer node data.
+5 moreshow less
Removes CanAbuse edges, replacing them with more specific relationships.
Adds a saved-query update endpoint (PUT/PATCH for existing saved queries).
Adds a saved-query share endpoint to share queries with other users.
Adds a saved-query unshare endpoint to revoke sharing.
Adds a ~eq case-insensitive string equality predicate for API filtering.
Feature-rich, stable and customizable Flipper Zero firmware.
Momentum Firmware mntm-007 adds Laser Tag game, Saflok NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. parser, and T5577 macro publishing API
└──▷ GET THIS VERSION
$ git clone --branch mntm-007 https://github.com/Next-Flip/Momentum-Firmware.git
# already have the repo? check out this version:$ git checkout mntm-007
Adds a new Saflok parser for NFC tag emulation.
Publishes a T5577 page 1 block count macro via the API.
Adds a Procrastination dolphin animation on desktop OFW.
Updates Picopass to emulate with a dummy MAC when keys are unknown (CVE-2024-41566 mitigation).
A portable multi-tool for pentesters and geeks; this is its official firmware.
Flipper Zero 1.0.1 adds Procrastination animation, Happy mode config, Extract MF KeysNFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. feature, and 5V GPIOGPIOGeneral-Purpose Input/Output pins on a microcontroller or SoC that firmware can individually control as digital signals, letting cyber tools interact directly with hardware interfaces like UART, JTAG, or SPI. control for extensions.
└──▷ GET THIS VERSION
$ git clone --branch 1.0.1 https://github.com/flipperdevices/flipperzero-firmware.git
# already have the repo? check out this version:$ git checkout 1.0.1
Adds the new Procrastination dolphin animation
Adds configurable always happy mode to dolphin settings
Renames the NFC sub-menu option from Detect Reader to Extract MF Keys
Adds new Linux BadUSB example resource files
Enables external modules to enable 5V throw RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. or Extension protocol via 5V on GPIO control
Flipper Zero Unleashed Firmware, an unlocked alternative firmware.
Unleashed Firmware unlshd-078 adds Marantec24, GangQi, and Hollarm SubGHz protocols
└──▷ GET THIS VERSION
$ git clone --branch unlshd-078 https://github.com/DarkFlippers/unleashed-firmware.git
# already have the repo? check out this version:$ git checkout unlshd-078
SubGhz: Add support for Marantec24 (static 24 bit), GangQi (static 34 bit), and Hollarm (static 42 bit) protocols with button parsing
SubGhz: Add support for Hay21 (dynamic 21 bit) protocol with button parsing
NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions.: Add Saflok parser improvements
Infrared: Add Airwell AW-HKD012-N91 to universal AC remote library
GreatFET One v2024.0.2 adds Windows support for Cynthion.
└──▷ GET THIS VERSION
$ git clone --branch v2024.0.2 https://github.com/greatscottgadgets/greatfet.git
# already have the repo? check out this version:$ git checkout v2024.0.2
The firmware for the HackRF+PortaPack H1/H2/H4/H4M.
Mayhem v2.0.2 adds TPMS external app support, USB serial setfreq command, and theme system.
└──▷ GET THIS VERSION
$ git clone --branch v2.0.2 https://github.com/portapack-mayhem/mayhem-firmware.git
# already have the repo? check out this version:$ git checkout v2.0.2
└──▷ USE IT
Flash the firmware and ensure external apps are on the SD card.
Villain v2.2.0 adds redirectors support, renames exec to inject, and introduces --version flag with improved shell templates.
└──▷ GET THIS VERSION
$ git clone --branch v2.2.0 https://github.com/t3l3machus/Villain.git
# already have the repo? check out this version:$ git checkout v2.2.0
└──▷ TRY IT
Check which version of Villain you are running after upgrading.
$ python3 villain.py --version
Adds redirectors feature and prompt command for managing traffic redirection in sessions.
Renames exec pseudo shell command to inject, now a dedicated command for fileless script execution in active sessions.
New reverse shell notifications now include the session ID for easier session tracking.
Adds --version (-v) argument to display the current Villain version.
Improved Windows/hoaxshell payload templates.
+1 moreshow less
Reverse TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. handler (formerly referenced as netcat, now reverse_tcp) rebuilt for significantly greater performance and stability.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The exec pseudo shell command has been renamed to inject; any scripts or workflows invoking exec for fileless execution will break.
!References to netcat have been renamed to reverse_tcp in the project; configurations or scripts referencing the netcat handler name will need to be updated.
airgeddon v11.31 adds Evil Twin client-tracking features and faster PMKIDPMKIDA 128-bit identifier derived from a PMK, the access point MAC, and the client MAC in WPA2 handshakes, allowing offline cracking of Wi-Fi passwords without capturing a full four-way handshake. capture
└──▷ GET THIS VERSION
$ git clone --branch v11.31 https://github.com/v1s1t0r1sh3r3/airgeddon.git
# already have the repo? check out this version:$ git checkout v11.31
Adds real-time visibility during Evil Twin captive portal attacks showing whether the client accessed the portal
Adds real-time detection during Evil Twin attacks showing whether the client is still present on the network
Improves PMKID capture performance with faster command execution and a reduced default timeout
ldeep 1.0.64 adds ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. certificate template enumeration for AD CS attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. discovery.
└──▷ GET THIS VERSION
$ git clone --branch 1.0.64 https://github.com/franc-pentest/ldeep.git
# already have the repo? check out this version:$ git checkout 1.0.64
1 more release in this issue
· 2024-09-07 → 2024-09-18
ldeep 1.0.62 adds --no-encryption option for unencrypted LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. connections
└──▷ GET THIS VERSION
$ git clone --branch 1.0.62 https://github.com/franc-pentest/ldeep.git
# already have the repo? check out this version:$ git checkout 1.0.62
└──▷ TRY IT
Query an LDAP server that doesn't support TLS or STARTTLSSTARTTLSA protocol command that upgrades a plaintext connection to an encrypted TLS session without changing ports, used in SMTP, IMAP, and LDAP so tools can negotiate encryption opportunistically on standard service ports., such as a legacy DC in a lab environment
gowitness 3.0.3 adds screenshot delay to the /submit API endpoints and a new immediate-mode probe UI.
└──▷ GET THIS VERSION
$ git clone --branch 3.0.3 https://github.com/sensepost/gowitness.git
# already have the repo? check out this version:$ git checkout 3.0.3
└──▷ HOW TO FIND IT
Use immediate mode in the web UI to probe a URL on the fly and see results in a modal without polluting the database.
📍Open the gowitness web UI, navigate to the Probe section, enter a target URL, and select Immediate Mode to view the screenshot result in a modal without recording to the database.
Adds delay parameter to the /submit and /submit/single API endpoints, enabling a configurable pause before screenshot capture via the API.
New web UI for immediate-mode probing that shows screenshot results in a modal without writing to the database.
2 details in Everything
3 more releases in this issue
· 2024-09-17 → 2024-09-22
gowitness 3.0.1 adds a synchronous /submit/single API endpoint for immediate screenshot results and Swagger UI link.
└──▷ GET THIS VERSION
$ git clone --branch 3.0.1 https://github.com/sensepost/gowitness.git
# already have the repo? check out this version:$ git checkout 3.0.1
└──▷ TRY IT
Capture a screenshot of a single URL and get the result back immediately in one API call — no writer pipeline needed, useful for scripting or CI checks.
gowitness v3 overhauls CLI, adds rod driver, multi-writer output, official Swagger API, and React report UI.
└──▷ GET THIS VERSION
$ git clone --branch 3.0.0 https://github.com/sensepost/gowitness.git
# already have the repo? check out this version:$ git checkout 3.0.0
└──▷ USE IT
Embed gowitness scanning into your own Go tool using the library's runner/reader/writer pattern.
go
runner, _ := runner.NewRunner(...opts)
reader := readers.NewFileReader(...fileopts)
go func() {
if err := reader.Read(runner.Targets); err != nil {
log.Error("error in reader.Read", "err", err)
}
}()
runner.Run()
runner.Close()
Adds hierarchical subcommand CLI structure with proper flag inheritance across all scan commands.
Introduces pluggable scanner drivers: chromedp (default, higher accuracy via fresh browser per target) and gorod (tab-based, faster/lower resource usage), selectable with --driver.
Replaces preflight HTTP checks with CDPCDPCisco Discovery Protocol, a Cisco-proprietary Layer 2 protocol that advertises device identity, capabilities, and topology between directly connected Cisco gear, giving cyber tools a passive way to map network infrastructure.Network.responseReceived events for significantly more accurate probe results.
Introduces writers concept enabling simultaneous output to SQLite, JSON Lines, and stdout in a single scan run.
Introduces readers concept supporting pluggable input sources (files, CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges, Nmap, Nessus, and more).
+5 moreshow less
Rewrites the report web server frontend in React with more features and a modernised UI.
Adds an official REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. with code-generated Swagger documentation.
Switches to a pure-Go SQLite implementation, eliminating the CGO_ENABLED=1 build requirement for easier cross-compilation.
Exposes gowitness as a proper importable Go library with stable drivers, readers, writers, and runner packages.
Updates perception hashing to use Hamming Distance for screenshot grouping.
Nettacker 0.4.0 adds dir_scan and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS modules, Scan Compare feature, -d shortcut, and ScanID support
└──▷ GET THIS VERSION
$ git clone --branch 0.4.0 https://github.com/OWASP/Nettacker.git
# already have the repo? check out this version:$ git checkout 0.4.0
└──▷ USE IT
Run a scan skipping service discovery using the new shortcut flag to speed up large network sweeps.
Plans closed-beta API endpoints after October 17 and date-only versioning for new beta API versions, preserving existing integrations
After October 17, new experimental endpoints will be replaced by /closed-beta previews for a limited set of users; these are not suitable for integrations or major workloads.
For upcoming new beta API versions, specify the date, such as 2024-08-02, without the ~beta suffix; existing versions and integrations remain unchanged.
2 details in Everything
1 more release in this issue
· 2024-09-05 → 2024-09-17
New Environment and Snyk product filters added to the IDE & CLI usage Report.
Adds an environment filter to the IDE & CLI usage Report for analyzing adoption in specific coding environments (VS Code, IntelliJ, Visual Studio, Eclipse, CLI)
Adds a Snyk product filter to the IDE & CLI usage Report for refining metrics by specific Snyk products
Mend SCA 24.8.2 adds package health insights, npm maintenance status, and optional vulnerability data in SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format.SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. reports
Adds Package Health information on the Recommended Fix tab to guide optimal upgrade paths for vulnerable packages
Adds maintenance status (Deprecated or Maintained) to npm package versions in the UI to help assess upgrade safety
Adds toggle in the Create Report wizard to exclude vulnerability data from Dependencies SBOM reports in SPDX format
Veracode Scan for Visual Studio v0.1.0 adds SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scanning and autopackaging integration for VS 2019/2022.
New REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoint GET /api/v2/summary.json for service status and maintenance schedules
└──▷ BREAKING ON UPGRADE
!The old endpoint https://api.status.veracode.com/status will be retired on October 31, 2024; calls to it will fail after that date.
Veracode Workflow App 0.2.13 adds custom runner, image, and dependency configurations for GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure..
actions:ruby:version config key lets you specify the Ruby version required in your project
actions:ruby:bundle config key allows specifying a specific bundler for gem installation
actions:{scan type}:build:runs_on config key defines the runner for building your project
actions:{scan type}:build:packager_image config key enables using a public docker image for builds
Veracode CLI v2.31.0 adds SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself.SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. scanning and PowerShell proxy config
└──▷ TRY IT
Scan a Software Bill of MaterialsSoftware Bill of MaterialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generated by an SCA agent or previous upload scan.
$ veracode scan --sbom <path_to_sbom.json>
Adds veracode scan capability to process SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. from an SCA agent-based scan or upload scan
Adds proxyUrl parameter to the Veracode CLI installation script for PowerShell to configure proxy servers during installation
Introducing Veracode SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. for Eclipse IDE v1.0.0
Adds Veracode SAST for Eclipse IDE plugin to integrate Static Application Security Testing with the Eclipse IDE
Enables automatic code packaging into supported artifacts for Static Analysis via the new plugin's autopackaging feature
Veracode CLI v2.31.0 adds SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scan scanning and PowerShell install proxy support
veracode package command improves packaging for JavaScript
veracode package command now excludes nested Go modules when packaging Go projects
veracode scan command has improved logging for .NET projects
veracode scan can now scan SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. from an SCA agent-based scan or upload scan
Added the proxyUrl parameter to a CLI installation script for PowerShell
Mend SAST 24.8.2 adds automated remediation suggestions and GitHub remediation flows for Java/JS/C# findings, plus gen 2 JS support for .html/.ejs files.
└──▷ HOW TO FIND IT
View automated fix suggestions for a Java vulnerability directly in the Mend Platform web UI
📍In the Mend Platform UI, navigate to the Code finding details pane to view remediation suggestions
Update a GitHub feature branch with suggested fixes without leaving the browser
📍In the Mend Platform web UI, trigger the end-to-end remediation flow for a finding linked to a GitHub.com or GitHub Enterprise repository
Adds automated remediation suggestions for Code findings in Java, JavaScript/TypeScript, and C# to the Mend Platform web UI
Integrates remediation suggestions into Jira tickets generated for Code findings
Enables end-to-end remediation flow in GitHub.com and GitHub Enterprise repositories to update feature branches with one click
GitLab 17.4 adds Advanced SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., JaCoCo coverage, CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema.SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. support, and new API endpoints for groups/projects members and webhook management.
Introduces Advanced SAST scanning engine powered by Oxeye technology with a new code-flow view for tracing vulnerabilities across files and functions
Adds ability to search projects by multiple compliance frameworks simultaneously in the UI
Adds JaCoCo coverage report visualization for merge requests as a beta feature
Adds detection of Anthropic API keys in both pipeline and client-side Secret Detection
Adds allowed_email_domains_list attribute to the Groups API to restrict group access by domain programmatically
+12 moreshow less
Adds new endpoints to the Groups API and Projects API to retrieve groups invited to a group or project
Adds suffix configuration option to policy.yml for pipeline execution policies to handle job name collisions (on_conflict or never)
Adds Grant access to this repository for projects linked to it as the security policy project source for security policies toggle in Settings > General > Visibility, project features, permissions
Adds new Masked and hidden visibility option for CI/CD variables to permanently mask values in the UI
Adds support for triggering a Flux reconciliation directly from the Kubernetes dashboard using the Flux status badge
Adds optional token expiration enforcement for personal, project, and group access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. via administrator settings
Adds Idempotency-Key header support for webhook requests to allow clients to detect retries
Adds API endpoints to resend failed project and group webhook requests programmatically
Adds an official Code intelligence CI/CD component supporting Go 1.21+, TypeScript, and JavaScript
Adds the ability to trigger auto-merge for merge requests when all required checks pass via the UI
Enables GitLab Duo Code Suggestions to use content from open editor tabs for context-aware recommendations
Adds an extension marketplace in the Web IDE on GitLab.com, enabled via user preferences > Integrations
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. now supports Edge WAF deployments for Rust-based Compute projects
New Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. endpoint to list agent configuration keys for a workspace
Fastly expands its VCLVCLVarnish Configuration Language, a domain-specific language used to configure the Varnish HTTP cache, letting tools control request routing, caching rules, and traffic manipulation with low-latency precision. configuration capabilities by allowing inline comments in Country and IP lists, improving maintainability for service configurations.
Country and IP lists now support the # character to include comments inline with list entries.
Enhanced traversal detection capabilities in Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. agent 4.58.2
JavaScript SDK 3.23.0 adds gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. backend support to Fastly edge functions.
Adds grpc backend option to configure gRPC connectivity.
Go SDK 1.3.3 adds ErrTooManyRequests, ServerAddr/RemoteAddr fields, pluggable URL parser, backend keepalive/pooling/cert/grpc configs, and GetVCPUMilliseconds.
Adds ErrTooManyRequests error type to the kvstore package for handling rate-limiting events
Adds ServerAddr field to fsthttp.Request and RemoteAddr field to fsthttp.Response
Adds a pluggable URL parser in fsthttp allowing custom URL resolution logic
Adds TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. and HTTP keepalives configuration options for backends in fsthttp
Adds connection pooling configuration for backends in fsthttp
+3 moreshow less
Adds client certificate configuration support for backends in fsthttp
Adds a grpc flag option for backends in fsthttp
Adds GetVCPUMilliseconds function to the compute package
JavaScript SDK 3.22.0 adds vCPU ms hostcall support and exposes purgeSurrogateKey hostcall
Adds vcpu ms hostcall to enable virtual CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. time measurement in JavaScript actions.
Exposes the purgeSurrogateKey hostcall for direct cache invalidation via surrogate keys.
Infisical v0.86.0 adds Azure Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. dynamic secrets, org-level audit logs, and server-side pagination.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.86.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.86.0-postgres
Adds Azure Entra ID as a supported provider for dynamic secrets generation
Moves audit logs to organization-level scope instead of project-level
Enables server-side pagination on Secrets Overview and Main Pages for improved performance
Allows access approvals to be granted via user groups
Configures email notifications when an integration sync fails
5 details in Everything
5 more releases in this issue
· 2024-09-03 → 2024-09-23
Infisical v0.85.0 adds AWS Secrets Manager prefixing and an integration details logging page.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.85.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.85.0-postgres
feat(integrations): aws secrets manager secrets prefixing support
Infisical v0.84.0 adds native Slack integration, certificate key usage configuration, and bulk member invitations.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.84.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.84.0-postgres
native slack integration allows Infisical to send secrets or notifications directly to Slack channels.
Supports configuring certificate key usage and extended key usage for PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. certificates.
Allows inviting multiple members to a project with role assignment in a single action.
Infisical v0.83.0 adds Dynamic Secret support for MongoDB and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. glob pattern matching.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.83.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.83.0-postgres
Adds Dynamic secret/mongodb capability to enable on-the-fly credential generation for MongoDB databases
Supports glob patterns for OIDC authentication, allowing more flexible group/user matching
Adds Elasticsearch visibility support to GitHub integration and Elastic secrets backend
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.82.1-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.82.1-postgres
Adds dynamic-secrets Elasticsearch support for generating dynamic credentials
Adds visibility options (read/write/none) to the GitHub integration for controlling secret propagation scope
Adds password protection for secret shares and MongoDB Atlas dynamic secrets
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.82.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.82.0-postgres
feat: password protect secret share allows sharing secrets with a required password.
Scan a directory (non-git) for secrets using the new dir subcommand.
$ gitleaks dir --source /path/to/project --report-path gitleaks-report.json
Pipe content into gitleaks for secret detection using the new stdin subcommand, e.g. in a CI pre-receive hook.
$ cat secrets.env | gitleaks stdin
Adds new top-level git, dir, and stdin subcommands as the modern replacements for detect and protect.
New detection rule for Kubernetes secrets.
New detection rule for OpenShift user tokens.
New detection rules for Harness Personal Access Tokens (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) and Service Account Tokens (SAT).
Makes config generation utilities public for programmatic use.
+3 moreshow less
Adds poetry.lock, gradle verification-metadata.xml, go.work, and go.work.sum to the global allowlist paths.
Uses the first non-empty capture group when secretGroup is not set, reducing required rule configuration.
Updated rule validation now uses rule ID in config validation errors for clearer feedback.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!The detect and protect subcommands are deprecated in favor of git, dir, and stdin; the change is intended to be backwards compatible but may break existing scripts or tooling.
Socket Python SDK 1.0.9 adds report filtering, API timeouts, and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. dict generation
Adds from_time parameter to report.list() function for unix timestamp filtering
Adds timeout argument to socketdev class constructor for API call duration control
Adds sbom.create_packages_dict() function for generating package dictionaries
GitHub app now creates full-scan resources on push events, accessible via the full_scans API endpoint
Adds the full_scans API endpoint to retrieve a paginated list of full scans for an organization, excluding SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. artifacts
Adds NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. package support and reporting for over 400k .NET packages in Spectra Assure Community.
Apiiro maps an application's architecture and risk graph and runs AI-SAST, SCA, secrets, API and threat-modeling checks on AI- and human-written code.
Apiiro introduces GA for Managed Semgrep to orchestrate SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. across applications with deep context enrichment.
Adds the ability to centrally execute and configure Semgrep analysis for all applications within a single pane of glass.
Enables automatic enrichment of Semgrep findings with Apiiro's deep application context, including code ownership, business impact, and internet exposure.
Supports running Semgrep scans in pull requests via the Apiiro platform's workflow integration.
sbom-tool v2.2.9 restores Conan package support in SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. output.
└──▷ GET THIS VERSION
$ git clone --branch v2.2.9 https://github.com/microsoft/sbom-tool.git
# already have the repo? check out this version:$ git checkout v2.2.9
1 more release in this issue
· 2024-09-10 → 2024-09-18
LavaMoat webpack plugin adds ContextModule support and improved HMR compatibility in v0.6.0-beta.0
└──▷ GET THIS VERSION
$ git clone --branch webpack-v0.6.0-beta.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout webpack-v0.6.0-beta.0
Supports webpack ContextModule by skipping policy enforcement for dynamic require contexts, enabling broader webpack project compatibility.
Handles HMR-instrumented code gracefully even when Hot Module Replacement is not enabled, preventing build errors in non-HMR setups.
Syft v1.13.0 adds a data enrichment flag, Dart support, seven new binary classifiers, and richer JVMJVMThe Java Virtual Machine, a runtime maintained by Oracle (and implemented by others) that executes Java bytecode on any OS, giving cyber tools a portable, garbage-collected environment with a large ecosystem of libraries./JDK cataloging.
└──▷ GET THIS VERSION
$ git clone --branch v1.13.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.13.0
New --enrich flag enables opt-in data enrichment when generating SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
Adds Dart language classifier for detecting Dart binaries.
Adds binary classifiers for lighttpd, proftpd, zstd, xz, gzip, jq, and SQLCipher.
Catalogs JDK installations more completely, including richer metadata for JVM installations.
Stubs unknown package versions instead of dropping packages from the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
+1 moreshow less
Supports scanning bitnami/mysql:8.x images.
6 details in Everything
1 more release in this issue
· 2024-09-11 → 2024-09-24
syft v1.12.2 adds curl, Haskell, OCaml, and HAProxy binary detection to SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. cataloging.
└──▷ GET THIS VERSION
$ git clone --branch v1.12.2 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.12.2
Detects curl binaries as cataloged packages in SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
New Haskell binaries cataloger identifies Haskell ecosystem components.
Adds OCaml ecosystem support for cataloging OCaml packages.
Supports HAProxy dev builds for binary-level SBOM detection.
nuclei v3.3.3 adds Linear issue tracker integration, PDCP dashboard scan upload, and new headless lifecycle events.
└──▷ GET THIS VERSION
$ git clone --branch v3.3.3 https://github.com/projectdiscovery/nuclei.git
# already have the repo? check out this version:$ git checkout v3.3.3
└──▷ TRY IT
Upload a previously saved nuclei JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. results file to the PDCP cloud dashboard for team review without re-running a scan.
$ ./nuclei -pdu nuclei_results.jsonl
Configure the Linear integration in your nuclei config to auto-create issues only for critical findings, skipping low-severity results.
nuclei v3.3.2 adds ActionWaitDialog for headless XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. detection and Jira issue-type/project-id config support.
└──▷ GET THIS VERSION
$ git clone --branch v3.3.2 https://github.com/projectdiscovery/nuclei.git
# already have the repo? check out this version:$ git checkout v3.3.2
Adds ActionWaitDialog action type in the headless protocol to simplify detection of JavaScript dialog-based XSS.
Extends Jira integration config to accept issue-type ID and project ID as optional inputs.
Caido v0.41.0 adds a one-click community plugin store and major backend/frontend SDK expansions including TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. sockets and SQLite.
└──▷ GET THIS VERSION
$ git clone --branch v0.41.0 https://github.com/caido/caido.git
# already have the repo? check out this version:$ git checkout v0.41.0
New community plugin store enables one-click installation of open-source plugins submitted via github.com/caido/store.
New sdk.requests.get() backend API lets plugins retrieve a request by its ID.
New sdk.meta.path() backend API exposes the plugin's file system path.
New sdk.meta.db() backend API provides access to the SQLite database associated with a plugin.
New sdk.findings.get() backend API fetches a finding linked to a specific request.
+5 moreshow less
New Request.getUrl() backend API returns the URL for a given request.
New net module enables plugins to use TCP sockets for external connectivity.
New sqlite module lets plugins create and manage SQLite databases.
New sdk.ui.httpRequestEditor() frontend API provides a read-only HTTP request editor component for plugin UIs.
New sdk.ui.httpResponseEditor() frontend API provides a read-only HTTP response editor component for plugin UIs.
DOMPurify 3.1.7 adds Angular compiler support and expands HTML/SVG attribute allow-lists.
└──▷ GET THIS VERSION
$ git clone --branch 3.1.7 https://github.com/cure53/DOMPurify.git
# already have the repo? check out this version:$ git checkout 3.1.7
Adds improved support for the Angular compiler.
Expands the HTML and SVG attribute allow-lists with several new attributes.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The foreignObject element has been removed from the list of HTML entry-points, which may affect sanitization behavior for configs that relied on it as an entry-point.
Turbinia Helm chart now supports multiple instances and a more generalized ingress configuration.
└──▷ GET THIS VERSION
$ git clone --branch turbinia-1.1.3 https://github.com/google/osdfir-infrastructure.git
# already have the repo? check out this version:$ git checkout turbinia-1.1.3
Supports deploying multiple instances of Turbinia within the same Kubernetes cluster via the updated Helm chart.
Generalizes the Helm chart ingress configuration to support a wider range of ingress setups.
Locks Helm chart image tags to the release version for more reproducible deployments.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The values-production.yaml file has been removed from the Helm chart; any deployments relying on it must migrate their overrides to a custom values file.
3 more releases in this issue
· 2024-09-06 → 2024-09-27
Timesketch Helm chart simplifies ingress for non-GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. setups and supports multiple concurrent instances
└──▷ GET THIS VERSION
$ git clone --branch timesketch-1.0.8 https://github.com/google/osdfir-infrastructure.git
# already have the repo? check out this version:$ git checkout timesketch-1.0.8
Supports running multiple Timesketch instances simultaneously in the same Kubernetes cluster.
Simplifies ingress configuration for non-GKE Kubernetes setups.
Timesketch Helm chart gains support for supplying existing configuration via a Kubernetes ConfigMap.
└──▷ GET THIS VERSION
$ git clone --branch timesketch-1.0.7 https://github.com/google/osdfir-infrastructure.git
# already have the repo? check out this version:$ git checkout timesketch-1.0.7
$ git clone --branch grr-1.0.3 https://github.com/google/osdfir-infrastructure.git
# already have the repo? check out this version:$ git checkout grr-1.0.3
$ git clone --branch 3.16.1 https://github.com/fox-it/dissect.git
# already have the repo? check out this version:$ git checkout 3.16.1
└──▷ TRY IT
Run YARA scans directly without invoking the main target-query CLI.
$ target-yara <rules> <targets>
Get a detailed, human-readable file listing from a mounted filesystem view.
$ target-fs ls -lh <path>
New target-yara command as a standalone entry point, separating YARA scanning from target-query
New -l and -h flags added to target-fs ls for detailed and human-readable listing output
New --root flag in the etc plugin to specify an alternate starting directory
New libvirt child plugin to dissect virtual machines hosted by libvirt
New qemu child plugin to dissect QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware.-based virtual machine images
+7 moreshow less
New plugin to extract unsaved Notepad tabs from memory or disk artifacts
New plugin to extract Windows Jump List information for forensic analysis of recent file access
New plugin to extract Windows Update Agent (WUA) registration and history data
New MFT segmentation ability within the NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. parser
Support for Android backups added via new loader capability
VirtualBox .vdi loader now handles case-insensitive format attributes more robustly
90% speedup in the walkfs plugin for faster filesystem traversal
12 details in Everything
└──▷ BREAKING ON UPGRADE
!The hard dependencies on lz4 and lzo extras of dissect.util are removed; these are now separate optional extras of the dissect package (pip install dissect[lz4,lzo]) and are not installed by default.
1 more release in this issue
· 2024-09-10 → 2024-09-16
Dissect 3.16 adds libvirt/qemu child plugins, unsaved Notepad and Jump List extractors, target-fs ls flags, and shell history.
└──▷ GET THIS VERSION
$ git clone --branch 3.16 https://github.com/fox-it/dissect.git
# already have the repo? check out this version:$ git checkout 3.16
Adds dissect.plugins.libvirt and dissect.plugins.qemu child plugins to parse virtual machine artifacts from Hyper-V/libvirt/QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. disk images.
Adds a new plugin to extract unsaved tabs from Notepad++ files for recovering recently opened but never saved content.
Adds a new plugin to extract Windows Jump List information, including recently accessed files and frequent applications, from .dat files.
Adds -l (long format) and -h (human-readable) options to the dissect.target target-fs ls command for improved output readability.
Adds shell history persistence to target-shell, allowing users to recall previously executed commands within the interactive session.
capa v7.3.0 adds VMRay sandbox support, Ghidra BinExport2 analysis, Android/AArch64AArch64The 64-bit execution state of the ARM architecture, defined by Arm Ltd., offering a wider register file and cleaner instruction set than 32-bit ARM; cyber tools target it to run natively on ARM-based servers, phones, and embedded devices. targets, and a new rules website.
└──▷ GET THIS VERSION
$ git clone --branch v7.3.0 https://github.com/mandiant/capa.git
# already have the repo? check out this version:$ git checkout v7.3.0
Supports VMRay sandbox analysis archives as a new dynamic analysis input, joining CAPE as a second sandbox integration.
Supports analyzing BinExport2 files generated by Ghidra, enabling static analysis without IDA Pro or Binary Ninja.
Adds Android OS and AArch64 (ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead.) architecture support via the BinExport2 backend, enabling ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. analysis for Android targets.
CLI hyperlinks rule matches directly to the new capa rules website in modern terminals.
Launches browsable capa rules website at https://mandiant.github.io/capa/rules for exploring the default rule set.
+2 moreshow less
Updates capa Explorer IDA Pro plugin to support the IDA Pro 9.0 IDAPython API while maintaining backward compatibility.
Adds six new detection rules covering MinHook linking, SQLCipher linking, Windows Filtering Platform (WFP) network filter enumeration/deletion, and Android thread-related behaviors.
malcontent v1.0.0 is a new release of the binary analysis CLI with broader archive and program kind support.
└──▷ GET THIS VERSION
$ git clone --branch v1.0.0 https://github.com/chainguard-dev/malcontent.git
# already have the repo? check out this version:$ git checkout v1.0.0
└──▷ USE IT
Scan a newly supported .xz compressed archive to detect embedded binaries
shell
malcontent scan malware.xz
Analyze a Python compiled bytecode file now supported by programkind detection
shell
malcontent scan app.pyc
Use the new shorter output format for quicker CI feedback loops
shell
malcontent scan --format short binary.dll
Adds .xz archive support to scan mode for deeper inspection of compressed binaries
Extends programkind detection to include .bat, .cpp, .dll, and .pyc file types
Overhauls the CLI architecture using urfave/cli for improved command structure
Introduces a shorter output format option for scan mode to reduce verbose logging
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The tool name and remote repository have changed from bincapz to malcontent; update git remotes with git remote set-url origin git@github.com:chainguard-dev/malcontent.git
Frida 16.5.0 adds thread hardware breakpoints/watchpoints and Windows on ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. support available through source builds.
Adds setHardwareBreakpoint() and unsetHardwareBreakpoint() methods to thread objects for precise breakpoint control
Adds setHardwareWatchpoint() and unsetHardwareWatchpoint() methods to thread objects for memory access monitoring
Adds source-level Windows on ARM support: arm64 Frida can inject into native arm64 and emulated x86_64/x86 processes, but prebuilt Windows arm64 binaries are not provided in this release.
Adds Cancellable.withTimeout() convenience factory function in the Node.js API
Adds Cancellable.combine() convenience method in the Node.js API
Pwndbg 2024.08.29 adds Binary Ninja integration, Go debugging commands, glibc UAF tracking, assembly search, and richer disasm annotations.
└──▷ GET THIS VERSION
$ git clone --branch 2024.08.29 https://github.com/pwndbg/pwndbg.git
# already have the repo? check out this version:$ git checkout 2024.08.29
└──▷ TRY IT
Find all ROP gadgets matching an assembly pattern and immediately set breakpoints on each — useful during exploit development to stop at specific instruction sequences.
$ search --asmbp 'pop rdi; ret'
Inspect the concrete type hidden inside a Go interface object at a known address, without needing debug symbols.
$ go-dump any 0x00c0000b4000
Identify unmapped memory gaps in a process — helpful for spotting guard pages or finding injection targets.
$ vmmap --gaps
Adds Binary Ninja integration to synchronize Binary Ninja view and symbols with Pwndbg.
Adds go-dump <type> <address> command to dump Go types (including interface objects via the any type).
Adds go-type <address> command to inspect Go type information.
Adds glibc heap UAF (use-after-free) tracking and detection.
Extends search with --asm <code> to find assembly instructions and --asmbp <code> to set breakpoints on matching instructions.
Disassembly view displays upcoming syscall details for syscall instructions.
Disasm banner now shows ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. mode (ARM vs Thumb).
Honors MIPSMIPSA RISC processor architecture originally developed at Stanford and commercialized by MIPS Technologies, widely used in embedded and network devices; cyber tools target it to analyze or exploit routers, cameras, and similar hardware. delay slots in the disassembly view.
Prompt is now colored green when the process is alive and red when it is dead.
WX memory is now underlined in memory maps (previously RWX was highlighted).
Adds commands to display Android Binder driver info (experimental).
Adds pcp command to print Linux kernel per-cpu page cache.
Capstone 6.0 adds LoongArch, HPPA, and Alpha architectures, LLVM 18 updates, NanoMips, instruction aliases, and Auto-Sync.
└──▷ GET THIS VERSION
$ git clone --branch 6.0.0-Alpha1 https://github.com/aquynh/capstone.git
# already have the repo? check out this version:$ git checkout 6.0.0-Alpha1
Adds LoongArch, HPPA (PA-RISC), and Alpha architecture disassembly support.
Updates AArch64AArch64The 64-bit execution state of the ARM architecture, defined by Arm Ltd., offering a wider register file and cleaner instruction set than 32-bit ARM; cyber tools target it to run natively on ARM-based servers, phones, and embedded devices., SystemZ, and Mips disassemblers to LLVM 18.
Updates ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. and PPC disassemblers to LLVM 16.
Adds NanoMips extension support.
Adds exotic PPC PairedSingle extension support.
+8 moreshow less
Adds instruction alias support across architectures.
Adds RISC-V operand access information (read/write flags per operand).
Exposes instruction formats for PPC, SystemZ, and LoongArch.
Introduces Auto-Sync mechanism enabling easier architecture module updates and additions.
Adds dynamic architecture registration API.
Adds eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. bswap16/32/64 instruction support.
Adds big-endian mode for the Alpha architecture.
Adds several API improvements to the ARM, AArch64, and PPC modules.
13 details in Everything
└──▷ BREAKING ON UPGRADE
!ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. is renamed to AArch64 everywhere (a compatibility header is provided, but code referencing ARM64 names may break without it).
!SysZ is renamed to SystemZ everywhere (a compatibility header is provided, but code referencing SysZ names may break without it).
!The PPC, ARM, and AArch64 APIs have breaking changes to enumeration values and structs — existing code using these modules must be updated per the v6 release guide.
Cortex Analytics 2024.09.04 adds new low/info BIOCs and alerts for Azure AD PIMPIMProtocol Independent Multicast, an IETF routing protocol that distributes IP multicast traffic across networks without depending on a specific unicast routing protocol, letting tools monitor or manipulate multicast group traffic., webshells, and P2P traffic.
Adds detection for 'Unusual process accessed a web browser history file' (Low Analytics BIOC)
Adds detection for 'Possible webshell file written by a web server process' (Informational Analytics BIOC)
Adds detection for 'Download pattern that resembles Peer to Peer traffic' (Informational Analytics Alert)
Cortex Analytics adds 4 Low and 1 Informational BIOCs plus 1 Informational alert for new detection coverage
Adds New FTP Server as a Low severity Analytics BIOC
Adds Suspicious SSH Downgrade as a Low severity Analytics BIOC
Adds 'Unusual process accessed a crypto wallet's files' as a Low severity Analytics BIOC
Adds 'Unusual process accessed a messaging app's files' as a Low severity Analytics BIOC
Adds 'Kubernetes Pod Created with host Inter Process Communications (IPCIPCInter-process communication, ways for separate programs to exchange data or signals. Examples include pipes, sockets and shared memory.) namespace' as an Informational Analytics BIOC
+1 moreshow less
Adds Rare access to known advertising domains as an Informational Analytics Alert
Prisma Cloud Compute 33.00 introduces VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. vulnerability reporting and agentless AWS ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy. firewall policy API.
Adds lbARN, lbName, and lbType fields to the trafficMirroring > vpcConfig object in the Set Agentless App Firewall Policy API for AWS ALB support
Switches vulnerability reporting format from OVAL to VEX for Red Hat security data when Console and Defenders are upgraded to 33.00+
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Failure to upgrade Defenders below version v30.00 (such as v22.12) results in disconnection from the Console.
Prisma Access 5.2 adds a single-page view for component versions and EoS notifications
Adds a unified dashboard page in Strata Cloud Manager to view Prisma Access version, PAN-OS dataplane version, release type (Preferred or Innovation), and Applications and Threats content version for deployments managed by Strata Cloud Manager and Panorama
Adds notifications within the single-page view that alert users when their current running Panorama version and plugin versions will reach End-of-Support (EoS)
Prisma Access 5.2 introduces explicit proxy support in China for branch and headless device traffic.
Adds explicit proxy support in China to provide a secure internet gateway for users and headless devices without requiring default route changes or GlobalProtect client installation
Leverages AWS infrastructure with a 1:1 architecture pairing each Envoy proxy with a proxy firewall virtual machine (VM) to handle traffic securely within local regulatory constraints
PAN-OS 11.2 adds SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. support on 5G cellular interfaces for automatic traffic steering
Enables SD-WAN on the 5G cellular interface for automatic traffic steering based on link metrics
Adds IPv4 SD-WAN cellular traffic support
Supports SD-WAN interface profile and upstream NAT for cellular links
Prisma Access 5.2 adds TLS 1.3 decryption and Pub/Sub notifications for Traffic Replication PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. files
Adds Pub/Sub notifications to proactively signal when a new PCAP file is stored, eliminating the need for polling tools.
Expander 2.7 adds QRadar integration, Remediation Report, expanded XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. data and 65k port scanning.
Adds outbound QRadar integration for correlating Xpanse-discovered risks
Introduces Remediation Report to share risk details by business unit with non-expander users
Enhances external services XQL dataset with detailed CVE data, service classification and geolocation fields
Enables periodic discovery scans across all 65k ports on 60+ additional protocols for global IPv4 address space
Adds alerts overview dashboard showing alert resolution trends and top ten alerts by type/cloud provider over one year
+3 moreshow less
Adds software version column to the Alerts table for filtering and exporting detected versions
Improves active response enrichment by supporting retrieval of Azure Compute instance hierarchy
Increases remediation coverage for attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. rules: TFTPTFTPTrivial File Transfer Protocol, a minimal UDP-based file transfer protocol standardized in RFC 1350, used by cyber tools when simplicity and low overhead matter more than authentication or error recovery. Server, Libssh, Insecure Bitvise SSH Server, Insecure SFTPGo
Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 3.12 adds multi-tenant MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions. licensing, Windows cloud agent support, AI PowerShell inspection, and Linux Userspace fallback.
Adds Enterprise Multi-Tenant & MSSP licensing model for Cortex XDR to streamline child tenant management and data segregation
Enhances Palo Alto Networks NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. integration process to support onboarding from multiple CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. accounts into a single Cortex tenant
Enables Windows support for the Cortex XDR agent for Cloud, providing unified runtime security, vulnerability, and compliance scanning for Windows OS
Introduces AI-powered PowerShell examination in the Windows Malware Profile as part of local analysis capabilities
Adds Agent Operation Mode setting in Linux Agent Settings Profile to allow selection of Userspace fallback mode when Kernel Mode is unavailable
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The Top Incidents widget has been renamed to Top Open Incidents.
PAN-OS 11.1 adds IKE gateway support for dynamic IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. addresses via DHCPv6, PPPoEv6, and 5G modems
Prisma Access 5.2 adds SC-NAT support with Dynamic Privilege Access to resolve IP exhaustion for private apps.
Adds source NAT (SNAT) support via SC-NAT integration with Dynamic Privilege Access (DPA) to map a single IP address for private application access through service connections.
Eliminates IPv4 address pool overlap and exhaustion between Prisma Access infrastructure subnets and on-premises data center or headquarters networks.
Enables simplified routing for service connections by using SNAT in Dynamic Privilege Access environments.
Prisma Access 5.2 adds IP Optimization with NAT layer for GlobalProtect and Explicit Proxy to reduce SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. allow list overhead.
Adds a new NAT layer for GlobalProtect Mobile Users that ensures autoscaled gateways retain the same IP address, eliminating the need to update external allow lists during autoscaling events.
Expands the existing IP Optimization capability to Explicit Proxy connections in Proxy Mode and Tunnel and Proxy Mode deployments, providing consistent source IPs.
Prisma Access 5.2 Preferred Innovation introduces route summarization for Dynamic Privilege Access to help enterprises with limited on-premises router capacity by advertising summarized global IP pools instead of numerous project-level routes.
Prisma Access 5.2 adds ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector support for commitless app onboarding
ZTNA Connector now supports commitless application onboarding, reducing setup time from 5-10 minutes to under one minute.
Enhanced scalability for large enterprises managing over 10,000 applications with rapid policy modifications.
Prisma Cloud adds DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. integration with attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., new Bedrock/DSPM policies, POST vulnerability APIs, and more
Adds dataSecurity objects to Asset Explorer API responses for DSPM integration
Introduces trafficMirroring > vpcConfig fields (lbARN, lbName, lbType) to the Set Agentless App Firewall Policy API for AWS ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy. support
Adds new POST endpoints for vulnerability dashboards: Get Vulnerability Impact by Stage - POST, Get Vulnerable Assets - POST, Get Top Impacting Vulnerabilities - POST, Get Vulnerability Overview - POST, Get Prioritized Vulnerabilities - POST, Get CVE Overview - POST, and Get Vulnerable Assets by CVE - POST
Supports Package Operational Risk assessment with severity levels (High, Medium, Low) for open-source packages
Decorates data stores in Attack Paths with a crown jewel icon and adds a Data tab to the Asset Inventory sidecar displaying data findings
Enhances Shared Views to allow setting default visibility (Make this dashboard visible for all viewers) when sharing custom views via Home > Alerts > Manage Views
Adds Jira integration support for versions 9.0 and above, including Jira Cloud and On-Premise
Transitions Red Hat security data reporting from OVAL to VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. format for vulnerability scanning
10 details in Everything
└──▷ BREAKING ON UPGRADE
!The azure-active-directory-credential-user-registration-details API is deprecated and no longer ingests metadata; RQL auto-completion for this API name is removed. Existing saved searches or custom policies using this API must be manually deleted, and alerts will resolve as Policy_Deleted.
Prisma Access 5.2 Preferred Innovation enhances administrative security by allowing granular control over the Cloud Services plugin within Panorama admin roles.
PAN-OS 11.2 adds explicit proxy support for Advanced WildFire, Threat Prevention, URL Filtering, App-ID Cloud Engine, and Enterprise DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. services
Adds Clone SmartGroup option under Groups > SmartGroups vertical ellipses menu to duplicate a group configuration
Adds Details view (with General Information, BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes., Subnet Information, and Certs Info tabs) for Transit, Spoke, and Specialty Gateways on Cloud Fabric > Gateways
Third-Party Guest Users Analyzed in PeopleBase and Account Takeover Protection
PeopleBase supports import and analysis of guest users across connected mail, identity, and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. tenants.
Account Takeover Protection now surfaces Notable Events for guest user behavior deviations.
2 details in Everything
1 more release in this issue
· 2024-09-03 → 2024-09-21
$ git clone --branch 3.10.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:$ git checkout 3.10.0
Adds MIME UTF-8 support for improved handling of international email content.
Adds SenderScore Reputationlist RBLRBLA DNS-based blocklist of IP addresses known to send spam or host malicious traffic, maintained by various operators, used by cyber tools to reject or flag connections from listed sources at lookup speed. and RPBL return codes to the default RBL configuration.
Supports setting a negative group score limit via min_score on score groups.
Adds DMARC reporting.only_domains setting to restrict DMARC aggregate reports to specific domains.
Implements individual rate limits per fuzzy key in fuzzy storage.
+7 moreshow less
Supports different operating modes for fuzzy rules.
Adds OpenSSL 3.0 support across cryptographic subsystems including lua_rsa.
Allows changing the log tag dynamically from an HTTP request.
Sets a default 5-day expiration for Redis-backed history entries.
Allows manipulations with opaque UCL objects for more flexible configuration handling.
URL-encodes constructed ICAP paths to ensure URL safety.
Supports more flexible keypair encoding formats.
12 details in Everything
└──▷ BREAKING ON UPGRADE
!NIST mode has been removed from the cryptobox; configurations relying on NIST curve support in cryptobox will break.
!Control block support has been removed; setups using control blocks will no longer function.
Zeek v7.0.1 adds StartTLS support to the LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. analyzer and improves GSS-API WRAP token handling.
└──▷ GET THIS VERSION
$ git clone --branch v7.0.1 https://github.com/zeek/zeek.git
# already have the repo? check out this version:$ git checkout v7.0.1
Adds StartTLS support to the LDAP analyzer, enabling the SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. analyzer for connections that negotiate TLS via the extended request/response mechanism.
Supports handling of non-sealed GSS-API WRAP tokens in the LDAP analyzer.
Adds system language support for Android 13+, always-on VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. detection after capture start, and Mitm addon v1.2 capabilities
└──▷ GET THIS VERSION
$ git clone --branch v1.7.3 https://github.com/emanuele-f/PCAPdroid.git
# already have the repo? check out this version:$ git checkout v1.7.3
Allows setting the app language from the system (for Android 13+)
Detects if always-on VPN is enabled after a capture starts
Mitm addon v1.2: allows public files write
Permits using a compatible mitm addon with the same major version
bettercap v2.4.0 adds a full CAN-bus module, wifi.bruteforce for Linux/macOS, and new GPS/history controls
└──▷ GET THIS VERSION
$ git clone --branch v2.4.0 https://github.com/bettercap/bettercap.git
# already have the repo? check out this version:$ git checkout v2.4.0
└──▷ TRY IT
Override GPS coordinates manually (e.g. when testing location-aware caplets without a GPS receiver)
$ sudo bettercap -eval 'gps.set 48.8566 2.3522'
New can module for CAN-bus recon, injection, fuzzing, filtering, and OBD-II parsing
Adds can.inject to inject raw CAN frames onto a bus
Adds can.fuzz command with optional size argument to fuzz CAN frame IDs and payloads
Adds can.filter to filter captured CAN traffic
Adds can.dup and can.dump.inject to replay frames from a candump log file
+8 moreshow less
Adds built-in can.obd2 parser for decoding OBD-II data, including 29-bit identifiers
Implements wifi.bruteforce for Linux and macOS (WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes./WPA2 handshake attacks)
Adds gps.set command to manually override GPS coordinates without hardware
History file location is now configurable via the BETTERCAP_HISTORY environment variable
Embeds the web UI directly into the bettercap binary
Adds new WiFi RSN parsing and additional cipher suites and auth types (including WPA3WPA3The third generation of the Wi-Fi Protected Access authentication and encryption standard, maintained by the Wi-Fi Alliance, offering stronger handshake protection and per-session encryption compared to WPA2. identification)
BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems., CAN, HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral., and WiFi modules now set a custom shell prompt to reflect active module context
CAN bus state is now exposed in the session JSON object via the API
13 details in Everything
└──▷ BREAKING ON UPGRADE
!The armhf build target has been removed and no binary is produced for it in this release.
Snort3 3.3.7.0 adds DNS sinkholeDNS sinkholeA DNS server configured to return false responses for malicious or unwanted domains, redirecting traffic to a controlled address instead of the real destination, so analysts can detect and block infected hosts.EDNSEDNSAn extension to the DNS protocol, standardized by the IETF, that adds larger UDP payload sizes, option flags, and extensible fields; cyber tools use it to carry additional query metadata and avoid fragmentation issues. support, HTTP/2 IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. frame options, FTP fallback, and jemalloc heap profiling commands.
└──▷ GET THIS VERSION
$ git clone --branch 3.3.7.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.3.7.0
Adds DNS sinkhole support for EDNS in AppID, enabling detection of EDNS-based DNS traffic through sinkhole infrastructure.
Adds new IPS options for HTTP/2 frame header and data inspection via http2_inspect.
Adds fallback functionality for FTP in ftp_telnet, broadening protocol coverage.
Adds shell commands for jemalloc heap profiling to aid memory diagnostics.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Binder configuration is changed to allow only a single service per binding; setups with multiple services per binding entry will need to be updated.
1 more release in this issue
· 2024-09-09 → 2024-09-30
Snort 3.3.5.0 adds JSON logging for the extractor, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. window/options tracing, and new AppID reload logs.
└──▷ GET THIS VERSION
$ git clone --branch 3.3.5.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.3.5.0
Adds JSON logger output format to the extractor for structured event export.
Adds TCP window size, options, and meta-ack information to packet_tracer output.
Adds new log messages for AppID third-party library reloads.
Sets file name metadata during file processing in file_api.
Adds field name context to extractor logging function output.
New cscli metrics show bouncers command surfaces remediation component efficiency stats (blocked packets/bytes, HTTP requests) in the CLI and console.
Remediation components (starting with firewall-bouncer 0.0.30) can now report detailed metrics — visible per-instance in the CrowdSec console.
New cscli machines inspect and cscli bouncers inspect commands expose detailed info including underlying OS for easier management of larger deployments.
Machines can now auto-register with the Local API, simplifying Kubernetes and Docker onboarding.
New --ignore-missing option for cscli bouncers delete and cscli machines delete enables idempotent scripted teardowns.
+8 moreshow less
New cscli doc --target /path/to/dir command generates CLI documentation to a specified directory.
New default_range_remediation configuration option added for more granular remediation control.
Hub now backed by a new Hub API, enabling new item types (acquisition files, notification templates) and larger collections (e.g., Sigma).
cscli hub update gains --with-content option to retain embedded items in the index, used by default in Docker.
Environment variables can now be expanded in local_api_credentials.yaml and .yaml.local config files.
OpenBSD support added for filesystem type detection via correct statfs struct member.
LAPI CAPI status query can now also return enrollment status.
Improved TLS middleware with stronger revocation checks.
Malcolm v24.09.0 adds Podman support, HART-IP parsing, index-splitting, and new env vars for container runtime and protocol control.
└──▷ GET THIS VERSION
$ git clone --branch v24.09.0 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v24.09.0
└──▷ USE IT
Run Malcolm under Podman instead of Docker by setting the container runtime in process.env before starting.
ini
MALCOLM_CONTAINER_RUNTIME=podman
Partition network indexes by event provider and date to isolate traffic by source system in OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions..
Disable the new HART-IP ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. protocol parser on a Zeek sensor if it conflicts with existing capture rules.
ini
ZEEK_DISABLE_ICS_HART_IP=true
Adds MALCOLM_CONTAINER_RUNTIME to ./config/process.env to indicate docker, podman, or kubernetes, enabling Podman support alongside Docker.
Adds ZEEK_DISABLE_ICS_HART_IP to ./config/zeek.env (and control_vars.conf for Hedgehog Linux), settable to true to disable the new HART-IP protocol parser.
Extends MALCOLM_NETWORK_INDEX_SUFFIX and MALCOLM_OTHER_INDEX_SUFFIX in ./config/opensearch.env to support dot-delimited field name expansion using {{ }} syntax (e.g., {{event.provider}}%{%y%m%d}).
Integrates the HART-IP parser (icsnpp-hart-ip) for ICS protocol analysis via Zeek.
Allows splitting indexes by arbitrary field values beyond the existing defaults.
+6 moreshow less
Allows total index size-based pruning for opensearch-remote and elasticsearch-remote database modes.
Includes the netbox-topology-views plugin by default in NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment..
Allows users to use the Arkime Lua plugin without manually creating bind volume mounts.
Adds an option to navigate backwards in Malcolm's dialog-based install.py installation and configuration script.
Allows specifying an alternate download URL for MaxMind GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. database files when building Docker images and the Hedgehog Linux ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability..
Updates EtherNet/IP and CIP parsers to account for the new packet correlation ID.
$ git clone --branch v0.32.0 https://github.com/inspektor-gadget/inspektor-gadget.git
# already have the repo? check out this version:$ git checkout v0.32.0
New fsnotify gadget traces calls to inotify() and fanotify() system calls.
Adds support for displaying event data in hex format via columns.
K8s enrichment now includes OwnerKind and OwnerName fields for traced events.
Adds mechanism to disable pulling of image-based gadgets.
Trivy is a comprehensive security scanner that finds vulnerabilities, misconfigurations, secrets, and SBOM in containers, Kubernetes, code repositories, and clouds
Trivy 0.55.0 adds --detection-priority tuning, --path-prefix for server mode, misconf scanning for YAML/JSON, and new VM filesystem support.
└──▷ GET THIS VERSION
$ git clone --branch 0.55.0 https://github.com/aquasecurity/trivy.git
# already have the repo? check out this version:$ git checkout 0.55.0
└──▷ USE IT
Scan a container image or filesystem while tuning false positive rates by setting detection priority.
shell
trivy --detection-priority high target-image
Configure Trivy Server to run behind a reverse proxy with a path prefix.
shell
trivy server --path-prefix /trivy
Scan a local YAML or JSON configuration file for misconfigurations.
shell
trivy config path/to/config.yaml
Adds --detection-priority flag to tune vulnerability detection accuracy
Adds internal --path-prefix flag for Trivy Server client/server mode
Adds Ext2/Ext3 filesystem support in VM scanning module
Adds direct filesystem support in VM scanning module
Adds test scope support for Java pom.xml files
+10 moreshow less
Adds support for ignoring checks by nested attributes in misconf
Adds variable support for Terraform Plan in misconf
Adds support for policy and bucket grants in misconf
Adds iterator argument support for dynamic blocks in misconf
Adds port and protocol support for EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. networks in misconf
Adds support for using spec from on-disk bundle in misconf
Exports modified findings in JSON reports
Uses toolchain as stdlib version for go.mod files
Sets User-Agent header on requests to Rekor for SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. module
KubeHound v1.5.1 adds the CE_UMH_CORE_PATTERN attack edge and an env var for the ingestor/gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. image.
└──▷ GET THIS VERSION
$ git clone --branch v1.5.1 https://github.com/datadog/kubehound.git
# already have the repo? check out this version:$ git checkout v1.5.1
Adds an environment variable to configure the ingestor/gRPC container image.
Adds CE_UMH_CORE_PATTERN attack edge, modelling container-escape via core-pattern kernel write.
KubeHound v1.5.0 unifies all components into one binary and adds a config command plus automatic metadata.json generation on dumps.
└──▷ GET THIS VERSION
$ git clone --branch v1.5.0 https://github.com/datadog/kubehound.git
# already have the repo? check out this version:$ git checkout v1.5.0
└──▷ TRY IT
Inspect or manage KubeHound configuration using the new built-in config command.
$ kubehound config
Adds a config command to the kubehound CLI for managing configuration.
Generates a metadata.json file on each dump, carrying run_id and cluster_name, so ingest no longer requires manual cluster identification via flags.
Consolidates the collector, ingestor, and gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. client into a single kubehound-binary binary, replacing the previous per-component binaries.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!kubehound-ingestor has been renamed to kubehound-binary; any scripts or pipelines referencing the old binary name will break.
!The --cluster flag on kubehound ingestor local is deprecated; cluster metadata is now read from the generated metadata.json, or parsed from the dump path when the file is absent.
Kata Containers 3.9.0 adds CDH_API_TIMEOUT config, TDXTDXIntel Trust Domain Extensions, a CPU feature that creates hardware-isolated virtual machines whose memory is encrypted and inaccessible even to the hypervisor, letting tools run workloads in a confidential computing environment. mrconfigid settings, and image-rs xattr checks.
└──▷ GET THIS VERSION
$ git clone --branch 3.9.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:$ git checkout 3.9.0
agent/config introduces the CDH_API_TIMEOUT configuration key to control the Confidential Computing API timeout
runtime: Add support for setting mrconfigid, mrowner, and mrownerconfig in TDX configurations
image-rs (agent) now checks extended attributes (xattrs) during image unpacking for stricter security
virtcontainers allows specifying the nydus-overlayfs binary path via a configuration option
Anchore Enterprise 2.0 adds configurable GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. dashboard, GraphQL reporting service, and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. integration
Adds a new configurable GUI dashboard with metrics time series for container image status
Introduces the Enterprise Reporting Service exposing full container image information via a flexible GraphQL interface
Adds LDAP/AD identity management integration with flexible RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. account and user subsystem mappings
Anchore Enterprise 2.1 adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management./SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. auth, GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. vulnerability feeds from VulnDB, and Policy Hub integration.
Adds configurable filtered reports (tabular HTML, JSON, or CSV) for image, security, and policy status in the GUI Reports control
Adds Single-Sign-On integration support for Okta, Keycloak, and Enterprise IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. systems via SAML/token-based authentication for API and client integrations
Incorporates third-party vulnerability data feeds from Risk Based Security (VulnDB) to enhance image scanning results
Enables viewing, listing, and importing pre-made policies from the Anchore Policy Hub via the Policy Hub GUI
Anchore Enterprise 2.2 introduces notifications for GitHub/Jira/Slack/Teams, a new System Dashboard UI, and Harbor v1.10++ support
Adds Anchore Enterprise Notifications capability to send system, user, and workload level events to GitHub, Jira, Slack, and Microsoft Teams.
Adds a new System Dashboard in the Enterprise GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. to review deployment status, troubleshoot issues, and view service roles.
Adds full support for CNCF Harbor project v1.10++ as an integrated artifact registry.
Anchore Enterprise 2.3.1 adds relative time windows to Reporting GraphQL API and CVE blacklisting policy rules.
Adds since parameter to Reporting service's GraphQL API queries to specify time ranges using a relative window (e.g., last 30 days) instead of absolute start/end dates
Adds licenses field (array type) to API responses for content packages, supplementing the existing comma-delimited license string field
Anchore Enterprise 4.1.0 adds source-to-image SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. drift detection, CVE false positive reduction feed, and image archive rules with last_seen_in_days.
src2img-sbom-drift-policy-gate and src2img-sbom-drift-trigger detect when source repository SBOM packages are missing from the built container image.
New 'anchore:exclusions' vulnerability feed automatically excludes known false positives using Grype database schema Version 4.
archival_rule_exclusion.last_seen_in_days allows archive rules to skip images with active runtime inventory records seen within N days.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Embedded Inventory Mode Feature is deprecated and will be removed in v4.2.0.
!Configuration variable ANCHORE_VULNERABILITIES_PROVIDER is no longer supported.
!Configuration variable ANCHORE_ENTERPRISE_FEEDS_THIRD_PARTY_DRIVERS_ENABLED is no longer supported.
Anchore Enterprise 4.1.1 adds a Recommendation field to policy rules for remediation guidance and overhauls service logs with detailed timestamped routing info.
Adds a Recommendation field to Policy Rules visible in image policy check results, allowing creators to provide generic fix hints
Overhauls service log output to display detailed timestamped information categorized by level, including accessed routes, connection details, configuration details, and major runtime operations
Anchore Enterprise 4.2.0 adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. strict mode, node.js binary detection, and vendor-only vulnerability filtering
Adds saml.strict_mode config key to enforce pre-allocated SSO users for login
Adds detection of non-packaged node.js binaries during image analysis
Adds Vendor Only CVE client-side filter to the Vulnerabilities tab in the UI
Adds Kubernetes page optimized presentational view for high analytical volume via client config parameters
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Removed the Kubernetes Runtime Inventory Embedded mode and associated cluster configuration APIs; deploy KAI into the cluster directly in inventory mode instead.
Anchore Enterprise 4.3.0 adds runtimeInventoryUnscannedImages report query, repo-analyzerRBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. role, Wolfi OS feed support, and application version vulnerability queries.
Adds the runtimeInventoryUnscannedImages report query to list runtime inventory images that have not been analyzed
Introduces a new repo-analyzer RBAC Role to create repository subscriptions as a companion to image-analyzer
Enables vulnerability matching for Wolfi OS Packages by importing the Wolfi Security Feed
API now supports querying a list of vulnerabilities found for a specific Application Version
Anchore Enterprise 4.5.0 adds report-admin RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. role and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export to Artifact Analysis.
Adds report-admin as a new RBAC Role for users who need to work with scheduled queries without other write permissions
Enables download of SBOM data from the Artifact Analysis view in SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. and OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against.CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. formats alongside the native JSON format
Anchore Enterprise 4.6.0 adds a DELETE API for runtime inventory contexts and introduces an inherit parameter to Vulnerability Package Triggers.
Adds /enterprise/inventories DELETE endpoint to remove runtime inventory contexts no longer reported by KAI
Adds the inherit parameter to Vulnerability Package Triggers to control whether base image vulnerabilities are considered
Deprecates policy triggers using blacklist/whitelist terminology in favor of denylist/allowlist (existing entries work until policy update)
Improves Inventory Watcher logging conciseness at info level
Adds global metrics anchore_monitor_inventory_contexts_monitored_total, anchore_monitor_inventory_images_total (found), anchore_monitor_inventory_images_total (success), and anchore_monitor_inventory_images_total (fail) for runtime inventory monitoring
+2 moreshow less
Adds analyzer status metrics: anchore_analyzer_status (waiting), anchore_analyzer_status (error), anchore_analyzer_status (processing), and anchore_analyzer_dequeue_latency
Improves analysis job re-queue detection time from hours to minutes when an analyzer shuts down
Anchore Enterprise v4.7.0 adds new Runtime Inventory Agents, K8s namespace vulnerability reporting, and AnchoreCTL SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. import.
Adds anchore-k8s-inventory and anchore-ecs-inventory as new Runtime Inventory Agents for accessing Kubernetes and ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. environments
Introduces a new Vulnerabilities by Kubernetes Namespace report template to filter findings by namespace
Makes the account email field editable via API endpoints
Adds a new parameter to the Vulnerability Package trigger to control behavior for base image vulnerabilities
Enables Container Image SBOM generation and import from AnchoreCTL without Syft, supporting secret scans and filesystem metadata analysis
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Upgrading from an Anchore Enterprise version prior to v4.2.0 requires a sequential upgrade to v4.2.0 or v4.3.0 before proceeding to v4.7.0
Anchore Enterprise v4.8.1 adds configuration options to disable specific vulnerability reports
Adds ANCHORE_ENTERPRISE_REPORTS_GENERATE_VULN_K8S_NAMESPACE, ANCHORE_ENTERPRISE_REPORTS_GENERATE_VULN_K8S_CONTAINER, and ANCHORE_ENTERPRISE_REPORTS_GENERATE_VULN_ECS_CONTAINER environment variables for Docker Compose users to control report generation
Adds anchoreEnterpriseReports.vulnerabilitiesByK8sNamespace, anchoreEnterpriseReports.vulnerabilitiesByK8sContainer, and anchoreEnterpriseReports.vulnerabilitiesByEcsContainer configuration keys in Helm values.yaml to control vulnerability reports
Anchore Enterprise 4.9.0 adds V2 API for migration, configurable import sizes, and new policy metadata capture.
Exposes the Anchore Enterprise V2 API as a consolidated endpoint for customers migrating from the distributed V1 APIs prior to v5.0.0
Adds ANCHORE_MAX_IMPORT_CONTENT_SIZE_MB environment variable and Helm value max_import_content_size_mb to configure the maximum image import size (default 100 MB)
Adds ANCHORE_MAX_IMPORT_SOURCE_SIZE_MB environment variable and Helm value max_source_import_size_mb to configure the maximum source repository import size (default 100 MB)
Enables Policy Engine to capture and persist observed date and fix observed date for vulnerability provider sync data to support consistent max days since fix evaluations
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The distributed V1 API files are deprecated in favor of the consolidated V2 API; customers using direct V1 API access must migrate prior to Enterprise v5.0.0
Anchore Enterprise 4.9.4 adds software downgrade support and fixes for Windows container analysis and feed sync
Adds the ability to execute a software downgrade from a patch release to a release within the same Major.Minor version numbers.
Fixes an issue that prevented new Windows OS containers from being analyzed properly, enabling correct reporting for these workloads.
Ensures image digests match when an image is analyzed within Enterprise (centralised analysis) versus when the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. is imported via AnchoreCTL (distributed analysis).
Steampipe v0.24.0 adds configurable plugin startup timeout and enriches JSON query output with column metadata.
└──▷ GET THIS VERSION
$ git clone --branch v0.24.0 https://github.com/turbot/steampipe.git
# already have the repo? check out this version:$ git checkout v0.24.0
└──▷ TRY IT
Parse column type metadata from query results — useful when scripting against APIs that return duplicate column names or when you need data-type-aware processing.
Adds ability to configure plugin startup timeout, giving operators control over slow-starting plugins.
Enriches --output json query results with a new columns property containing column name and data type metadata, enabling correct handling of duplicate column names.
Installs FDW and embedded Postgres database from GHCRGHCRGitHub Container Registry, GitHub's hosted service for storing and distributing OCI-compatible container images, giving cyber tools a versioned, access-controlled image store tied directly to a GitHub repository. instead of GCP, reducing dependency on GCP infrastructure.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The JSON output format for steampipe query --output json now includes a top-level columns array alongside rows; scripts or tools that parse the JSON output and expect only a rows key will need to be updated.
Cloud Custodian 0.9.41 adds 5 new AWS resources, Azure snapshots, OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. Ingestion, MemoryDB users/ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource., and a shift-left validate command.
└──▷ GET THIS VERSION
$ git clone --branch 0.9.41.0 https://github.com/cloud-custodian/cloud-custodian.git
# already have the repo? check out this version:$ git checkout 0.9.41.0
└──▷ USE IT
Filter AWS Config recorders by retention period to detect non-compliant retention configurations.
Adds aws.opensearch-ingestion resource with filters and actions for managing OpenSearch Ingestion pipelines.
Adds aws.origin-access-control resource for managing CloudFront origin access controls.
Adds aws.memorydb-user, aws.memorydb-acl, and aws.memorydb-snapshot resources (snapshot includes tag support and delete action).
Adds retention filter to aws.config-recorder for querying Config recorder retention settings.
Adds browser-policy, subnet, user-access-logging, and user-settings filters to aws.workspaces-web.
+7 moreshow less
Adds detail spec to aws.storage-gateway, unlocking tag management actions (tag, remove-tag, rename-tag, copy-related-tag, auto-tag-user, mark-for-op) and marked-for-op filter.
Adds azure.snapshot resource with a delete action.
Restores Terraform as a supported provider in core, enabling schema validation for shift-left (terraform._ resource).
Adds from_json JMESPath function to the value filter for parsing embedded JSON strings during filtering.
Adds validate command to c7n-left (shift-left CLI) for policy validation against IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup..
Extends c7n-left traverse filter to support boolean blocks in attributes.
De-duplicates matched egress/ingress rules in aws.security-group results.
Adds 74 new AWS checks spanning ACM, CloudFront, CodeBuild, DMS, DocumentDB, DynamoDB, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware., ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping., EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves., ElastiCache, ELB, ELBv2, GuardDuty, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access., KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves., Lambda, Neptune, Network Firewall, Organizations, RDS, S3, SageMaker, and VPC.
New organizations_opt_out_ai_services_policy check detects whether your AWS Organization has opted out of AWS AI services using your data for model training.
New IAM checks detect policies using non-existent actions/resources in NotAction/NotResource statements that inadvertently grant broad permissions.
New containerregistry_admin_user_disabled check for Azure Container Registries verifies the admin user is disabled.
Adds KISA ISMS-P (Korea Internet & Security Agency Personal Information & Information Security Management System) as a supported AWS compliance framework.
+12 moreshow less
New GuardDuty checks guardduty_rds_protection_enabled and guardduty_s3_protection_enabled verify threat detection coverage for RDS and S3.
New CloudFront checks cover custom SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certificates, default root objects, SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address.-based HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate., origin failover, traffic encryption to custom origins, S3 origin access control, and non-existent S3 origin buckets.
New Lambda checks awslambda_function_inside_vpc and awslambda_function_vpc_multi_az verify VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. placement and multi-AZ resilience.
New RDS cluster and instance checks cover multi-AZ, deletion protection, encryption at rest, IAM authentication, minor version upgrades, tag copying, CloudWatch log integration, non-default ports, backup plan protection, and critical event subscriptions.
New ECS checks cover public IP assignment, read-only container filesystem access, host namespace sharing, host networking mode users, logging, and privileged container usage.
New codebuild_project_no_secrets_in_variables and codebuild_project_source_repo_url_no_sensitive_credentials checks detect secrets exposed in CodeBuild configurations.
New eks_cluster_uses_a_supported_version check flags EKS clusters running unsupported Kubernetes versions.
New kms_cmk_not_deleted_unintentionally check detects KMS customer-managed keys scheduled for unintentional deletion.
New s3_access_point_public_access_block check verifies public access block configuration on S3 access points.
New ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports check flags security groups exposing high-risk TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. ports to the internet.
New ec2_launch_template_no_public_ip check ensures launch templates do not assign public IPs by default.
New ecr_repositories_tag_immutability check verifies ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. image tag immutability is enabled.
Tetragon is an eBPF-based security observability and runtime enforcement tool for Kubernetes and cloud-native environments.
Tetragon v1.2.0 adds LSM sensor, username enrichment, persistent enforcement, NRI runtime hooks, and new MatchBinaries operators.
└──▷ GET THIS VERSION
$ git clone --branch v1.2.0 https://github.com/cilium/tetragon.git
# already have the repo? check out this version:$ git checkout v1.2.0
└──▷ USE IT
Switch the liveness probe back to tetra status after upgrading, since gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. is now the default.
Adds LSM (Linux Security Module) sensor for LSM-based policy enforcement and event generation.
Adds username enrichment to process_exec events, resolving UIDs to login names via /proc and a local cache.
Supports persistent enforcement during Tetragon restarts, maintaining policy enforcement across agent lifecycle.
Adds NRI (Node Resource Interface) support for runtime hooks via tetragon.rthooks.
Adds FollowChildren attribute to MatchBinaries selector in tracing policies, enabling matching on child processes.
+10 moreshow less
Adds Postfix and NotPostfix operators to the matchBinaries selector.
Adds cgroup rate support for limiting events per cgroup.
Adds export filter targeting parent process binary name.
Adds dynamic log level change option via the tetra CLI.
Adds tetragon_pod label to metrics via ServiceMonitor and supports extra labels on ServiceMonitors.
Exposes kernel ring buffer errors and Go scheduler latencies in metrics.
Adds missed probes metrics.
Adds debug Helm flag for the agent.
Enforces single Tetragon instance per node.
Adds compact print support for LSM events in tetra CLI.
15 details in Everything
└──▷ BREAKING ON UPGRADE
!The tetragonOperator.skipCRDCreation Helm value is removed; use crds.installMethod=none instead.
!The default liveness probe is now gRPC instead of tetra status; to keep using tetra status, specify tetragon.livenessProbe in Helm values.
!The tetragon_policyfilter_metrics_total metric is renamed to tetragon_policyfilter_operations_total, and its op label is renamed to operation.
!The tetragon_missed_events_total metric is renamed to tetragon_bpf_missed_events_total.
!tetragon_ringbuf_perf_event_errors_total is renamed to tetragon_observer_ringbuf_errors_total.
!tetragon_ringbuf_perf_event_received_total is renamed to tetragon_observer_ringbuf_events_received_total.
!tetragon_ringbuf_perf_event_lost_total is renamed to tetragon_observer_ringbuf_events_lost_total.
!tetragon_ringbuf_queue_received_total is renamed to tetragon_observer_ringbuf_queue_events_received_total.
!tetragon_ringbuf_queue_lost_total is renamed to tetragon_observer_ringbuf_queue_events_lost_total.
!tetragon_errors_total{type="process_cache_evicted"} is replaced by tetragon_process_cache_evicted_total.
!tetragon_errors_total{type=~"process_cache_miss_on_get|process_cache_miss_on_remove"} metrics are replaced by tetragon_process_cache_misses_total{operation=~"get|remove"}.
!tetragon_event_cache_<entry_type>_errors_total metrics are replaced by tetragon_event_cache_fetch_failures_total{entry_type="<entry_type>"}.
!tetragon_event_cache_accesses_total is renamed to tetragon_event_cache_inserts_total.
!tetragon_event_cache_retries_total is renamed to tetragon_event_cache_fetch_retries_total.
!tetragon_errors_total{type="event_missing_process_info"} is replaced by tetragon_events_missing_process_info_total.
!tetragon_errors_total{type="handler_error"} is removed; use tetragon_handler_errors_total instead.
!The sensor managing gRPC API methods ListSensors, EnableSensor, DisableSensor, and RemoveSensor are deprecated.
!tetragon.ociHookSetup Helm value is deprecated; use tetragon.rthooks instead.
Hunters Pathfinder AI adds Azure Event Hub ingestion, Meraki/SAP integrations, new API timestamps, and detection logic
Adds support for ingesting Microsoft logs via Azure Event Hub
Adds new Meraki Auth Users integration for splash guest and RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. user data
Adds new SAP Security Audit Logs integration mapped to the Hunters Login Schema
Adds new SAP S/4HANA Security Audit Logs integration mapped to the Hunters Login Schema
Adds Azure Kubernetes Service integration mapped to the Hunters K8s Schema
+6 moreshow less
Adds Azure Application Gateway WAF integration mapped to the Hunters Network Schema
Adds Microsoft Purview integration for data governance logs
Adds Microsoft Defender Identity Query integration for identity threat insights
Adds new detector aws_malicious_user_agents to identify API calls by known attacking tools via User-Agent field
Adds new detector edr_cmd_suspicious_silent_execution_patterns to find suspicious silent cmd.exe execution with the /Q flag
Adds two timestamp fields to the Get Leads API endpoint: event_end_time and ingestion_time
Hunters Pathfinder AI updates Azure AD, Defender for Office 365, and Proofpoint detector logic to reduce SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. noise
Adds risk_state filtering for Azure AD Identity Protection Risk Detections to limit SOC queue entries to specific risk states
Databricks emergency access can now be configured without SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., supporting up to 20 users with FIDO 2 MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone..
Emergency access for account admins no longer requires Single Sign-On (SSO) configuration.
Meta Llama 3.2 (3B and 1B) models added to Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves. in Databricks Model Serving.
Prototype and export tool-callingtool-callingA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions. AI agents in the Databricks AI Playground. Users can now provide tools as Unity Catalog functions to interact directly with the agent within the playground environment. Additionally, there is support for exporting the AI agent into notebooks, enabling further iteration, quality evaluation, and deployment processes.
The Publish to Power BI feature, which was in private preview, has reached general availability. Users can now natively create semantic models from Databricks tables or schemas and publish them directly to the Power BI service without intermediate steps.
General availability of the direct-to-Power BI publishing capability.
Foundation Model API provisioned throughput now supports GTE v1.5 (English) embedding modelsembedding modelsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG.
Adds support for gte-base-en-v1.5 and gte-large-en-v1.5 in Foundation Model API provisioned throughput
Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves. pay-per-token billing now available in eu-central-1 and eu-west-1.
Pay-per-token pricing for Foundation Model APIs becomes available in the eu-central-1 region.
Pay-per-token pricing for Foundation Model APIs becomes available in the eu-west-1 region.
Adds OpenAI-compatible function callingfunction callingA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions. support to Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves. on provisioned throughput.
Wazuh v4.9.0 adds Fluentd alert forwarding, Amazon Security Hub via SQS, Journald logcollector support, and HAProxy helper
└──▷ GET THIS VERSION
$ git clone --branch v4.9.0 https://github.com/wazuh/wazuh.git
# already have the repo? check out this version:$ git checkout v4.9.0
Adds alert_forwarding to ossec.conf for Manager to forward alerts to Fluentd
Adds Amazon Security Hub integration via AWS SQS in the Agent
Adds journald input support in Logcollector (Agent)
Adds HAProxy helper script to manage load balancer configuration and automatically balance agents
Merges group file endpoints into a single endpoint (GET /groups/{group_id}/files/{filename}) with raw parameter
+1 moreshow less
Removes the cache configuration option from the Wazuh API
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The cache configuration option is removed from the Wazuh API config, requiring removal if previously set
!Group file endpoints are merged; the previous individual endpoint paths for each group file no longer exist (now handled by GET /groups/{group_id}/files/{filename})
Sekoia extension for Palo Alto XSOAR is now available in the marketplace
Adds Sekoia Defend (XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss.) content pack to Palo Alto XSOAR for retrieving assets, collecting alerts, and querying events
1 detail in Everything
2 more releases in this issue
· 2024-09-17 → 2024-09-24
Adds five new netskope.*DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. fields to the Netskope integration intake.
Adds netskope.dlp.action field to capture the action taken on a DLP incident
Adds netskope.dlp.forensic_id field for forensic identifier mapping
Adds netskope.dlp.policy field indicating the policy that triggered the DLP incident
Adds netskope.dlp.profile_name field to store the DLP profile name
Adds netskope.dlp.rules field to list rules that triggered the DLP incident
MISP v2.4.198 adds the dom-hash attribute type for fingerprinting and correlating HTML DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. structure across phishing pages.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.198 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.4.198
└──▷ HOW TO FIND IT
Tag a phishing-page event with its DOM fingerprint so analysts can correlate structurally identical pages across MISP instances.
📍In the event view, click Add Attribute, set Type to dom-hash, and paste the 32-character SHA-256 DOM fingerprint (e.g. from LookyLoo) as the value.
└──▷ BREAKING ON UPGRADE
!The external_baseurl setting is no longer the preferred base URL source; MISP.baseurl is now preferred, and external_baseurl is intended to be informational only for sharing groups.
1 more release in this issue
· 2024-09-02 → 2024-09-16
MISP v2.4.197 adds org UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. response headers, bookmark comments, and improved STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. dependency visibility.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.197 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.4.197
New user_org_uuid_in_response_header config option includes the requesting user's organization UUID in API response headers.
Bookmarks now support comments, visible in the bookmark index, dropdown menu titles, and add/edit views.
Displays required STIX dependency versions during the build process.
MSTICPy v2.13.0 adds an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-powered document Q&A agent via Autogen/RAGRAGRetrieval-augmented generation: looking up relevant documents and adding them to the prompt before the model answers. It grounds responses in private or current data without retraining. and a new BinaryEdge threat-intel provider.
└──▷ GET THIS VERSION
$ git clone --branch v2.13.0 https://github.com/microsoft/msticpy.git
# already have the repo? check out this version:$ git checkout v2.13.0
└──▷ USE IT
Ask natural-language questions about MSTICPy from a notebook — useful when onboarding or exploring unfamiliar query provider configuration.
python
%load_ext msticpy.aiagents.mp_docs_rag_magic
%%ask
What are the three things that I need to connect to Azure Query Provider?
Adds an LLM/RAG-based document Q&A agent (msticpy.aiagents.mp_docs_rag_magic) powered by Autogen, enabling natural-language queries against MSTICPy documentation inside notebooks.
Adds a new Threat Intelligence provider for BinaryEdge, expanding TI lookup coverage.
Lookyloo v1.26.0 adds capture categorization, API retrieval by UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide., per-script control, and CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. headers.
└──▷ GET THIS VERSION
$ git clone --branch v1.26.0 https://github.com/Lookyloo/lookyloo.git
# already have the repo? check out this version:$ git checkout v1.26.0
└──▷ TRY IT
Remove a specific capture from Lookyloo using its UUID.
Access a specific capture directly via its UUID in the browser or API.
📍https://lookyloo.example.com/capture/<uuid>
Adds categories feature to organize captures
Adds GET /api/v1/captures/category/<category> endpoint to retrieve UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. by category
Adds API capability to fetch a single capture via its UUID
Adds controller buttons to Start/Stop individual scripts per capture
OpenCTI 6.3.4 adds logout_remoteOpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. option and Microsoft ADFS SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support.
└──▷ GET THIS VERSION
$ git clone --branch 6.3.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.3.4
Adds logout_remote value to the OpenID connect configuration options for remote logout handling
Enables Microsoft ADFS as an OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. provider, extracting user claims from the id_token
2 details in Everything
1 more release in this issue
· 2024-09-17 → 2024-09-29
OpenCTI 6.3 introduces bulk creation, custom mandatory field bypass, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching./KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. vulnerability support, Splunk app, and retention rules.
└──▷ GET THIS VERSION
$ git clone --branch 6.3.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.3.0
└──▷ HOW TO FIND IT
Install the new Splunk integration to ingest indicators and trigger actions.
📍Install the OpenCTI Add-on for Splunk from Splunkbase: https://splunkbase.splunk.com/app/7485
Use the new EPSS enrichment connector to populate vulnerability data.
📍Deploy the EPSS enrichment connector which integrates with the FIRST API to retrieve values for specific vulnerabilities.
Adds a new Splunk App to seamlessly ingest indicators via OpenCTI live stream and trigger actions
Adds dedicated RabbitMQ queues for playbooks, synchronizers, and CSV Mapper import instead of shared queues
Adds bulk creation of entities by copy-pasting a list directly into the platform
Adds bulk creation of relations even for entities that do not yet exist in the platform
Allows connectors to bypass custom mandatory attributes by default via role configuration
+9 moreshow less
Extends the Vulnerability model to support EPSS and CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. attributes
Enables use of EPSS and CISA KEV fields in playbook components for vulnerability decision trees
Adds configurable retention rules for Files and Workbenches to automatically delete outdated data
Adds a new tab in the dashboard menu to view public dashboards as a list without entering each one
Adds list views for Threat Actors, Intrusion Sets, Campaigns, and Malware alongside card views
Adds massive operations to Arsenal entities (Malware, Channels, Tools, Vulnerability), Narratives, and Attack Patterns
Introduces new data tables with proper pagination, column resizing, and click-to-filter on column titles
Adds an enrichment connector for EPSS values by integrating with the FIRST API
Delivers new connectors: Jira, Infoblox, Cisco SMA, Group IB, and Cofense
14 details in Everything
└──▷ BREAKING ON UPGRADE
!The RabbitMQ queues push_sync, listen_sync, listen_playbook and push_playbook are deprecated and will be removed in version 6.6
Trend Vision One extends its Endpoint Security agent to cover ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.-based Graviton 2 instances running SLES 15, enabling deployment of Server & Workload Protection.
New platform support for Server & Workload Protection and Endpoint Sensor on SUSE Linux Enterprise Server 15 (AWS ARM-based Graviton 2)
1 detail in Everything
15 more releases in this issue
· 2024-09-02 → 2024-09-30
Trend Vision One Container Security adds CIS KubernetesCIS KubernetesHardening benchmarks published by the Center for Internet Security for Kubernetes clusters, giving cyber tools a concrete, versioned checklist of configuration checks to run and report against. benchmark compliance scanning.
Trend Vision One adds agentless malware scanning for AWS EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives., ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure., and Lambda resources
Trend Vision One now supports deploying Endpoint Security agents on Windows 11 ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. endpoints
Granular parameters for risk event rules in Threat and Exposure Management allow IP, app, rule, or day conditions.
Adds the ability to set specific parameters (IP addresses, apps, rules, days of the week) as conditions for triggering risk event rules in Threat and Exposure Management
Enables more granular control over when a risk event rule is applied by allowing multiple conditional criteria
Lynis 3.1.2 adds macOS FileVaultFileVaultApple's full-disk encryption feature built into macOS, using XTS-AES-128 to encrypt the startup volume so that data is unreadable without the user's credentials. encryption test, Wazuh integration, and seven new OS detections.
└──▷ GET THIS VERSION
$ git clone --branch 3.1.2 https://github.com/CISOfy/lynis.git
# already have the repo? check out this version:$ git checkout 3.1.2
└──▷ TRY IT
Run a full audit on a macOS host to exercise the new FileVault encryption check (CRYP-7932) and macOS app inventory (PKGS-7305).
$ sudo lynis audit system
Detects seven new Linux/OS platforms: ALT Linux, Athena OS, Container-Optimized OS (Google), Koozali SME Server, Nobara Linux, OSMC, and PostmarketOS.
New test CRYP-7932 checks macOS FileVault full-disk encryption status.
New test FILE-6398 checks whether the JBD (Journal Block Device) kernel driver is loaded.
New test FINT-4344 checks whether the Wazuh agent is running.
New test PKGS-7305 queries macOS applications in /Applications and CoreServices.
+8 moreshow less
Adds Wazuh as a recognized malware scanner, antivirus, and rootkit detection tool (MALW/LOGG checks).
Adds ESET Endpoint Antivirus detection to MALW-3200.
Adds Microsoft Defender Antivirus detection to MALW-3291.
Adds version numbers to Homebrew package output in PKGS-7303.
Extends Slackware support with installed-package querying via functionPackageIsInstalled().
Adds prosecute and report to LEGAL_BANNER_STRINGS for legal banner checks.
Adds inetd package and service name for Ubuntu 24.04 to INSE-8000.
Extends CONT-8104 to detect errors (not only warnings) in docker info output.
Sigma r2024-09-02 adds 74 new detection rules spanning macOS, Linux, GitHub audit logs, RATs, ransomware loaders, and CVE-specific exploits.
└──▷ GET THIS VERSION
$ git clone --branch r2024-09-02 https://github.com/SigmaHQ/sigma.git
# already have the repo? check out this version:$ git checkout r2024-09-02
Adds detections for access to Chromium browser sensitive files, crypto currency wallets, and Microsoft Teams sensitive files by uncommon applications.
Adds macOS-specific rules for disk image creation/mounting via Hdiutil, hiding files via Chflags, and clipboard data collection via Pbpaste.
Adds Linux shell invocation rules covering Capsh, AWK, SSH, Env, GCC, Find, Flock, Git, Nice, and Rsync as shell-spawning vectors.
Adds GitHub audit log detections for forking private repositories, repository/organization transfers, SSH certificate configuration changes, and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone./risk policy updates.
Adds detections for Raspberry Robin (initial execution from external drive, subsequent commands, AcluI DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. sideloading, registry ZoneMap manipulation).
Adds detection for WSUSWSUSWindows Server Update Services, a Microsoft service that lets administrators centrally manage and distribute Windows and software updates to machines on a network instead of each host pulling from the internet. abuse via HackTool SharpWSUS/WSUSpendu execution.
Adds detection for SOAPHound Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. data collection tool execution.
Adds detection for KerberoastingKerberoastingAn attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access. initial LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. query activity.
Adds four rules detecting defense evasion via emoji characters in command lines.
Adds detection for obfuscated PowerShell one-liner execution and potential Unicode character obfuscation from suspicious images.
Adds detection for inline Python spawning a shell via the OS system library.
Adds detection for MSSQL data export via BCP.EXE, potential file override via SET command, and data export scenarios.
Adds detection for Multi-Factor Authentication disabled for user accounts and User Risk/MFA registration policy updates.
Adds detection for headless processes launched via Conhost.EXE and PowerShell executed from a headless ConHost process.
Adds detection for suspicious process masquerading as SvcHost.EXE and processes launched without an image name.
Adds detection for Python function execution security warning disabled in Excel (process and registry variants).
Adds detection for potential BOINC software execution and renamed BOINC client execution (living-off-trusted-apps abuse vector).
Adds detection for Unattend.XML file access attempts and uncommon connections to Active Directory Web Services.
Adds detection for Task Scheduler DLL loaded by applications in potentially suspicious locations.
Adds detection for hiding user accounts via the SpecialAccounts registry key from the command line.
Adds detection for manual execution of scripts inside compressed files and OneNote malicious embedded script execution.
Expands file-sharing domain coverage across BITS, curl, wget, certutil, PowerShell, Bitsadmin, and network connection rules with *.trycloudflare.com, *.pages.dev, *.w3spaces.com, and *.workers.dev.
Expands GitHub high-risk configuration detection to include GitHub Advanced Security business- and org-level disable events.
Expands Active Directory LDAP reconnaissance detection to cover enumeration of distinguished names.
pySigma v0.11.14 adds log source conditions for correlation rules and a new RuleContainsFieldCondition check.
└──▷ GET THIS VERSION
$ git clone --branch v0.11.14 https://github.com/sigmahq/pysigma.git
# already have the repo? check out this version:$ git checkout v0.11.14
└──▷ USE IT
Gate a pipeline transformation on whether the rule contains a specific field — useful when a backend should only apply a mapping when that field is actually present.
python
from sigma.processing.conditions import RuleContainsFieldCondition
condition = RuleContainsFieldCondition(field="CommandLine")
# Returns True when the active rule references the 'CommandLine' field
if condition.match(pipeline_context, rule):
apply_commandline_mapping()
Adds RuleContainsFieldCondition (surfaced as contains_field) to test whether a rule references a specific field, enabling backend authors to gate transformations on field presence.
Implements log source condition support for Sigma correlation rules, allowing correlation rule processing to filter on log source attributes.
2 details in Everything
2 more releases in this issue
· 2024-09-02 → 2024-09-13
$ git clone --branch v0.11.12 https://github.com/sigmahq/pysigma.git
# already have the repo? check out this version:$ git checkout v0.11.12
Supports nested processing pipelines, allowing pipelines to be composed from other pipelines.
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!The ReplaceStringTransformation / replace_string now restricts replacements to plain SigmaString parts; pipelines relying on non-plain-string replacements will break (note: this restriction is reverted in v0.11.13, so upgrading beyond v0.11.12 is strongly recommended).
Beelzebub v3.2.5 adds support for handling SSH inline commands in its honeypot service.
└──▷ GET THIS VERSION
$ git clone --branch v3.2.5 https://github.com/mariocandela/beelzebub.git
# already have the repo? check out this version:$ git checkout v3.2.5
Supports SSH inline command handling, enabling the honeypot to capture and respond to commands passed directly via SSH (e.g., ssh user@host <command>) rather than only interactive sessions.
ValleyRAT analytic story lands with 6 new detections covering C2 config, registry abuse, UAC bypass, and task scheduler DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. loading.
└──▷ GET THIS VERSION
$ git clone --branch v4.41.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v4.41.0
New ValleyRAT Analytic Story bundles detections for C2 configuration, registry manipulation, privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., and defense impairment on Windows.
New detection: Windows Impair Defenses Disable AV AutoStart via Registry — catches antivirus auto-start being disabled through registry modifications.
New detection: Windows Modify Registry Utilize ProgIDs — identifies suspicious use of ProgIDs via registry changes.
New detection: Windows Modify Registry ValleyRAT C2 Config — surfaces ValleyRAT command-and-control configuration written to the registry.
New detection: Windows Modify Registry ValleyRat PWN Reg Entry — detects ValleyRAT-specific registry entries associated with privilege abuse.
+3 moreshow less
New detection: Windows Schedule Task DLL Module Loaded — flags DLL modules loaded through scheduled task activity.
New detection: Windows Schedule Tasks for CompMgmtLauncher or Eventvwr — detects UAC bypass attempts via scheduled tasks targeting CompMgmtLauncher or Eventvwr.
Updated detections for Add or Set Windows Defender Exclusion, FodHelper UAC Bypass, Eventvwr UAC Bypass, CMLUA/CMSTPLUA UAC Bypass, and related endpoint analytics now include ValleyRAT coverage.
8 details in Everything
1 more release in this issue
· 2024-09-11 → 2024-09-26
Splunk Security Content v4.40.0 adds 52 new detections including 50 Linux Auditd rules and 2 PowerShell Web Access detections, plus 3 new analytic stories.
└──▷ GET THIS VERSION
$ git clone --branch v4.40.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v4.40.0
Adds 50 new Linux Auditd detections covering unauthorized account creation, kernel module manipulation, privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., data destruction, credential access, and suspicious service stoppages under the new Compromised Linux Host analytic story.
Adds 2 new detections for PowerShell Web Access installation and enablement (Windows DISM Install PowerShell Web Access; Windows Enable PowerShell Web Access) tied to CISA AA24-241A Iran-based threat actor activity.
Introduces BlackSuit Ransomware analytic story tagging existing analytics to TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. associated with Black Suit ransomware for targeted ransomware threat detection.
Introduces CISA AA24-241A analytic story aligning detections with the joint advisory on Iran-based cyber actors exploiting U.S. and foreign organizations.
Introduces Compromised Linux Host analytic story grouping the 50 new Linux Auditd detections for streamlined investigation workflows.
+1 moreshow less
Updates 72 existing analytics across cloud, endpoint, network, and web categories.
Cribl Stream 4.8.2 adds NetFlow v9 source/destination, CrowdStrike Falcon Next-Gen SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. destination, and various source/destination enhancements.
Adds NetFlow v9 Source for collecting NetFlow records over UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery.
Adds NetFlow Destination to route unmodified NetFlow v5/v9 data
Enables period and underscore separators in OTLP Metrics Function prefixes
Adds dynamic Site name setting via JavaScript in the Exabeam Destination
Extends Retry Connection Timeout and Retry Connection Reset options to Office 365 Message Trace, Office 365 Services, Wiz, and REST Collector sources
+7 moreshow less
Enables secrets store support in the Splunk HEC Source for authentication tokens
Adds Azure service principal authentication for Azure Blob Source, Collector, and Destination
Adds Authentication URL and audience customization in the Wiz Source
Enables random partition assignment for Kafka, Confluent Cloud, Amazon MSK, and Azure Event Hubs Sources
Adds character encoding configuration (UTF-16LE, Latin-1) for Splunk Search Source and multiple Collectors
Enables IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles authentication for Google Cloud Pub/Sub Source and Google Cloud Storage Collector Source
Adds Dammam region (me-central2) support to the Exabeam Destination
NodeZero adds Tripwires GA, hybrid-joined Azure pivot attacks, and K8s/S3 token discovery to the pentest engine.
Tripwires are now Generally Available, with support for AWS credential file, MySQL Dump file, and Windows Suspicious Process Monitor types
Pentest configuration page now includes an opt-in toggle to drop tripwires during execution
New Tripwires Management page allows viewing and managing dropped tripwires alongside pentest results
Tripwire alerts can be integrated with Splunk Cloud via configurable webhooks for event ingestion
Team members can now be granted access to the Tripwires feature through User Management
+7 moreshow less
Main pentest page includes a 1CV badge and tooltip to identify 1-Click Verify pentests
Pentest summary page adds a summary table showing status and associated tests for 1CV pentests
Rapid Response tests support enhanced tagging and filtering options for faster retrieval
Weaknesses CSV export now includes Impact, Mitigations, and References columns
Hybrid-Joined Intune Device Exploitation allows pivoting from Azure to on-premise RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. on Windows, MacOS, and Linux devices using interactsh
Kubernetes Service Account token discovery now scans SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments., NFS, and S3 file shares for exposed tokens
AWS Cognito exploit content expanded to target unauthenticated roles assigned IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permissions
Stratus Red Team v2.17.0 adds Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. attack techniques and a new AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. login profile attack.
└──▷ GET THIS VERSION
$ git clone --branch v2.17.0 https://github.com/datadog/stratus-red-team.git
# already have the repo? check out this version:$ git checkout v2.17.0
└──▷ TRY IT
Detonate the new AWS IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. login profile update technique to simulate an attacker gaining console access by overwriting a victim user's password.
Adds Microsoft Entra ID attack techniques, expanding adversary simulation coverage to Azure identity infrastructure.
New AWS attack technique: Update IAM user login profile (aws.credential-access.update-iam-user-login-profile), simulating credential takeover via console access manipulation.
SploitScan v0.11.0 adds per-method selection and auto-detection of plain-text CVE import lists.
└──▷ GET THIS VERSION
$ git clone --branch v.0.11.0 https://github.com/xaitax/SploitScan.git
# already have the repo? check out this version:$ git checkout v.0.11.0
└──▷ TRY IT
Pull only EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scores and CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. status for a CVE — useful when you want a quick triage signal without waiting for AI or HackerOne lookups.
$ sploitscan -m epss cisa CVE-2024-1234
Feed a plain-text file of CVE IDs (one per line) directly into SploitScan without specifying a type — handy for quick bulk triage from exported scanner output.
$ sploitscan -i cve_list.txt
New -m argument lets practitioners selectively run specific data-source methods (e.g., cisa, epss, hackerone, ai, prio, references) per CVE lookup.
Import list auto-detection: -i now automatically recognises plain-text CVE list files without requiring the -t type flag.
2 details in Everything
1 more release in this issue
· 2024-09-01 → 2024-09-05
sploitscan 0.11.0 adds selective method execution via -m and auto-detection for CVE import lists
└──▷ GET THIS VERSION
$ git clone --branch 0.11.0 https://github.com/xaitax/SploitScan.git
# already have the repo? check out this version:$ git checkout 0.11.0
└──▷ USE IT
Run only EPA EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. and HackerOne data for specific CVEs to skip slower AI or reference lookups
shell
sploitscan -i cves.txt -m epss,hackerone
Adds the -m flag to specify methods like cisa, epss, hackerone, ai, prio, or references for granular data source control
Tenable One introduces Tenable Inventory with asset classes, dynamic tagging, NLP search, and dual-score views
Adds Tenable Inventory application for viewing Assets, Tags, and Weaknesses.
Introduces asset classes and new asset properties to expand inventory data model.
Enables creation of static and dynamic tags leveraging new asset properties.
Adds Weakness Inventory view to inspect Misconfigurations and CVEs.
Provides Advanced Search with natural language processing (NLP) and a new query builder using asset classes.
+4 moreshow less
Introduces editable Tenable Queries and Bookmarks for saving queries.
Enhances Asset Details with new data fields, related attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., exposure cards, and relationships.
Adds Asset Explainability to summarize high-level asset and risk information.
Releases dual score versions (Score & Score (Beta)) in Tenable Inventory and Lumin Exposure View.
9 details in Everything
6 more releases in this issue
· 2024-09-02 → 2024-09-30
Tenable One OT Exposure 3.19.70 SP adds Compliance dashboard and new API types/fields for asset aggregation
Compliance dashboard enables alignment of security measures with regulatory requirements (CAF Principles, OTCC Sub Domains, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001 Controls, NIS 2 Directive) to track progress over time.
Phoenix Contact ILC Snapshots support for FOX TLS, including Audit Log tracking changes to FOX TLS configuration.
New API types and fields added: AggregationsAssetsExpressionsParams, AssetMapTimeFrame, eventAggregationsAssetsRaw, and pluginHits field on Query object.
Tenable One Attack Path adds sorting on choke points, origin support for history/queries, and product dropdown filters.
choke point column in weaknesses is now sortable to prioritize critical bottlenecks.
origin field added to history records and Tenable queries for tracking attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately.provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build..
Filter dropdown now lists all Tenable products directly instead of requiring free-text input.
Navigation and UI of the Attack Path dashboard's matrix have been adjusted.
Adds AI/LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. monitoring via AI Inventory button on Findings workbench, custom dashboard, and three new reports.
Adds AI Inventory button to Findings workbench tabs for filtering AI-related informational findings
Adds new AI Inventory section on AI/LLM finding detail pages
Adds new AI/LLM Dashboard accessible via Template Library for viewing top AI browser extensions and applications
Adds three new reports in the Reports section focused on AI/LLM-related findings
Edgescan adds vulnerability tagging, PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. report formatting fixes, and improved asset/license management logic
Adds the ability to tag vulnerabilities for better organization and filtering.
Allows users to accept or reject license upgrade suggestions from the interface.
Enables setting organizational default as the pause schedule value when creating an asset.
3 details in Everything
1 more release in this issue
· 2024-09-03 → 2024-09-18
Edgescan adds immediate overdue assessment triggering and EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. domain visibility controls in Sept release.
Adds optional start assessment tasks for PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. frequency control
Allows overdue assessments to kick off immediately or be scheduled via new asset blocker workflows
Improve ability to indicate new domains in subsequent scans within EASM
DefectDojo 2.38.3 adds Qualys Hacker Guardian and KrakenD audit parsers, HackerOne Bug Bounty support, and risk exception audit notes.
└──▷ GET THIS VERSION
$ git clone --branch 2.38.3 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.38.3
New Qualys Hacker Guardian parser for ingesting Hacker Guardian scan results.
New KrakenD audit parser for ingesting KrakenD audit findings.
Adds support for HackerOne Bug Bounty Program reports in the HackerOne parser.
Risk Exceptions: automatically adds/removes audit notes on a finding when it is added to or removed from a risk exception.
User accounts now require email at all times and a password for new users.
+2 moreshow less
Lists global role members in Product and Product Type member views.
Adds Swagger documentation for API models that support prefetching.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!User email is now required at all times and password is required for new users — API calls or integrations that create users without these fields will fail.
DefectDojo 2.38.2 adds a Wiz SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. parser, Invicti/Netsparker parser support, and less verbose JSON parsing errors.
└──▷ GET THIS VERSION
$ git clone --branch 2.38.2 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.38.2
Adds Wiz SCA (Software Composition Analysis) parser, plus support for the legacy Fortify format in the Wiz parser.
Adds support for the Invicti scanner via the existing Netsparker parser.
Makes JSON parsing errors less verbose in the API, reducing noise in error responses.
DefectDojo 2.38.1 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scores for Aqua parser, two new parsers (Threat Composer & Legitify), and a dynamic parsing flag for new test types.
└──▷ GET THIS VERSION
$ git clone --branch 2.38.1 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.38.1
Adds EPSS score support to the Aqua parser.
New parser: Threat Composer.
New parser: Legitify.
Adds a flag on test types to indicate dynamically parsed test types, exposed via the API and database.
Makes Product Type clickable in the Product detail UI.
Artemis v3.3.0 adds SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. and SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. port detection modules plus dark mode UI
└──▷ GET THIS VERSION
$ git clone --branch v3.3.0 https://github.com/CERT-Polska/Artemis.git
# already have the repo? check out this version:$ git checkout v3.3.0
Adds error-based and time-based SQL injection check capabilities as new scanning modules
Adds detection and reporting for exposed SMB ports
OSV-Scanner v1.8.5 adds Maven snapshot support, composite package overrides, and FIXED-VULN-IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. in guided remediation output
└──▷ GET THIS VERSION
$ git clone --branch v1.8.5 https://github.com/google/osv-scanner.git
# already have the repo? check out this version:$ git checkout v1.8.5
Support for composite-based package overrides allows ignoring entire manifests when scanning
Adds FIXED-VULN-IDS field to guided remediation non-interactive output
runZero 4.0.240926 adds CUPS (IPP) Browser protocol probe on UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery./631 and improves console error display for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. processes.
runZero 4.0 adds Oracle Solaris Service Tag discovery and OS CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. inventory display.
runZero 4.0.240917.1 adds MECM integration, ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. Linux support, and CrowdStrike relative timestamp queries.
Self-hosted platform now supports ARM64 (aarch64) on Linux
CrowdStrike integration supports querying device last seen fields as relative timestamps
runZero 4.0.240904 adds ATG asset identification and RFC 1918RFC 1918IETF standard that reserves three IPv4 address ranges (10.x, 172.16–31.x, 192.168.x) for private networks, never routed on the public internet, giving tools a reliable way to identify internal traffic. scan options to reports page.
Automatic Tank Gauge protocol support for asset identification
RFC 1918 scan options accessible from the RFC 1918 reports page
Fleet 4.57.0 adds policy-driven auto-installs, BYODBYODBring Your Own Device: a policy allowing employees to use personal phones, laptops, or tablets for work, creating a network of unmanaged endpoints that cyber tools must monitor or enforce policy on.MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. enrollment, OTA iOS/iPadOS enrollment, and package uninstall via Fleet.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.57.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.57.0
└──▷ TRY IT
Poll the result of an async software batch upload after submitting packages via the API.
Adds automatic installation of software on hosts that fail policies.
Adds ability to uninstall packages from hosts via Fleet.
Adds BYOD device enrollment into Fleet MDM for end users.
Adds OTA MDM enrollment endpoint and protocol support for iOS and iPadOS hosts, with automatic team assignment.
Adds support for configuring policy installers via GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control..
+8 moreshow less
Adds support for policies scoped to No team hosts, with All teams and No team reserved as team names.
Adds software status filter for No teams on the hosts page.
Adds in-place editing of software installer packages, self-service flag, scripts, pre-install query, and self-service availability (no longer requires delete and re-add).
Adds automatic reset of install counts and cancellation of pending installs/uninstalls when GitOps installer updates change package contents.
Makes POST /api/latest/fleet/software/batch asynchronous and adds GET /api/latest/fleet/software/batch/{request_uuid} endpoint to poll batch upload results.
Adds validation of Setup Assistant profiles on upload.
Adds validation to prevent installing software on a host with a pending installation.
Allows custom SCEPSCEPSimple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention. CA certificates with any extendedKeyUsage attributes.
13 details in Everything
2 more releases in this issue
· 2024-09-05 → 2024-09-23
Fleet 4.56.0 adds multi-VPP/ABM token support, ALAS vulnerability scanning, S3 bootstrap package storage, and new software filtering APIs.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.56.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.56.0
└──▷ TRY IT
Filter software titles by exploitability and CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. score range to prioritize patching the riskiest, actively-exploited packages across your fleet.
Check whether a specific CVE is known to Fleet but not yet present on any enrolled host — useful for verifying scan coverage without a false not found result.
Adds server support for multiple VPP tokens, including the ability to assign multiple teams to the same VPP token.
Adds new ABM page and VPP page to the Fleet UI, consolidating Automatic Enrollment and VPP settings under the MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. settings integration page.
Adds new and updated endpoints for managing multiple Apple Business Manager tokens, including per-token tracking of terms expired API errors.
Adds support for S3 to store MDM bootstrap packages (using the same bucket configuration as software installers).
Adds self-service VPP software support in the UI, backend, and gitops.
+10 moreshow less
Adds MDM migration support for hosts manually enrolled in a third-party MDM, plus an offline screen for the macOS MDM migration flow.
Enforces minimum OS version settings during Apple Automated Device Enrollment (ADE).
Adds ALAS bulletins as a vulnerability source for Amazon Linux 1, 2, 2022, and 2023 (replacing OVAL for Amazon Linux 2).
Adds exploit, min_cvss_score, and max_cvss_score filter parameters to the /software/titles and /software/versions API endpoints.
Updates GET /api/v1/fleet/vulnerabilities/{cve} to validate CVE format and return 204 when a known CVE is not present on any hosts.
Adds new UI empty states for vulnerability search results: invalid CVE format, known CVE not on hosts, unknown CVE, exploited vulnerability, and operating systems.
Adds support for Fleet server to accept arguments via stdin, enabling safer secret injection without exposing values in env vars, CLI args, or config files.
Adds support for MySQL 8.4.2 LTS.
Improves live query performance to accommodate higher volumes in zero-trust workflows.
Adds matching rules for July and August Microsoft 365 security updates.
Sophos Mobile 2024.36 adds new iOS and Android restrictions and account-driven Apple User Enrollment.
└──▷ HOW TO FIND IT
Configure iOS policies to restrict AI features like Genmoji and Writing Tools.
📍In the Sophos Mobile Central console, create a new iOS device policy. Under Restrictions, locate the Apple Intelligence section and uncheck Allow Genmoji, Allow Image Wand, and Allow Writing Tools.
Prevent Android users from sharing work-profile Wi-Fi connections with personal apps.
📍In the Sophos Mobile Central console, edit your Android Enterprise policy. Navigate to Restrictions › Wi-Fi and check Allow sharing of managed Wi-Fi connections (default is unchecked) to explicitly permit or deny this action.
Set up account-driven Apple User Enrollment for user-owned devices.
📍In the Sophos Mobile Central console, go to Enrollments › Apple. Select Account-driven as the enrollment method. Ensure target devices run iOS/iPadOS 15 or later, as profile-based enrollment is reserved for iOS/iPadOS 17 and earlier.
Adds Allow app installation from a website, Allow iPhone mirroring on Macs, and other new iOS restriction options to device policies, including controls for Genmoji, Image Wand, Writing Tools, and eSIMeSIMA programmable SIM embedded directly in a device's hardware, standardized by the GSMA, allowing carrier profiles to be provisioned or switched remotely without swapping a physical card. transfer.
Adds Allow sharing of managed Wi-Fi connections restriction to Android EnterpriseAndroid EnterpriseA Google program that gives organizations APIs and management modes to enroll, configure, and enforce policy on Android devices through an EMM platform. and work profile policies, blocking users from sharing Wi-Fi configs set by Sophos Mobile.
Enables account-driven Apple User Enrollment for iPhones and iPads, streamlining device ownership setup via the Settings app on iOS/iPadOS 15+.
GFI LanGuard v12.11 adds WAN scanning/patching and enforces HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. for Call Home.
Introduced scan and patch over WAN functionality within GFI LanGuard.
Updated all call home features to use HTTPS instead of the default insecure HTTP port, enhancing system security.
GFI LanGuard 12.11 enables remote WAN operations and secures outbound telemetry with HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate..
Introduces scan and patch over WAN functionality within GFI LanGuard
Updates all call home features to use HTTPS instead of the default insecure HTTP port
1Password in the browser 8.10.46 adds Guided Setup for Individual/Family accounts, identity auto-save, and Open in Web menu option
Guided Setup is now available for Individual and Family accounts to help set up autofill, practice basics, import passwords, and access them everywhere
1Password can now offer to save identity information automatically
Added Open in Web to the More options ellipsis button dropdown
3 details in Everything
7 more releases in this issue20 more releases in this issue · 2024-09
1Password SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Manager adds app-specific team views, empty team filtering, and primary user source configuration.
Adds an Applications tab to the Teams page that lists apps used by a team and shows the proportion of users from that team in the Team share column.
Introduces a UI control to show or hide empty teams via Settings > Teams, with the Show empty teams option accessible through the main context menu (…)
Sets an automatic primary source for managed apps based on the hierarchy: Direct integration > Bulk import > Identity Provider > None, visible in the Overview tab's Sources section.
Adds SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. enforcement checking for SAML-enabled managed apps to determine if the Identity Provider is accepted as the primary source.
Beta release includes UI updates: new badge for item fields, improved messages for recovery code setup, localization improvements, and fix for password history visibility.
Adds a New badge for any new fields you might see when editing an item
1Password browser extension adds localization for the memorable password generator and improves passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. prompt behavior.
Adds localization support for the memorable password generator, allowing users to generate passwords in their preferred language
Improves localization across a number of supported languages using new translations from Crowdin
Changes passkey registration prompt behavior: now prompts to save a *new* passkey instead of updating an existing one when registering for a different user on the same site
sudo 1.9.16 adds denial messages, compact JSON logging, PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. output control, and a new IBM Directory Server schema.
└──▷ GET THIS VERSION
$ git clone --branch v1.9.16 https://github.com/sudo-project/sudo.git
# already have the repo? check out this version:$ git checkout v1.9.16
└──▷ TRY IT
Show a custom denial message to users blocked by sudoers policy, e.g. to point them to a ticketing system.
Adds cmddenial_message sudoers option to display custom text to users when a command is denied by the sudoers policy.
Adds json_compact value for the log_format sudoers option, enabling compact JSON output when logging to a file; existing json value aliased to json_pretty.
Adds pam_silent sudoers option, which can be negated (!pam_silent) to allow PAM authentication module output to reach the user.
Paths in Chdir_Spec and Chroot_Spec sudoers directives may now be double-quoted.
Sudo insults are now compiled in by default; enabled via --with-insults configure option or the insults sudoers option.
+3 moreshow less
Default sudoers file now enables secure_path by default and preserves EDITOR, VISUAL, and SUDO_EDITOR when running visudo; new --with-secure-path-value configure option sets the default value.
Includes a new sudoers schema for IBM Directory Server (IBM Tivoli Directory Server / IBM Security Directory Server / IBM Security Verify Directory).
Sudo now warns the user when the terminal device path cannot be determined, and uses the terminal device number directly in time stamp files.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!The existing json value for the log_format sudoers option is now aliased to json_pretty; in a future release json will alias to json_compact, changing default JSON log formatting for setups using log_format=json.
Stytch launches Fraud & Risk Prevention with intelligent rate limiting, a configurable rules engine (Allow/Challenge/Block), and ML-powered device detection via API.
Adds intelligent rate limiting driven by predictive analysis of device, user, and traffic sub-signals to detect unusual traffic volumes and adapt to new attacker profiles in real-time without restricting legitimate users.
Introduces a Security Rules Engine that allows programmatic configuration of Allow, Challenge, or Block verdicts via API or Dashboard for bespoke access rules.
Deploys an ML-powered device detection model that programmatically assesses the risk of new or spoofed browser types by comparing them against historical version data.
Provides a cloneable example app on GitHub demonstrating Adaptive MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. implementation using Stytch's Device Fingerprinting to enforce MFA only for unrecognized devices.
4 details in Everything
2 more releases in this issue
· 2024-09-06 → 2024-09-18
Adds Slack and HubSpot as OAuth providers with JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. provisioning and email verification capabilities
Adds support for Slack and HubSpot OAuth providers alongside Google and Microsoft
Introduces email_verification step to challenge users when OAuth providers do not guarantee verified emails
Enables JIT provisioning by OAuth tenant, allowing bypass of email verification for specific tenants
Stytch adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. Groups support and a new Admin Portal UI for managing SCIM connections
Adds scim_group_implicit_role_assignments field to SCIM Connection config to automate role assignment from IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. groups
Adds SCIM configuration and management interface in the Stytch Admin Portal for creating, deleting, and rotating tokens
Adds Salesforce as a supported OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. provider in Ory Kratos social sign-in.
Ory Keto adds a new gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. endpoint for bulk permission checks.
Adds a gRPC endpoint to verify multiple permissions in one request; the source links BatchCheckRequest documentation.
Adds oauth2.token_prefix config key in Ory Hydra OEL to customize token prefixes for OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. tokens.
Improved account linking interface logic in Ory Identities.
The account linking UI now filters identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. options based on login hints configuration.
Nudge Security is a SaaS security platform that discovers shadow IT assets, manages identity governance, and hardens security posture.
Nudge Security adds SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. spend discovery from mailbox invoices for shadow IT visibility.
Adds SaaS spend discovery by extracting billing data (frequency, amount, renewal date, cost center) from user invoice attachments in the last two years
Adds per-app inventory of invoice details including invoice ID, payment status, payee, and service description to uncover hidden costs
Enables SaaS spend forecasting with estimated annual budget tracking alongside 12-month historical spend and projected usage-based costs
3 details in Everything
1 more release in this issue
· 2024-09-12 → 2024-09-24
New SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. for Google Workspace and Microsoft 365 with Posture dashboard and remediation workflows
Adds SaaS security posture managementSaaS security posture managementSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. (SSPM) for Google Workspace and Microsoft 365 to detect misconfigurations, identity risks, and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally.-to-SaaS integration risks.
Introduces a new Posture dashboard to highlight top findings, riskiest users, and remediation activities.
Adds Findings view with resolution outcomes tracking via remediation workflows.
JumpCloud API now supports escaped pipe characters in $in and $nin filters.
API requests to endpoints like /systemusers can now include the pipe | character within search terms by escaping it with a backslash (\), allowing precise filtering for multi-word values like department names.
Adds PDF report download/email for API Protection Dashboard; adds Link Expiration Date action for Box SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. policies
Adds ability to download or email a PDF dashboard report from the API-enabled Protection > SAAS (NEXT GEN) > Dashboard page for storage apps
Adds Set Link Expiration Date restrict access policy action for Next Generation API Data Protection on Box
Adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. and Domain filters and widgets to the Netskope SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. dashboard.
Adds MITRE ATT&CK and Domain dashboard filters to the SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management Dashboard
Adds #Failed Findings by Domain and #Failed Findings by MITRE ATT&CK widgets to the SaaS Security Posture Management Dashboard
Adds MITRE ATT&CK and Domain columns to the Posture Findings widget in the SaaS Security Posture Management Dashboard
Netskope 119 adds Box/Webex/ServiceNow/Slack API protection, USB encryption detection, and new DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. file types.
General Availability (GA) of Next Generation API Data Protection for Box, Cisco Webex, ServiceNow, and Slack Enterprise
Support Automatic Classification of Files using Box Labels with the Apply Sensitivity Label policy action
General Availability (GA) of Microsoft Purview Information Protection Write Capability Action (Apply Sensitivity Label)
New Scan Content Type criteria for Ticketing Apps (Custom Objects, Default Objects) and Messaging Apps (Direct Message, Private Channel, Public Channel)
Ability to exclude Microsoft 365 SharePoint Sites by site name or site ID in NG API policies
+19 moreshow less
Export Inventory Data as CSV via new Export button on the Inventory page (max 500,000 rows)
New restrict access policy actions: Restrict Access to Owner’s Domain, Specific Domains, Specific Users, Revoke Access from Specific Users, Disable Print & Download, Restrict Sharing to View
Automatically optimize port ranges for Private Apps in Publishers UI
Authentication bypass support for specific URIs in NPA Browser Access
Multiple IDPs with Browser Access (up to 10 SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. accounts)
Enable/disable Private Access tunnel independently on Windows and macOS via Netskope Client
Transaction Events log Format 4 with 35 new fields in Identity, Device, Threat Protection, and Connection categories
Netskope URL Lookup API with rate limiting support
Separation of Custom Categories, URL Lists, and URL Lookup into distinct sections in Web profiles UI
API option to remove IP surrogate for IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications., GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation., and EPoT deployments via Forward Proxy Global Settings
Real-time device classification evaluation for non-decrypted traffic
40 additional file types supported in real-time policy activity constraints
HTTP/2 account compatibility with Remote Browser Isolation (automatic downgrade to HTTP1.1)
File Retention profile option for detected malware uploads to IaaS
Linux OS check rule in Device Classification for Traffic Steering
Migration of client log data from AWS S3 to Google Cloud Storage (GCS)
Block IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. non-web traffic on Windows devices via Netskope Client
New License Information and Renewal Notices page in the management console
Display of Resource Id on the 3rd Party Apps page for SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications.
24 details in Everything
└──▷ BREAKING ON UPGRADE
!Microsoft 365 SSPM instance configuration requires new permissions due to deprecation of Azure ACS onboarding; existing instances will stop monitoring if ACS is disabled and require re-granting access on the Configure App Access page.
Netskope DEM adds App Probe telemetry, Enterprise Station monitoring, new dashboards, and User Experience Score RCA.
Adds App Probe synthetic testing capability for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. application availability and performance monitoring
Enables monitoring of custom web-based applications beyond the 80,000+ predefined apps
Supports connectivity performance monitoring from corporate sites using the new Enterprise Station component
Introduces Sites Overview, Site Details, Path Performance, Applications Overview, and Application Details dashboards
Adds DEM User Experience Score RCA feature to identify root causes for degraded user experience scores (<=70)
Cyera introduces industry-specific classification LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. for unstructured document analysis.
Adds industry-specific classification via new LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. models that summarize and analyze unstructured documents through an industry-specific lens.
1 detail in Everything
1 more release in this issue
· 2024-09-05 → 2024-09-12
Adds data discovery and classification support for the Box SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. platform.
Adds support for scanning and classifying sensitive data stored within Box.
Bytebase 2.23 adds Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. sync, CockroachDB support, and project-level backup settings
└──▷ GET THIS VERSION
$ git clone --branch 2.23.0 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 2.23.0
Adds Entra ID (Azure AD) user and group synchronization via SCIM.
Adds native support for the CockroachDB database engine.
Adds project-level backup settings with auto-enable and skip error options.
Adds real-time syntax checking in the SQL Editor.
Adds ability to configure password restriction policies.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The Data Classification upload data format has changed from a list to a key-value map.
1 more release in this issue
· 2024-09-05 → 2024-09-19
Bytebase 2.22.3 adds one-click rollback for PostgreSQL DML changes and allows enabling backups after issue creation.
└──▷ GET THIS VERSION
$ git clone --branch 2.22.3 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 2.22.3
└──▷ HOW TO FIND IT
Revert a deployed PostgreSQL DML change by triggering the rollback action in the UI
📍In the Bytebase UI, open the PostgreSQL DML issue and click One-click rollback to reverse the data changes.
Enable DML backup for an existing issue that was created without it
📍Open the existing change issue in Bytebase, locate the backup settings section, and toggle the Enable Backup option.
Adds one-click rollback capability for PostgreSQL DML changes, allowing users to reverse data modifications directly from the change record.
Adds the ability to enable or disable the backup option for an issue even after it has been created, previously requiring this to be set before creation.
Adds streaming flow API mutations for real-time application trace uploads and analysis
createStreamUpload, generatePresignedPartUrls, finalizeStreamUpload, and refreshStreamUpload mutations added to support the new streaming flow capability
Clevis v21 adds experimental PKCS#11PKCS#11The standard programming interface software uses to ask an HSM, smart card or token to sign or decrypt with a key it holds. Supporting it lets a tool keep its keys in hardware. pin support for hardware token-based unlocking.
└──▷ GET THIS VERSION
$ git clone --branch v21 https://github.com/latchset/clevis.git
# already have the repo? check out this version:$ git checkout v21
Druva is a SaaS data protection platform that backs up enterprise workloads, endpoints, and SaaS applications and restores them after ransomware.
Druva adds column customization for Backup Records view and reveals deleted records via snapshot history
Backup Records UI now supports personalized, auto-saved column selection for the record view.
Added visibility into deleted records within Data Backup > Project > Backup Definition > Records > View Backup History, indicated by a blank New Value field.
2 details in Everything
4 more releases in this issue
· 2024-09-02 → 2024-09-28
New SharePoint, Teams, and Groups discovery reports with corresponding API endpoints
Adds m365SharePointSiteDiscoveryReport, m365TeamsDiscoveryReport, and m365GroupsDiscoveryReport API endpoints to retrieve details of configured SharePoint sites, Teams, and Groups respectively
Introduces SharePoint Site Discovery Report, Teams Discovery Report, and Groups Discovery Report in the Druva Cloud Platform Console UI
Druva adds File Level Restore for Azure VMs and a dedicated Registered Servers page for MS SQL Server
Adds File Level Restore capability to recover specific files and folders from Azure disk backups to a custom storage container.
Adds Protect > MS SQL > Registered Servers navigation path to list, register, and manage MS SQL servers, removing them from the File Server UI grouping.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The Manage Credentials option is removed from the Registered Server page (now on the MS-SQL Server page).
!Commands for activating a new Windows server and re-registering a Windows server have changed.
Kasten K10 7.0.8 adds User Profile page, dark mode, optional flags to k10_debug.sh, and SELinuxSELinuxA mandatory access control system built into the Linux kernel, maintained by the NSA and Red Hat, that enforces fine-grained policies restricting what processes can access, even if they run as root. level preservation on OpenShift.
└──▷ USE IT
Switch from deprecated per-value TLS cert/key Helm values to the recommended secrets.tlsSecret reference during upgrade.
yaml
secrets:
tlsSecret: kasten-tls-secret
Extends k10_debug.sh with optional flags (replacing positional arguments) and adds an option to collect metrics from the Prometheus server installed by Veeam Kasten.
Preserves the SELinuxLevel of the source namespace for the Kanister Pod during the Export phase on OpenShift clusters.
Adds a User Profile page and updates the main header with a new User Menu and a dark mode toggle; moves the guided tour launch into the new User Menu.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The Helm values secrets.apiTlsCrt and secrets.apiTlsKey are deprecated and will be removed in an upcoming release; migrate to secrets.tlsSecret (a secret of type kubernetes.io/tls) before that removal to avoid breakage.
An open-source command-line backup program that stores encrypted, deduplicated snapshots on local disks, SFTP servers, and object storage.
restic v0.17.1 adds --stuck-request-timeout, exit code 12 for bad passwords, JSON restore errors, and auto-cache cleanup.
└──▷ GET THIS VERSION
$ git clone --branch v0.17.1 https://github.com/restic/restic.git
# already have the repo? check out this version:$ git checkout v0.17.1
Adds --stuck-request-timeout option to customize the timeout for stuck backend requests, preventing spurious retry errors on large repositories.
Returns exit code 12 when the repository cannot be opened due to an incorrect password, enabling scripts to distinguish bad-password failures.
Automatically clears removed snapshots from the local cache on any host, not only the host where forget was run.
Includes files with incomplete metadata in snapshots rather than silently omitting them, with an updated warning message prefixed incomplete metadata for /path/to/file:.
DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds malware scanning, custom resource tags, GCP Storage support, and enhanced query predicates.
Adds malware scanning capability for file-based data stores (AWS S3, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware., Azure Storage/VM, GCP Storage) selectable in scan settings.
Adds the ability to add custom tags to DSPM-created resources during cloud account onboarding for grouping and billing.
Adds support for onboarding and scanning Google Cloud Platform (GCP) Cloud Storage buckets and managed folders.
Adds DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Engine filter to alert notifications and ignore alert filters.
Adds Azure App Services as a resource type for investigation and policy queries.
+5 moreshow less
Adds Action over Parent Resource and Access Level over Parent Resource predicates for querying parent data store permissions.
Adds Include In (⊆) operator for CVE severity values in investigation and policy queries.
Adds IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Users, Unmanaged Users, and External Users as resource types in investigation and custom policy queries.
Adds Like (%) and Not Like (! (%)) operators with wildcard support for string predicates.
Enables identification of external and internal cross-account/cross-organization access paths in investigations and custom policies.
10 details in Everything
30 more releases in this issue
· 2024-09-03 → 2024-09-30
ZIA adds Block No-SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. toggle, DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. watermarks, HTTP GET param inspection, Unicode phrase matching, SSN dict control, Slack file restore, and IR health checks.
Adds Block No Server Name Indication (SNI) toggle under Policies > SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection > Add SSL Inspection Rule to block traffic lacking SNI in Client Hello
Enables DLP watermarks for file sharing via the SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API, with removal of applied watermarks available as a remediation action on the Assets with Incidents page
Adds includeSsnNumbers and ssnNumbers attributes to cloud service API endpoints for editing predefined DLP Social Security Numbers (US) dictionaries
Enables inspection of HTTP GET Query Parameters for sensitive data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. detection via a new toggle on the DLP page
Enables Non-delimited Unicode phrase matching in the Add DLP Dictionary window, allowing matches against strings without delimiters
+3 moreshow less
Adds Restore option as a remediation action for quarantined Slack files on the SaaS Assets Report > Assets with Incidents page
Enables Zscaler Incident Receiver health check by default, producing <systmld>_<iphash>_ir_health_status_timestamp.json files in the evidence folder every 5 minutes
Increases limit for Zscaler Private Access application segments to 2,000 when configuring Source IP Anchoring in the ZIA Admin Portal
ZDX adds Wi-Fi name visibility controls and a new PSE Health Dashboard to the Admin Portal.
Adds Wi-Fi Name visibility toggle under Device and User Information permissions for ZDX roles and sharing snapshots
Adds ZIA Private Service Edge (PSE) Health Dashboard providing statistical overview of data center PSEs including traffic, latency, and transactions over 24 hours to 14 days
Updates ZDX Admin Portal UI design with new color palette and typography
ZDX Module 3.9 adds remote bandwidth testing, traceroute through proxies, and ZPA TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. probing.
Enables remote bandwidth testing via a Diagnostics session in ZDX
Supports traceroutes through external proxy
Enhances the Zscaler Private Access (ZPA) Cloud Path to support TCP and UDP protocols for probing from the client to the Zscaler Private Service Edge
Zscaler Client Connector adds Endpoint DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. notification support and Self Service diagnostic capabilities on macOS.
Adds support for sending ZIA DLP notifications via Endpoint DLP if Endpoint DLP is enabled
Adds Self Service to improve end user experience by diagnosing and providing recommendations to resolve issues due to high CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage and poor Wi-Fi connection
DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. 2024 upgrade introduces custom tagging for resources, new query operators (Like/Not Like) and predicates (Parent Resource), granular IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. filtering (Unmanaged/External Users), DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engine alert filters, and security hardening by gating scanner updates via private endpoints.
Adds Custom Tags capability to DSPM resources for grouping, billing, and security controls
Adds Malware Scanning for file-based data stores (S3, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware., Azure Storage, VM, GCP)
Adds new Data Posture Policies for AWS RDS/S3, Azure VM/Storage, and GCP Storage buckets
Adds DLP Engine filter to alert notifications and ignore filters
Adds Like (%), ! (%), and [!(%)] operators for wildcard string matching in queries
+4 moreshow less
Adds Action over Parent Resource and Access Level over Parent Resource predicates
Adds support for onboarding Azure App Services as a resource type in investigations
Adds Unmanaged Users and External Users IAM resource types for granular query filtering
ZIA adds language translation in isolation profiles and granular controls for AI/ML app actions.
Adds Language Translation in Isolation profile setting to enable Google Translate within isolated sessions via the isolation bar or right-click menu.
Extends granular action controls (Chatting, Downloading, Renaming, etc.) to Google Gemini, Microsoft Copilot, Perplexity, Poe, and Runway in the Add AI & ML Rule window.
ZIA adds DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. SSN dictionary control via API attributes, GET param inspection, Slack file restore, and Incident Receiver health check files.
Adds includeSsnNumbers and ssnNumbers attributes to the cloud service API for managing predefined DLP Social Security Numbers (US) dictionary matches
Enables DLP inspection on HTTP GET Query Parameters via the Inspect HTTP GET Query Parameters toggle in the DLP page UI
Adds a Restore remediation action for quarantined Slack files in the Incidents section of the SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Assets Report
Produces _ir_health_status_timestamp.json files in the evidence folder from the Incident Receiver health check feature
Zscaler Workflow Automation adds Closed event status and Filewatcher health alerts
Adds Closed as a new event status option on the Events page for tracking resolved issues.
Removes Customer ID prefix from Event ID field format for Business Insights events in Admin Portal.
Adds Close Event action to Actions drop-down menu on Event Details page for Business Insights events.
Enables running run-filewatcher.sh bash script in Azure DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. integration to install/upgrade Filewatcher container using Docker or Podman.
Adds health alert notification for Filewatcher on Notifications Center page when status is unhealthy.
ZIA adds Gen AI prompt configuration, a new Analytics page for Gen AI reports, and a Prompt filter in Web Insights Logs.
Adds the Gen AI Prompt Configuration section to the Policy > URL Filtering & Cloud App Control > Advanced Policy Settings page for enabling and categorizing prompts for ChatGPT, Google Gemini, Perplexity, Poe, and Meta AI
Adds a new Analytics > Gen AI Security Report page to monitor and view logs for generative AI usage
Adds the Insert XFF Header for SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspected Traffic field on the Advanced Settings page to control XFF header insertion for traffic forwarded from ZIA to Zscaler Private Access
Adds ZDX Snapshot feature to generate shareable view-only URLs for Incident details
ZDX Snapshot feature provides a URL that you can share with ZDX users for view-only access to an Incidents dashboard or specific Incident details page.
Zscaler Branch Connector adds Hyper-V deployment support and App Segments granularity to traffic forwarding rules
Adds support for deploying Zscaler Branch Connector on the Microsoft Hyper-V platform.
Adds App segments configuration option in Traffic Forwarding Rules to enable granular control by selecting specific application segments or segment groups.
ZIA adds Smartsheet tenant support, XFF header insertion for ZPA traffic, and remote access download controls in Malware Protection policy.
Adds Insert XFF Header for SSL Inspected Traffic field in Advanced Settings to insert XFF headers for traffic forwarded from ZIA to Zscaler Private Access (ZPA).
Adds Smartsheet tenant configuration support via the SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API.
Adds ability to allow or block downloads from remote access sites in Malware Protection policy.
Zscaler Workflow Automation adds privacy toggles for DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. incident fields and new filters on the Incidents page.
Adds Hide Evidence Data, Hide Trigger Data, and Hide Policy Details fields to DLP integration pages to control visibility for admins, end users, and managers/approvers.
Adds Department, Document Type, File Source Location, and Referrer URL filters to the Incidents page with multi-value support for specific fields.
Cloud & Branch Connector adds Azure VMSS support and Hyper-V branch deployment (2024-09-05)
Cloud Connector supports Virtual Machine Scale Sets (VMSS) deployment on Microsoft Azure, controlled via the Zscaler Admin Console where Auto Scaling now refers to VMSS.
ZIA adds granular action controls for ChatGPT, Webex, Slack, SharePoint, Teams, and LinkedIn in Cloud App Control.
Adds Chatting, Uploading, Downloading, Deleting, Sharing, and Inviting actions for the ChatGPT application in Cloud App Control AI & ML Rules
Adds Sharing, Editing, Creating, Downloading, Chatting, Uploading, Inviting, and Meeting actions for Webex Meetings in Cloud App Control Collaboration Rules
Adds Editing, Creating, Downloading, Deleting, Chatting, Uploading, Inviting, and Huddle actions for Slack in Cloud App Control Collaboration Rules
Adds Sharing, Editing, Renaming, Creating, Downloading, Deleting, and Uploading actions for SharePoint Online in Cloud App Control Collaboration Rules
Adds Chatting and Screen Sharing actions for Microsoft Teams in Cloud App Control Collaboration Rules
+1 moreshow less
Adds Posting, Chatting, Sharing, Editing, Commenting, Uploading, and Creating actions for LinkedIn in Cloud App Control Social Networking Rules
ZIA adds active/deactivated/risky app counts and user impact to the 3rd-Party App Governance dashboard, plus Zoom, Webex, and Box support in the governance catalog.
The 3rd-Party App Governance Dashboard now displays an overview of all active and deactivated apps across your business, including counts for active, deactivated, and risky apps as well as affected users over a specific time period.
The 3rd-Party App Governance Catalog now supports Zoom, Webex, and Box apps, allowing you to search for, pre-vet, and manage these applications and upload them to your inventory.
Nebula v1.9.4 adds UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. dialing support in gVisorgVisorA user-space kernel written in Go by Google that intercepts and handles system calls on behalf of a container, sandboxing it without needing a full VM. and exposes internal state programmatically via control object.
└──▷ GET THIS VERSION
$ git clone --branch v1.9.4 https://github.com/slackhq/nebula.git
# already have the repo? check out this version:$ git checkout v1.9.4
Supports UDP dialing when running under gVisor.
Exposes Nebula internal state programmatically via the control object, enabling richer integrations and tooling.
Termius v9.7.0 adds Kanagawa and Hacker terminal themes to the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..
1 more release in this issue
· 2024-09-16 → 2024-09-20
Headscale v0.23.0 adds SSH support, delta network updates, policy APIs, and API key deletion with significant breaking config changes.
└──▷ GET THIS VERSION
$ git clone --branch v0.23.0 https://github.com/juanfont/headscale.git
# already have the repo? check out this version:$ git checkout v0.23.0
└──▷ USE IT
Enable random IP allocation from separate v4/v6 prefix ranges instead of the old single ip_prefixes key.
yaml
prefixes:
v4: 100.64.0.0/10
v6: fd7a:115c:a1e0::/48
allocation: random
Adds Tailscale SSH support, enabling SSH access control through Headscale policy.
Supports delta network map updates — nodes now receive only changed/added/removed node info instead of full network state on every update.
Adds real-time update delivery via go channels (notifier package), replacing fixed-interval polling for lower-latency propagation to connected clients.
New APIs for managing Headscale ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource./policy (read and write policy via API).
Adds support for deleting API keys.
+10 moreshow less
Adds autogroup:internet group to policy, matching Tailscale's policy model.
Adds command to backfill IP addresses for nodes missing IPs from configured prefixes.
Supports manual DERP map entry creation with custom configuration instead of automatic generation only.
IP prefix configuration now split into separate prefixes.v4 and prefixes.v6 ranges, with new prefixes.allocation option supporting sequential or random IP assignment.
Write-ahead logging (WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites.) for SQLite is now on by default and configurable.
PostgreSQL database configuration gains new options for max open connections, idle connections, and idle connection lifetime.
CLI commands (all except serve) now require only minimal configuration — no errors or warnings from unset settings.
CLI results are now consistently sent to stdout and errors to stderr.
Logs are now sent to stderr by default.
HuJSON is now the sole supported format for Headscale policy files.
15 details in Everything
└──▷ BREAKING ON UPGRADE
!Database configuration structure has changed and the old structure has been removed — configuration must be converted to the new structure (see config-example.yaml).
!The API renames Machine to Node across all endpoints and responses.
!Tailscale clients older than version 1.42 are no longer supported.
!Headscale now fails to start if no DERP server is configured (cannot load DERPMap from file or URL).
!Embedded DERP server now requires a private key — add a filepath entry to derp.server.private_key_path in config.
!Docker container image entrypoint changed from shell to headscale binary — headscale serve must be changed to serve in container commands.
!Docker container no longer automatically creates /var/lib/headscale and /var/run/headscale directories.
!ip_prefixes config option is renamed to prefixes.v4 and prefixes.v6.
!MagicDNS domains no longer contain usernames by default — use use_username_in_magic_dns to restore old behavior (this option will be removed when tags are fixed).
!dns.base_domain can no longer be the same as or part of server_url.
!YAML format is no longer supported for Headscale policy files — HuJSON is now the only accepted format.
!DNS configuration has been restructured — review the new config-example.yaml for the updated layout.
OpenSSH 9.9 adds ML-KEMML-KEMNIST's post-quantum key-exchange standard (FIPS 203), formerly Kyber. Two parties use it to agree on a shared secret, usually alongside X25519 in a hybrid TLS handshake.post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. KEX, RefuseConnection, invalid-user Match, env expansion in Include, and core dump protection
ssh(1), sshd(8): add mlkem768x25519-sha256 hybrid post-quantum key exchangepost-quantum key exchangeA cryptographic handshake algorithm designed to resist attacks from quantum computers, using math problems like lattices that quantum algorithms cannot efficiently solve, letting tools stay secure against future quantum-capable adversaries. algorithm (ML-KEM + X25519X25519The elliptic-curve key exchange most modern TLS, SSH and WireGuard connections use to agree on a session key. Post-quantum hybrids pair it with ML-KEM.), available by default
ssh_configInclude directive now expands environment variables
sshd_config: add RefuseConnection option to terminate connections at the first authentication request
sshd_configPerSourcePenalties: new refuseconnection penalty class for dropped connections
sshd_configMatch invalid-user predicate to match when the target username is not valid on the server
+1 moreshow less
Private keys are kept out of core dump files for most of their lifespan across ssh, sshd, and ssh-agent (OpenBSD, Linux, FreeBSD)
6 details in Everything
└──▷ BREAKING ON UPGRADE
!ssh(1): removal of pre-authentication compression support
!Match configuration directive arguments now follow stricter shell-like quote rules; workarounds for previous simplistic quote handling may need adjustment, especially in Match exec conditions
shadowsocks-rust v1.21.0 adds OpenBSD pf support and generic I/O socket types.
└──▷ GET THIS VERSION
$ git clone --branch v1.21.0 https://github.com/shadowsocks/shadowsocks-rust.git
# already have the repo? check out this version:$ git checkout v1.21.0
shadowsocks-service now supports OpenBSD Packet-Filter (pf) integration
ProxySocket in shadowsocks crate gains generic I/O socket type support
Aembit adds Custom Resource Sets support for GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. and GitLab Jobs CI/CD pipelines
Aembit updates its Edge Components (Helm Chart, Terraform ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. Module, VM Artifacts, AWS Lambda Extension) to newer versions for performance. PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.-based TLS is now available for Kubernetes and VM deployments.
Teleport v16.4.1 adds Kubernetes secrets lookup for Connector configs, Access Request Datadog plugin support, and new static user ownership flag
└──▷ GET THIS VERSION
$ git clone --branch v16.4.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v16.4.1
Adds owner field to static host users spec to allow Teleport to automatically take ownership of existing users with matching names across hosts.
Adds support for Kubernetes secrets lookup in the GithubConnector.ClientSecret and OIDCConnector.ClientSecret fields within the Kubernetes Operator.
Adds new Access Request Datadog plugin integration for notification and workflow automation.
Adds support for Kubernetes SPDYSPDYA deprecated Google-developed network protocol designed to speed up HTTP by multiplexing streams, compressing headers, and prioritizing requests over a single TCP connection; it became the basis for HTTP/2. over Websocket Protocols for PortForward connections.
4 details in Everything
6 more releases in this issue
· 2024-09-05 → 2024-09-25
Teleport v16.4.0 adds terraform_cloud joining, SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. Federation for Workload Identity, multi-domain web apps, and Okta dashboard.
└──▷ GET THIS VERSION
$ git clone --branch v16.4.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v16.4.0
└──▷ USE IT
Configure the default shell for auto-provisioned host users via role options.
Inspect the new Okta integration status dashboard in the web UI.
📍Go to Settings › Integrations › Okta Status in the Teleport Web UI.
Adds terraform_cloud joining method to enable secretless authentication on HCP Terraform jobs for the Teleport Terraform provider
Teleport Workload Identity now supports SPIFFE Federation, allowing trust relationships to be established between a Teleport cluster's trust domain and trust domains managed by other SPIFFE compatible platforms
Teleport now supports web application access where one application depends on another
Cluster admins are now able to get a detailed overview of the Okta integration status in the Teleport web UI
Added a new create_host_user_default_shell configuration under role options that changes the default shell of auto provisioned host users
+3 moreshow less
Machine ID now generates cluster-specific ssh_config and known_hosts files which will always direct SSH connections made using them via Teleport
The Teleport Terraform provider now supports AccessMonitoringRule resources
Emit audit logs when creating, updating or deleting Teleport Plugins
v16.2.1 adds teleport_installer to Terraform provider, ServiceNow/PagerDuty to access request notifications, and bulk selection in UI
└──▷ GET THIS VERSION
$ git clone --branch v16.2.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v16.2.1
Added support for the teleport_installer resource to the Teleport Terraform provider.
Added ServiceNow support to access request notification routing rules.
Added PagerDuty support to access request notification routing rules.
Connect now supports bulk selection of resources to create an access request in the unified resources view.
Added eks:UpdateAccessEntry to IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permissions generated by the teleport integration IAM setup command and to the documentation reference for auto-discovery IAM permissions.
Drata adds vulnerability monitoring with 8 new scanning providers and Security Questionnaire Automation.
Adds a new Vulnerabilities page for tracking SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. due dates, notifications for critical/high vulns, and centralized management
Adds support for 8 new vulnerability scanning providers: AWS Inspector, Snyk, Nessus Tenable, Qualys, Semgrep, CrowdStrike VMS, SentinelOne Vulnerability Management, Microsoft Defender Vulnerability Management, and Rapid7 InsightVM
Introduces Security Questionnaire Automation (SQA) with AI-generated responses that improve based on user edits
Enhances MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. and Drata agent sync to reflect direct source device names instead of defaulting to the model
Adds support for the NIS 2 compliance framework for EU organizations
Drata adds NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0 framework support, multi-email approvers in Trust Center, and ODP/ODS/ODT/PPTX for Security Questionnaire Automation
Adds NIST CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0 as a separate, standalone out-of-band (OOB) framework for existing customers
Supports multiple email addresses in Trust Center Access request approver field
Adds ODP, ODS, ODT, and PPTX file format support for Security Questionnaire Automation uploads
Drata adds Trust Center Analytics Report export via UI, email, and new public API endpoint; supports NIST SP 800-171 Rev.2.
Adds Trust Center: Analytics Report Export and Download feature allowing users to download reports with document downloads and request metrics from within the app or via email.
Adds a new public API endpoint for programmatically requesting Trust Center Analytics Reports to import into external analytics tools.
TrustCloud v268 introduces a new action-driven post-onboarding journey with clear tasks for free SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. customers to track audit readiness.
Adds an intuitive, action-driven post-onboarding user interface with clear, actionable tasks for tracking progress toward SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2 audit readiness.
Vendor custom fields now support six field types, including dropdown selections, with filtering and export controls.
Vendor custom fields support Text Box, Text Area, Currency, Single Select, Multi Select, and Date types.
Supports searching text custom fields through the search bar and filtering other custom-field types, such as single-select and multi-select, through Filters.
Allows selecting custom field columns in the column selector to control which fields appear in exports.
CISO Assistant v1.8.10 adds a CLI, BSI C5 framework support, and paginated library listing.
└──▷ GET THIS VERSION
$ git clone --branch v1.8.10 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.8.10
CLI: basic implementation for a new command-line interface
Adds BSI C5 framework support to the list of available compliance frameworks
Library listing now paginates results via API response instead of loading all items at once
3 details in Everything
4 more releases in this issue
· 2024-09-05 → 2024-09-30
CISO Assistant v1.8.9 adds Adobe CCF support and audit UI controls
└──▷ GET THIS VERSION
$ git clone --branch v1.8.9 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.8.9
add toggle to show hide non assessable items in audit
Feature to auto create suggested controls from an audit
CISO Assistant v1.8.1 adds ESRS framework support, TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. enclave paradigm, cost fields for applied controls, and folder attachment to assessments.
└──▷ GET THIS VERSION
$ git clone --branch v1.8.1 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.8.1
cost field added to applied_controls model
Support for ESRS (CSRD standards) frameworks
New enclave paradigm available in TPRM implementation
Adds Hindi and Urdu language support to CISO Assistant
└──▷ GET THIS VERSION
$ git clone --branch v1.7.5 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.7.5
└──▷ HOW TO FIND IT
Switch the CISO Assistant UI language to Hindi or Urdu via the user profile settings.
📍In the top-right menu, select Settings › Profile › Language › Hindi (or Urdu)
Adds Hindi and Urdu localization strings for the web interface
CISO Assistant v1.7.2 adds CSV export for Audits and Controls, plus a new inspect mode menu item.
└──▷ GET THIS VERSION
$ git clone --branch v1.7.2 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.7.2
└──▷ HOW TO FIND IT
Export audit data to CSV for offline analysis or reporting.
📍In the Audits view, use the Export option and select CSV format
Export control definitions to CSV for sharing with external parties.
📍In the Controls view, use the Export option and select CSV format
Explore the hierarchical structure of your assets via the new menu item.
📍Open the Extra menu in the UI and click inspect to view domains and projects.
Adds CSV export capability for Audits in the UI
Adds CSV export capability for Controls in the UI
Adds inspect submenu under the Extra menu to view tree of domains and projects
Giskard tests and evaluates LLM applications for performance, bias, and security issues.
Adds llm_base_url parameter to LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. client and Python 3.12 support in Giskard v2.15.0
└──▷ GET THIS VERSION
$ git clone --branch v2.15.0 https://github.com/Giskard-AI/giskard-oss.git
# already have the repo? check out this version:$ git checkout v2.15.0
Adds llm_base_url parameter to the llm.client.__init__ module for custom OpenAI-compatible endpoints
Garak scans language models and applications for vulnerabilities including prompt injection and data leakage.
Garak v0.9.0.16 adds Groq generator, multiple new probes, and moves generations to probe config
└──▷ GET THIS VERSION
$ git clone --branch v0.9.0.16 https://github.com/NVIDIA/garak.git
# already have the repo? check out this version:$ git checkout v0.9.0.16
Adds generator: groq support for probing with Groq-hosted models
Adds probe: topic_pushing detection plugin for evaluating topic consistency in LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. outputs
Adds probe: ruby_package_hallucination to detect hallucinated Ruby packages
Adds probe: latent_prompt_injection for detecting covert prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. attacks
Adds probe: npm_… to detect hallucinated NPM packages
+4 moreshow less
Adds probe: rust_crate_hallucination to detect hallucinated Rust crates
Moves the generations parameter from generator config to probe config, allowing per-probe output count control
Enables tokenizer customization in HFDetector via a new configuration key
Renames the detector config key knownbadsignatures to av_spam_scanning
9 details in Everything
└──▷ BREAKING ON UPGRADE
!The knownbadsignatures config key is renamed to av_spam_scanning
!The generations parameter must now be set in the probe configuration instead of the generator configuration
Adds --active flag to gh auth status, tenancy-aware attestation commands, and API subdomain support for tenant hosts.
└──▷ GET THIS VERSION
$ git clone --branch v2.57.0 https://github.com/cli/cli.git
# already have the repo? check out this version:$ git checkout v2.57.0
└──▷ TRY IT
Display only active (non-expired) authentication tokens to quickly audit session state.
$ gh auth status --active
gh attestation verify now supports custom OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. issuers for verifying attestations from non-default identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
gh auth status accepts a new --active flag to filter output and show only active authentication sessions.
2 details in Everything
1 more release in this issue
· 2024-09-09 → 2024-09-16
gh attestation verify gains OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. bundle fetching and offline verification support
└──▷ GET THIS VERSION
$ git clone --branch v2.56.0 https://github.com/cli/cli.git
# already have the repo? check out this version:$ git checkout v2.56.0
Fetches the attestation bundle from an OCI registry for gh attestation verify
curl 8.10.0 adds SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. size limits, HTTP/2 PUSH_PROMISE support, and new curl_multi_perform options
└──▷ GET THIS VERSION
$ git clone --branch curl-8_10_0 https://github.com/curl/curl.git
# already have the repo? check out this version:$ git checkout curl-8_10_0
Adds the --max-smtp-pixel command-line option to limit the number of bytes sent in an SMTP mail transfer
Adds CURLMOPT_PUSHFUNCTION to the multi interface API, allowing applications to intercept HTTP/2 PUSH_PROMISE frames
Adds the CURLINFO_SIZE_DOWNLOAD_T info option for retrieving download sizes as 64-bit values across all protocols
$ git clone --branch OpenSSL_0_9_6 https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_0_9_6
└──▷ TRY IT
Sign an S/MIMES/MIMEAn email encryption and signing standard that uses X.509 certificates to authenticate senders and protect message contents; cyber tools use it to verify identity and enforce confidentiality over standard mail protocols. message and output it in DER format for use in environments requiring binary-encoded CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly. messages.
New rsautl application for low-level RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. sign, verify, encrypt, and decrypt operations.
Adds MD4 digest algorithm support.
New sign and verify options added to the dgst application.
Supports DER and PEM encoded messages in the smime application.
Enhanced chain verification using key identifiers in certificate path validation.
+2 moreshow less
Support for external crypto devices via the ENGINE interface (separate distribution).
Enhanced EVP interface for cryptographic operations.
OpenSSL 0.9.7a adds FreeBSD/IA64 and FreeBSD/Sparc64 support, manual TLS cert chain building, and optional ENGINE-free builds.
└──▷ GET THIS VERSION
$ git clone --branch OpenSSL_0_9_7a https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_0_9_7a
Supports two new platforms: FreeBSD/IA64 and FreeBSD/Sparc64.
Enables manual certificate chain building in SSL/TLS connections.
Allows building OpenSSL without the ENGINE framework.
Improves compatibility with MIT KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application..
Includes IA32 assembler enhancements for improved performance.
OpenSSL 0.9.7b adds RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. blinding by default, linux-ia64-ecc platform support, and improved mingw/AIX/Irix builds.
└──▷ GET THIS VERSION
$ git clone --branch OpenSSL_0_9_7b https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_0_9_7b
Enables RSA blinding by default to harden against timing side-channel attacks.
Adds support for the linux-ia64-ecc platform.
Adds improved build support for mingw, AIX, and Irix configurations.
OpenSSL 0.9.7c adds -ignore_err option to the OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists. utility.
└──▷ GET THIS VERSION
$ git clone --branch OpenSSL_0_9_7c https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_0_9_7c
└──▷ TRY IT
Check certificate revocation status while ignoring non-fatal OCSP errors — useful when an OCSP responder returns soft failures you want to tolerate in testing or monitoring pipelines.
OpenSSL 0.9.7d allows multiple active certificates with the same subject in the CA index and speeds up HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. operations.
└──▷ GET THIS VERSION
$ git clone --branch OpenSSL_0_9_7d https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_0_9_7d
Supports multiple active certificates with the same subject in the CA index.
Speeds up HMAC and other cryptographic operations.
OpenSSL 0.9.7g adds proxy certificate processing per RFC 3820
└──▷ GET THIS VERSION
$ git clone --branch OpenSSL_0_9_7g https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_0_9_7g
OpenSSL 0.9.7 adds OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists., AES, elliptic curves, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application./AES TLS suites, new hardware engines, and CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. checking.
└──▷ GET THIS VERSION
$ git clone --branch OpenSSL_0_9_7 https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_0_9_7
New OCSP library section for Online Certificate Status Protocol support.
New elliptic curve cryptography library section.
New AES (Rijndael) library section with AES cipher suite support in SSL/TLS (RFC3268).
CRL checking now available in the verify code and the openssl utility.
Extension copying added to the ca utility.
+15 moreshow less
Flexible display options added to the ca utility.
Provisional support for international characters via UTF-8.
Hardware engine support (engine) is now built into the main distribution — no longer a separate package.
New hardware engine support: Broadcom ubsec, Accelerated Encryption Processing, IBM 4758.
SSL/TLS: optional cipher selection according to server preference.
SSL/TLS: server can now explicitly set new session IDs.
SSL/TLS: Kerberos cipher suite support (RFC2712, MIT Kerberos).
SSL/TLS: finer-grained control over renegotiations and sessions.
SSL/TLS: new callback to retrieve SSL/TLS messages.
NCONF: new configuration handling routines.
PRNG now queries additional locations for random devices and auto-detects EGD-style random sources.
Unified handling of cryptographic algorithms (software and engine) via EVP routines for both asymmetric and symmetric ciphers.
Support for new platforms: Windows CE, Tandem OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees., A/UX, AIX 64-bit, Linux x86_64, Linux 64-bit on SPARC v9.
Extended platform support for VxWorks and enhanced shared library support.
Support for pkg-config integration.
20 details in Everything
└──▷ BREAKING ON UPGRADE
!The DES API namespace has been changed to avoid collisions with libdes; macros for backward compatibility are provided but will be removed in a future release.
$ git clone --branch OpenSSL_0_9_8b https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_0_9_8b
New EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free() functions enable heap-allocated cipher context management in the EVP API.
Updated ECC cipher suite support expands elliptic-curve TLS options.
Built-in dynamic engine compilation support on Win32 allows engines to be compiled and loaded dynamically on that platform.
OpenSSL 0.9.8f adds TLS Extensions, RFC4507bis session tickets, DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. improvements, and AES/SSE2 assembly optimizations for VC++.
└──▷ GET THIS VERSION
$ git clone --branch OpenSSL_0_9_8f https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_0_9_8f
Supports Server Name Indication (SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address.) extension when explicitly enabled at compile time, enabling virtual hosting over TLS.
Adds AES and SSE2 assembly-language optimizations for VC++ builds, accelerating symmetric crypto on Windows x86 targets.
Delivers DTLS (Datagram TLS) improvements for UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery.-based encrypted communications.
OpenSSL 0.9.8m adds RFC 5746 TLS renegotiation extension support and removes MD2 from algorithm tables.
└──▷ GET THIS VERSION
$ git clone --branch OpenSSL_0_9_8m https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_0_9_8m
Supports RFC 5746 TLS renegotiation extension, enabling secure renegotiation per the IETF standard.
Removes MD2 from algorithm tables, hardening the default cryptographic surface.
OpenSSL 0.9.8 adds ECDH/ECDSAECDSAThe elliptic-curve signature algorithm behind most TLS certificates, blockchains and many hardware keys. It is one of the algorithms post-quantum signatures are meant to replace., DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic., SHA-2 family, RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it.-PSS, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. certs, and a new STORE library.
└──▷ GET THIS VERSION
$ git clone --branch OpenSSL_0_9_8 https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_0_9_8
└──▷ TRY IT
Hash a file with SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. (new FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 180-2 algorithm) instead of the legacy MD5 default.
$ openssl dgst -sha256 <file>
Adds ECDH and ECDSA elliptic curve cryptography, accessible via EVP, X509X509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols., and ENGINE interfaces.
Adds BIGNUM support for fields GF(2^m) and NIST curves to underpin elliptic crypto operations.
Adds support for DTLS (Datagram Transport Layer Security).
Adds FIPS 180-2 hash algorithms: SHA-224, SHA-256, SHA-384, and SHA-512.
Adds support for the RSA-PSS encryption scheme.
+24 moreshow less
Adds support for RSA X.931 padding.
New PKCS#12PKCS#12A file format standard from RSA Labs, now maintained under IETF, that bundles a private key, certificate, and chain into one encrypted container, letting cyber tools ship or load credentials as a single portable file.medium level API for programmatic manipulation of PKCS#12 files.
New ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses..1 mini-compiler usable through the OpenSSL configuration file.
Adds support for ASN.1 indefinite length constructed encoding.
New STORE library providing a unified interface to data repositories for keys, certificates, CRLs, and arbitrary blobs.
New X509_VERIFY_PARAM structure enabling parametrisation of X.509 path validation.
Adds support for IPv6 addresses in certificate extensions (RFC 1884 §2.2).
Adds support for certificate policy mappings, policy constraints, and name constraints.
Adds support for multiple certificates with the same subject in the openssl ca index file.
New openssl ca -selfsign option to create self-signed certificates.
New openssl ca -create_serial option to generate a serial number file.
ENGINE framework now loads dynamic engine modules automatically from specified directories.
New GMPGMPGNU Multiple Precision Arithmetic Library, a free library for arbitrary-precision integers, rationals, and floats; cyber tools use it when cryptographic operations require big-number math beyond native integer limits. engine module for private key exponentiation.
New VIA PadLock ACE engine module for VIA C3 Nehemiah processors.
Adds support for multi-valued AVAs in the OpenSSL configuration file.
New BIGNUM blinding support.
PKCS#7 library updated to support one-pass S/MIMES/MIMEAn email encryption and signing standard that uses X.509 certificates to authenticate senders and protect message contents; cyber tools use it to verify identity and enforce confidentiality over standard mail protocols. processing.
Adds compile-time option to exclude deprecated functionality via OPENSSL_NO_DEPRECATED macro or no-deprecated config argument.
Adds support for files larger than 2 GB.
Adds initial support for Win64.
Adds support for BSD sockets on NetWare.
Major RC4 performance overhaul on Intel P4, IA-64, and AMD64.
New control functions for the error stack.
New BUF functions and binary search functions with extended functionality.
29 details in Everything
└──▷ BREAKING ON UPGRADE
!The default digest in openssl commands is changed from MD5 to SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications..
!The Configure script now disables some algorithms by default; they must be explicitly enabled with enable-xxx.
!The key-generation and primality testing progress mechanism now requires a structure containing the ticker function and an argument, rather than a plain callback.
OpenSSL 1.0.0e adds ECDH cipher suite support for SHA-2 certificates and EC timing-attack protections.
└──▷ GET THIS VERSION
$ git clone --branch OpenSSL_1_0_0e https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_1_0_0e
Supports ECDH cipher suites for certificates using SHA-2 algorithms.
Adds protection against EC timing-channel attacks.
OpenSSL 1.0.0 adds CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly., GOST, PSK, RFC3161 timestamps, Whirlpool, and full PKCS#8 private key support.
└──▷ GET THIS VERSION
$ git clone --branch OpenSSL_1_0_0 https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_1_0_0
Adds RFC3280 path validation sufficient to process PKITS tests.
Adds integrated support for PVK files and keyblobs.
Changes default private key format to PKCS#8.
Adds CMS (Cryptographic Message Syntax) support, able to process all examples in RFC4134.
Adds streaming ASN1 encode support for PKCS#7 and CMS.
+14 moreshow less
Adds multiple signer and signer-add support for PKCS#7 and CMS.
Adds ASN1 printing support.
Adds Whirlpool hash algorithm.
Adds RFC3161 time stamp support.
Introduces new generalised public key API supporting ENGINE-based algorithms.
Introduces new generalised public key API utilities.
Adds new ENGINE supporting GOST algorithms.
Adds SSL/TLS GOST ciphersuite support.
Adds PKCS#7 and CMS GOST support.
Adds RFC4279 PSK ciphersuite support.
Adds supported points format extension for ECC ciphersuites.
Adds dsa-with-SHA224 and dsa-with-SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. signature types.
Adds Opaque PRF Input TLS extension support.
19 details in Everything
└──▷ BREAKING ON UPGRADE
!The default private key format is now PKCS#8; tooling or scripts that expect the legacy PEM format by default will produce or consume keys in a different format on upgrade.
Adds TLS padding extension workaround for broken servers
└──▷ GET THIS VERSION
$ git clone --branch OpenSSL_1_0_1g https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_1_0_1g
OpenSSL 1.0.1 adds TLS 1.2/1.1, DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic.-SRTP, heartbeat, SCTPSCTPA transport-layer protocol (RFC 4960) maintained by the IETF that delivers messages with optional ordering and built-in multi-homing, giving cyber tools reliable framing without TCP's head-of-line blocking., SRP, and key material export.
└──▷ GET THIS VERSION
$ git clone --branch OpenSSL_1_0_1 https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_1_0_1
Adds TLS v1.2 and TLS v1.1 protocol support.
Adds TLS/DTLS heartbeat support.
Adds SCTP (Stream Control Transmission Protocol) transport support.
Adds RFC 5705 TLS key material exporter.
Adds RFC 5764 DTLS-SRTP negotiation for secure media transport.
+5 moreshow less
Adds Next Protocol Negotiation (NPN) extension support.
Adds PSS signatures in certificates, certificate requests, and CRLs.
Adds password-based recipient info support for CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly..
Adds SRP (Secure Remote Password) support.
Adds preliminary FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. capability for the unvalidated 2.0 FIPS module.
OpenSSL 1.0.2 adds DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. 1.2, Suite B, ALPN, Brainpool, and expanded CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly. algorithm support.
└──▷ GET THIS VERSION
$ git clone --branch OpenSSL_1_0_2 https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_1_0_2
Adds Suite B support for TLS 1.2 and DTLS 1.2, enabling NSA Suite B cryptography compliance.
Supports DTLS 1.2, bringing the latest datagram TLS version to OpenSSL.
Enables automatic EC curve selection for TLS connections.
New API to set TLS supported signature algorithms and curves programmatically.
New SSL_CONF configuration API for streamlined TLS configuration.
+3 moreshow less
Adds TLS Brainpool curve support.
Supports ALPN (Application-Layer Protocol Negotiation) for protocol multiplexing over TLS.
Expands CMS support to include RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it.-PSS, RSA-OAEP, ECDH, and X9.42 DH algorithms.
OpenSSL 1.1.0 adds ChaCha20/Poly1305, X25519X25519The elliptic-curve key exchange most modern TLS, SSH and WireGuard connections use to agree on a session key. Post-quantum hybrids pair it with ML-KEM., DANE TLSA, Certificate TransparencyCertificate TransparencyA public, append-only log system maintained by various operators (Google runs several) that records every TLS certificate issued, letting anyone audit CAs for misissued or rogue certificates., async crypto, and more.
└──▷ GET THIS VERSION
$ git clone --branch OpenSSL_1_1_0 https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_1_1_0
Adds ChaCha20 and Poly1305 support to both libcrypto and libssl.
Adds support for X25519 key exchange.
Adds support for RFC6698/RFC7671 DANE TLSA peer authentication.
Adds Certificate Transparency support.
Adds HKDF support to libcrypto.
+16 moreshow less
Adds support for scryptscryptA password-hashing function that requires substantial memory for each guess, making large-scale password cracking more expensive. algorithm.
Adds support for OCB mode in libcrypto.
Adds support for asynchronous crypto operations in libcrypto and libssl.
Adds pipelining support for improved throughput in TLS.
Adds the AFALG engine for kernel-accelerated crypto on Linux.
Adds new threading API.
Adds support for extended master secret.
Adds CCM ciphersuites.
Adds new security levels to libssl.
Adds KDF algorithm support, including TLS PRF as a KDF.
Extends SSL_CONF support to configuration files.
Reworked BIOBIOA BIOS-level firmware interface standard maintained by UEFI Forum that abstracts hardware initialisation, giving cyber tools a consistent way to interact with pre-boot environments across vendors. networking library with full IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support.
Introduces new unified build system.
Deprecated interfaces can now be disabled at build time via no-deprecated or --api= Configure options.
Application software can be compiled with -DOPENSSL_API_COMPAT=version to gate deprecated API exposure.
Shared builds are now the default when possible.
21 details in Everything
└──▷ BREAKING ON UPGRADE
!Most libcrypto and libssl public structures are now opaque (including BIGNUM, EC_KEY, DH, DSA, RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it., BIO, EVP_MD_CTX, EVP_CIPHER_CTX, EVP_PKEY, HMAC_CTX, X509X509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols., X509_CRL, X509_STORE, and related types), breaking code that accesses their members directly.
!libssl internal structures are now opaque, breaking any code that accessed them directly.
!SSLv2 support has been removed.
!KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ciphersuite support has been removed.
!RC4 has been removed from DEFAULT ciphersuites in libssl.
!40-bit and 56-bit cipher support has been removed from libssl.
!All public header files moved to include/openssl; no more symlinking, which may break build systems expecting the old layout.
!Configure now uses --prefix as the main installation directory; --openssldir is now exclusively for certs, private keys, and openssl.cnf.
OpenSSL 1.1.1h lets MinProtocol/MaxProtocol configure both TLS and DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. contexts in a single setting.
└──▷ GET THIS VERSION
$ git clone --branch OpenSSL_1_1_1h https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_1_1_1h
└──▷ USE IT
Set a minimum protocol floor for both TLS and DTLS clients/servers in a single openssl.cnf stanza instead of maintaining separate configs.
ini
# In openssl.cnf
[system_default_sect]
MinProtocol = TLSv1.2
MaxProtocol = TLSv1.3
Enables MinProtocol and MaxProtocol config directives to govern both TLS and DTLS contexts simultaneously.
Enforces disallowance of explicit curve parameters in verification chains when X509_V_FLAG_X509_STRICT is set.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Explicit curve parameters in verification chains are now rejected when X509_V_FLAG_X509_STRICT is used, which may break certificate verification for chains that previously relied on explicit curve parameters under strict mode.
OpenSSL 1.1.1 adds TLSv1.3, overhauled RNG, EdDSAEdDSAA fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe./SM2/SHA3 algorithms, and a new URI-based STORE module.
└──▷ GET THIS VERSION
$ git clone --branch OpenSSL_1_1_1 https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout OpenSSL_1_1_1
Adds fully compliant TLSv1.3 (RFC 8446) support enabled by default, including 0-RTT early data, post-handshake authentication, key update, middlebox compatibility mode, PSKs, and all five RFC 8446 ciphersuites.
Supports stateless TLS server mode and configurable session ticket support under TLSv1.3.
Backports RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it.-PSS signature algorithms to TLSv1.2.
Rewrites the OpenSSL RNG around an AES-CTR DRBG (NIST SP 800-90Ar1) with per-thread public/private DRBG instances, seed chaining, fork-safety, and optional secure-heap storage.
Adds SHA3, SHA512/224, SHA512/256, EdDSA (Ed25519Ed25519A fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe. and Ed448 with X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. and TLS support), X448, multi-prime RSA, SM2, SM3, SM4, SipHash, and ARIA (with TLS support).
+5 moreshow less
New ClientHello callback enables adjustment of the SSL object before handshake processing begins.
Adds Maximum Fragment Length TLS extension negotiation and support.
New STORE module provides a uniform, URI-based reader for keys, certificates, CRLs, and other objects.
Claim of OSSL and OPENSSL symbol prefix namespaces for cleaner library symbol management.
Compute an HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. using the new openssl mac command as a quick CLI alternative to external HMAC tools.
$ openssl mac -digest SHA256 -macopt key:mysecretkey -in data.bin HMAC
Adds providers, a new pluggability framework replacing the ENGINE API, enabling fully modular cryptographic implementations.
Implements support for fully pluggable TLSv1.3 groups.
Adds Kernel TLS (KTLS) support for offloading TLS record processing to the OS kernel.
Adds a full Certificate Management Protocol (CMP, RFC 4210) implementation — including CRMF (RFC 4211) and HTTP transfer (RFC 6712) — with a new cmp CLI app covering both client and server roles.
Adds a proper HTTP client supporting GET/POST, TLS, persistent connections, HTTP(S) proxy, redirects, user-defined BIOs, and timeout checks.
+15 moreshow less
Adds EVP_MAC, an EVP-layer MAC API supporting BLAKE2, CMAC, GMAC, HMAC, KMAC, POLY1305, and SIPHASH.
Adds EVP_KDF, an EVP-layer KDF/PRF API supporting HKDF, KBKDF, KRB5 KDF, PBKDF2, PKCS12PKCS12A file format standard from RSA Labs, now maintained under IETF, that bundles a private key, certificate, and chain into one encrypted container, letting cyber tools ship or load credentials as a single portable file. KDF, SCRYPT, SSH KDF, SSKDF, TLS1 PRF, X9.42 KDF, and X9.63 KDF.
Adds new openssl mac command for MAC computation via the EVP_MAC API.
Adds new openssl kdf command for key derivation via the EVP_KDF API.
Adds openssl info command and OPENSSL_info() API for querying built-in configuration data.
Enhances openssl list with many new options for inspecting available algorithms, providers, and capabilities.
Adds OSSL_ENCODER and OSSL_DECODER, generic encoder/decoder APIs for key and certificate serialization.
Adds OSSL_LIB_CTX, a library context enabling multiple isolated libcrypto instances within a single process.
Adds OSSL_PARAM_BLD, a simpler builder API for constructing OSSL_PARAM arrays.
Adds OSSL_PROVIDER_available() to programmatically check whether a given provider is loaded.
Adds convenience functions for generating asymmetric key pairs.
Adds error raising macros ERR_raise() and ERR_raise_data() for structured error reporting.
Adds instrumentation support through trace and debug output.
Includes X25519X25519The elliptic-curve key exchange most modern TLS, SSH and WireGuard connections use to agree on a session key. Post-quantum hybrids pair it with ML-KEM., X448, Ed25519Ed25519A fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe., Ed448, SHAKE128, and SHAKE256 in the FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. provider.
Moves legacy ciphers (CAST5, BF, IDEA, SEED, RC2, RC4, RC5, DES) and legacy digests (MD2, MD4, MDC2, WHIRLPOOL, RIPEMD-160) to the legacy provider.
20 details in Everything
└──▷ BREAKING ON UPGRADE
!SSL 3, TLS 1.0, TLS 1.1, and DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. 1.0 only work at security level 0; they are blocked at higher security levels.
!X509X509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. certificates signed using SHA1 are no longer trusted at security level 1 or higher; since the default TLS security level is 1, SHA1-signed certificates no longer authenticate servers or clients by default.
!The RAND_DRBG API is removed; code using it will not compile.
!Interactive mode is removed from the openssl program; scripts relying on it will break.
!The heartbeat message feature in DTLS is removed.
!CAST5, BF, IDEA, SEED, RC2, RC4, RC5, and DES EVP ciphers are moved to the legacy provider; setups not loading the legacy provider will lose access to these algorithms.
!MD2, MD4, MDC2, WHIRLPOOL, and RIPEMD-160 EVP digests are moved to the legacy provider; setups not loading the legacy provider will lose access to these digests.
Cloudflare AI Crawl Control adds AI Audit dashboard for monitoring and WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. rules to block specific AI bots.
Adds AI audit dashboard to summarize crawling behavior of popular and known AI services
Enables enforcing robots.txt policy via an automatic WAF rule
Cloudflare introduces one-click Cache Rules templates for simplified CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. configuration via UI
Adds pre-configured cache rule templates available via the Rules > Templates dashboard section
Provides Cache everything template to adjust the cache level for all requests
Provides Bypass cache for everything template to bypass cache for all requests
THE CYBER TOOLCHAIN