The Cyber Toolchain — issue -006, January 31, 2026
THE CYBER TOOLCHAIN
NO. -006
Tail
THE DAILY RELEASE FIREHOSE
PUBLISHED JANUARY 31, 2026 · EVERY DAY
EDITIONStail|grep|head|ls|diff|uniq
The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
Sliver v1.6.1 adds experimental MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support, a new aka command for aliases, and improved implant build layout.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.1 https://github.com/BishopFox/sliver.git
# already have the repo? check out this version:$ git checkout v1.6.1
Adds experimental MCP (Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) support for AI-assisted C2 interaction.
New aka command lets operators define custom command aliases within the Sliver console.
Improves implant build layout for cleaner artifact organization.
Sliver v1.6.0 adds memory files, Tailscale multiplayer, bulk tasking, grep/head/tail, RC4 stagers, operator permissions, and more.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.0 https://github.com/BishopFox/sliver.git
# already have the repo? check out this version:$ git checkout v1.6.0
Adds memory file feature for in-memory file operations on implants.
Adds Tailscale integration for multiplayer C2 operator connectivity.
Adds profiles info subcommand and saves poll timeout in implant profiles.
Adds command to task many implants at once (bulk tasking).
Adds grep command for searching remote file content.
+25 moreshow less
Adds head and tail commands for reading the start/end of remote files.
Adds cp (copy file) command for copying files on the remote host.
Adds ability to upload entire directories with the upload command.
Adds WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. output support in beacon mode.
Adds RC4 encryption support to shellcode stager.
Adds ability to generate .exe MSF stagers directly from Sliver.
Adds customization of the LURI for MSF stager payloads.
Adds advanced options for MSF stager generation.
Adds DNS C2 without TXT record support (notxt DNS mode).
Adds C2 server-signing for enhanced communication integrity.
Adds operator permissions system for role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. in multiplayer mode.
Adds selective staging support for stage listeners.
Adds profile update capability.
Adds HTTP C2 configuration support for external builds.
Adds console session asciicast recorder for session replay.
Adds server-side console log rotation and compression.
Adds RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets.-level audit logging with additional details.
Adds hidden window support for executed processes on Windows implants.
Adds HTTP proxy fallback to direct connection when proxy fails.
Adds option to disable fallback connection to TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./80 when TCP/443 is unreachable.
Adds more detail about stage listeners in the jobs command output.
Adds Cybereason ActiveProbe to the known security processes list.
Stores Shikata Ga Nai (SGN) encoding preference within implant profiles.
Adds validation for advanced C2 options during implant generation.
Adds client-side error reporting for invalid/unsupported TLS certificates on HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. listeners.
Metasploit Pro 4.22.9 adds KrbClockSkew option, Linux RISC-V payload support, and React2Shell/Waku improvements
Adds KrbClockSkew datastore option to KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application.-authenticated modules for clock skew mitigation
Adds new bind shell and fetch payload support for Linux RISC-V targets
Adds register constants for aarch64, amd64, arm, loongarch64, mips32, mips64, ppc32, ppc64, riscv32, riscv64, and zarch architectures
Adds Waku framework support to the React2Shell module via modular configuration
Adds additional ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. references to persistence modules
adscan v4.0 adds NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. fallback, BloodHound CE attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. search, optional workspace cleanup, and changes BH CE port to 8443.
└──▷ GET THIS VERSION
$ git clone --branch v4.0.0 https://github.com/ADScanPro/adscan.git
# already have the repo? check out this version:$ git checkout v4.0.0
Added NTLM fallback when KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. fails
New attack path execution flow with step‑by‑step actions
Added BloodHound CE attack path search
Added optional workspace cleanup before scans
BloodHound CE default port changed from 8080 → 8443
5 details in Everything
└──▷ BREAKING ON UPGRADE
!BloodHound CE now listens on port 8443 instead of 8080 by default
cameradar v6.0.0 adds --skip-scan mode, M3U output, TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. UI, and custom dictionary paths
└──▷ GET THIS VERSION
$ git clone --branch v6.0.0 https://github.com/Ullaakut/cameradar.git
# already have the repo? check out this version:$ git checkout v6.0.0
└──▷ USE IT
Scan a list of IPs directly without performing initial port discovery to speed up known-target assessments.
shell
cameradar -t targets.txt --skip-scan
Run the tool in terminal-based interactive mode to monitor progress visually during an attack.
shell
cameradar -t 192.168.1.0/24 --ui tui
Export discovered streams into an M3U playlist file for use in media players.
xnLinkFinder v7.18 adds configurable max response size and streaming HTTP to skip large/binary files automatically.
└──▷ GET THIS VERSION
$ git clone --branch v7.18 https://github.com/xnl-h4ck3r/xnLinkFinder.git
# already have the repo? check out this version:$ git checkout v7.18
└──▷ TRY IT
Cap bandwidth consumption during a large crawl by skipping any response over 10 MB — useful when targeting hosts that serve large binary assets.
$ xnLinkFinder -i https://example.com -mrs 10
New -mrs / --max-response-size argument sets the maximum response size in MB (default: 100 MB); responses exceeding this limit are skipped.
HTTP requests now use streaming to inspect Content-Length and Content-Type headers before downloading, automatically skipping large or binary-content responses (e.g., .pth, .bin, .exe, archives).
Faster startup via lazy-loading of heavy imports (playwright, tldextract, inflect) and deferred PDF-related checks — each loaded only when the relevant feature is actually used.
3 details in Everything
5 more releases in this issue
· 2026-01-03 → 2026-01-08
Adds BeautifulSoup-based readable HTML extraction that strips <script>, <style>, <noscript>, and <template> tags before searching for links, surfacing encoded URLs that raw parsing misses.
New -ro/--readable-only flag restricts link extraction to human-visible page content, filtering out JS/CSS links — useful when hunting domain-specific links in blogs or CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly.-heavy sites.
xnLinkFinder v7.15 adds OCROCROptical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. fallback for scanned PDFs and smarter PDF detection via magic bytes.
└──▷ GET THIS VERSION
$ git clone --branch v7.15 https://github.com/xnl-h4ck3r/xnLinkFinder.git
# already have the repo? check out this version:$ git checkout v7.15
Adds OCR fallback using ocrmypdf to extract links from scanned or image-only PDFs when pdftotext and pypdf yield no text.
Supports PDF link extraction when a directory or a single .pdf file is passed directly as input.
xnLinkFinder v7.14 adds PDF link extraction via pdftotext or pypdf fallback.
└──▷ GET THIS VERSION
$ git clone --branch v7.14 https://github.com/xnl-h4ck3r/xnLinkFinder.git
# already have the repo? check out this version:$ git checkout v7.14
Extracts links and parameters from PDF files by converting .pdf URL responses to text using pdftotext (if installed) or the pypdf Python library as a fallback.
xnLinkFinder v7.13 adds HTTP Keep-Alive via persistent sessions and per-worker session init for faster multi-URL crawling.
└──▷ GET THIS VERSION
$ git clone --branch v7.13 https://github.com/xnl-h4ck3r/xnLinkFinder.git
# already have the repo? check out this version:$ git checkout v7.13
Implements HTTP Keep-Alive by reusing requests.Session objects across requests, reducing TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./TLS handshake overhead when crawling multiple URLs on the same host.
Adds init_worker function to initialize a persistent requests.Session in each worker process under multiprocessing, improving throughput in parallel crawls.
OOBZero detection now uses definitive SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. confirmation techniques
└──▷ GET THIS VERSION
$ git clone --branch v3.2.0 https://github.com/bountyyfi/lonkero.git
# already have the repo? check out this version:$ git checkout v3.2.0
1 more release in this issue
· 2026-01-03 → 2026-01-05
Lonkero v3.0.0 adds Google Dorking module, authenticated SPA scanning, and quantum-safequantum-safeCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. report signing.
└──▷ GET THIS VERSION
$ git clone --branch v3.0.0 https://github.com/bountyyfi/lonkero.git
# already have the repo? check out this version:$ git checkout v3.0.0
Adds Google Dorking module for search-engine reconnaissance
waymore v8.0 adds GhostArchive as a URL and response source, with new exclusion flag and provider option.
└──▷ GET THIS VERSION
$ git clone --branch v8.0 https://github.com/xnl-h4ck3r/waymore.git
# already have the repo? check out this version:$ git checkout v8.0
└──▷ TRY IT
Pull all archived URLs for a target including GhostArchive results, which were unavailable before v8.0.
$ waymore -i example.com -mode U --providers ghostarchive
Download archived HTTP responses from GhostArchive WARC files while skipping GhostArchive link extraction to avoid noise.
$ waymore -i example.com -mode R -xga
Adds GhostArchive (ghostarchive.org) as a new URL source for -mode U and -mode R, crawling paginated HTML pages to extract archived URLs and downloading WARC files for HTTP responses.
New -xga flag to exclude GhostArchive from URL link checks.
Extends --providers to accept ghostarchive as a valid provider value.
Adds .avif to FILTER_URL and image/avif to FILTER_MIME defaults so AVIFAVIFAn open image format based on the AV1 video codec, maintained by the Alliance for Open Media, offering smaller file sizes than JPEG or PNG at comparable quality — useful when a tool serves image-heavy web interfaces. images are filtered from results.
application/pdf removed from FILTER_MIME defaults so PDF files are no longer filtered out — surfaces potentially valuable archived documents.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!application/pdf is removed from FILTER_MIME in config.yml and DEFAULT_FILTER_MIME, meaning PDFs that were previously filtered out will now appear in results on upgrade.
waymore v7.7 expands binary file handling in -mode R and adds more audio/video filters to config
└──▷ GET THIS VERSION
$ git clone --branch v7.7 https://github.com/xnl-h4ck3r/waymore.git
# already have the repo? check out this version:$ git checkout v7.7
Adds more audio and video extensions to FILTER_URL defaults and config.yml to broaden automatic URL filtering.
Adds more audio and video MIME types to FILTER_MIME defaults and config.yml.
Introduces BINARY_EXTENSIONS constant covering 50+ binary file extensions for accurate binary detection during downloads.
Introduces BINARY_MIME_TYPES constant covering 40+ binary MIME types for accurate binary detection during downloads.
New isBinaryContent() function inspects actual content bytes (magic bytes) before falling back to Content-Type header or URL extension, ensuring HTML error pages aren't misidentified as binary.
+4 moreshow less
Binary files downloaded with -mode R now use the Wayback Machine id_ modifier (e.g., /web/20090315210455id_/http://...) to retrieve raw originals without Wayback Machine modifications.
Binary files with no determinable extension now saved as .bin instead of .unknown.
The --source-ip option is now shown in output only when explicitly configured (visible in verbose -v mode).
Adds extra debug output showing the file currently being processed to assist in diagnosing hangs.
waymore v7.6 adds source IP binding so outbound requests use a specific whitelisted interface on multi-homed hosts.
└──▷ GET THIS VERSION
$ git clone --branch v7.6 https://github.com/xnl-h4ck3r/waymore.git
# already have the repo? check out this version:$ git checkout v7.6
└──▷ TRY IT
Force waymore to egress through a specific whitelisted IP on a multi-homed host, e.g. when a target only allows requests from a known scanner IP.
$ waymore -i example.com --source-ip 203.0.113.42
Adds --source-ip / --bind-ip CLI argument and SOURCE_IP config option to bind all outbound HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. requests to a specific local IP address.
waymore v7.5 adds automatic IntelX endpoint fallback, switching from paid to free tier on auth errors.
└──▷ GET THIS VERSION
$ git clone --branch v7.5 https://github.com/xnl-h4ck3r/waymore.git
# already have the repo? check out this version:$ git checkout v7.5
Adds automatic fallback between paid (2.intelx.io) and free (free.intelx.io) Intelligence X endpoints, switching on 401/402/403 errors so users with either API key type get results without manual reconfiguration.
Adds thread-local storage for IntelX URL configuration to support concurrent IntelX operations.
theHarvester 4.10.0 adds SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. proxy support, LeakIX API key auth, and Bitbucket API key integration.
└──▷ GET THIS VERSION
$ git clone --branch 4.10.0 https://github.com/laramies/theHarvester.git
# already have the repo? check out this version:$ git checkout 4.10.0
Adds SOCKS proxy support via aiohttp-socks, enabling harvesting through SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. tunnels and anonymizing proxies.
Adds LeakIX API key support with improved request header configuration for authenticated LeakIX queries.
Adds Bitbucket API key entry in theHarvester/data/api-keys.yaml for authenticated Bitbucket source enumeration.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Core.bing_key() has been removed; any tooling or modules calling this method will break on upgrade.
Naabu v2.4.0 enables IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. by default and adds a DisableStdout SDK option for cleaner programmatic use.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.0 https://github.com/projectdiscovery/naabu.git
# already have the repo? check out this version:$ git checkout v2.4.0
└──▷ USE IT
Suppress naabu's stdout when using it as a Go library — useful when integrating into a pipeline that owns its own output formatting.
go
opts := &naabu.Options{
DisableStdout: true,
// other options...
}
Enables IPv6 scanning by default, broadening host coverage without extra flags.
Adds DisableStdout option to the Go SDK to suppress stdout output when embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. naabu programmatically.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!IPv6 is now the default scan mode; workflows that relied on IPv4-only behavior may produce different results or require explicit configuration to restrict scans to IPv4.
The httpx-toolkit probes HTTP services in parallel to identify live hosts, technologies, status codes, titles, and other web metadata.
httpx v1.8.0 adds Burp XML input, secret-file auth, and passive CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently./WordPress detection
└──▷ GET THIS VERSION
$ git clone --branch v1.8.0 https://github.com/projectdiscovery/httpx.git
# already have the repo? check out this version:$ git checkout v1.8.0
└──▷ TRY IT
Authenticate against targets using credentials stored in a secrets file to avoid leaking them in shell history or process listings.
Hunter adds source transparency with labels (Email, Mention, Removed) and URLs for emails.
Adds Email, Mention, and Removed source labels to clarify email provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build.
Shows Source URLs even for sources that have been removed
The open-source wireless research platform for ESP32.
GhostESP v1.9.2 adds Wireshark dongle mode and LilyGo T-Deck ADC support
└──▷ GET THIS VERSION
$ git clone --branch v1.9.2 https://github.com/GhostESP-Revival/GhostESP.git
# already have the repo? check out this version:$ git checkout v1.9.2
Added Wireshark dongle mode for real-time PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. streaming over USB/UARTUARTA hardware protocol for serial communication between devices, transmitting data one bit at a time over two wires. Cyber tools use it to access embedded device consoles and debug interfaces without a network stack.
Added T-Deck keyboard shift, symbol key support with key repeat functionality
Adds support for HackRF Pro hardware platform and PortaPacks with AGM Microelectronics CPLDsCPLDsConfigurable logic devices that sit between simple PLAs and full FPGAs, letting designers implement custom digital logic in reprogrammable hardware for low-latency, deterministic signal processing without a CPU.
└──▷ GET THIS VERSION
$ git clone --branch v2026.01.1 https://github.com/greatscottgadgets/hackrf.git
# already have the repo? check out this version:$ git checkout v2026.01.1
A tool that detects cell site simulators (IMSI catchers) on a cheap mobile hotspot.
Rayhunter v0.9.0 adds an installer GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. framework and mount logs for the rayhunter installer
└──▷ GET THIS VERSION
$ git clone --branch v0.9.0 https://github.com/EFForg/rayhunter.git
# already have the repo? check out this version:$ git checkout v0.9.0
Adds a gui installer framework to simplify desktop installation workflows.
Captures and displays mount logs during the rayhunter installer process.
A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32.
ESP32 Marauder v1.10.0 adds MAC tracking backend, SAE sniff/attack commands, and BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems. support for tracking.
└──▷ GET THIS VERSION
$ git clone --branch v1.10.0 https://github.com/justcallmekoko/ESP32Marauder.git
# already have the repo? check out this version:$ git checkout v1.10.0
Adds MAC tracking backend to persist and correlate device locations
Adds CLI command for MAC tracking operations
Adds BLE support for MAC tracking data synchronization
Adds SAE sniff capability for WPA3WPA3The third generation of the Wi-Fi Protected Access authentication and encryption standard, maintained by the Wi-Fi Alliance, offering stronger handshake protection and per-session encryption compared to WPA2. handshake capture
Adds SAE flood attack functionality
+1 moreshow less
Adds dedicated commands for SAE sniff and SAE attack workflows
HydraFW, the official firmware for HydraBus, an open source multi-tool for debugging and hacking embedded hardware.
Adds make flash target, SPISPISerial Peripheral Interface, a synchronous communication bus standard used to connect microcontrollers to sensors, flash memory, and other peripherals at short range; cyber tools use it to read or write firmware on embedded devices. BIDIR mode, and read-with-timeout support to HydraFW v0.12
└──▷ GET THIS VERSION
$ git clone --branch v0.12 https://github.com/hydrabus/hydrafw.git
# already have the repo? check out this version:$ git checkout v0.12
Adds make flash Makefile target for convenient firmware flashing
Initial support for SPI BIDIR (3-wire) mode in the console interface
Adds timed read / read with timeout feature for smartcards and other interfaces
Penelope v0.18.0 adds SharpHound, Mimikatz, LaZagne and more to its module library, plus jumpbox support for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. listeners.
└──▷ GET THIS VERSION
$ git clone --branch v0.18.0 https://github.com/brightio/penelope.git
# already have the repo? check out this version:$ git checkout v0.18.0
Adds SharpHound, PowerView, Mimikatz, LaZagne, SharpWeb, GhostPack collection, and Snaffler to the built-in enrichment modules.
Supports jumpboxes for TCP Listeners, enabling shell routing through intermediary hosts.
Introduces an on_first_attach hook for Modules, allowing actions to trigger automatically when a session is first attached.
BloodHound v8.5.1 reworks Local Group post-processing for more accurate AD attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis.
└──▷ GET THIS VERSION
$ git clone --branch v8.5.1 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v8.5.1
1 more release in this issue
· 2026-01-22 → 2026-01-27
BloodHound v8.5.0 adds OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. node/edge searchability, schema extension CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. APIs, kind filtering, and new Privilege Zones UI improvements.
└──▷ GET THIS VERSION
$ git clone --branch v8.5.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v8.5.0
OpenGraph nodes are now searchable on the Explore page.
Explore search results now return custom node icon data for OpenGraph nodes.
New API endpoint to retrieve OpenGraph edge kinds.
Full CRUD database methods for OpenGraph schema extensions (extensions, node kinds, edge kinds, and properties).
OpenGraph schema extension migrations added.
+17 moreshow less
Kind filtering added to the asset-group-tags/{id}/selectors/{id}/members API endpoint.
Asset group tag ID filtering added to the Global Search API.
Filter support added to the GET /asset-group-tag/:id/members endpoint.
Selector type counts added to GET /api/v2/asset-group-tags.
Kind count breakdown added to the Selectors API.
Adds hygiene_attack_paths count to the domains endpoint.
New DisableTimeoutLimit property added to application configuration.
Source Kind now supports deactivation and re-activation instead of hard deletion.
Far-reaching accessibility improvements across the UI.
Table view sort arrows are now always visible.
Processing indicator added to the UI for in-progress operations.
Run button now shows a visual running status while a query is executing.
Objects Accordion and Details Rules display redesigned in the details panel.
Privilege Zones selected details tabs added.
Citrix RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. support enabled via analysis.citrix_rdp_support configuration.
Strix v0.6.0 adds STRIX_REASONING_EFFORT env var, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. deduplication, persistent config to ~/.strix/cli-config.json, and a live TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. panel
└──▷ GET THIS VERSION
$ git clone --branch v0.6.0 https://github.com/usestrix/strix.git
# already have the repo? check out this version:$ git checkout v0.6.0
STRIX_REASONING_EFFORT environment variable controls reasoning depth and latency/quality tradeoffs for agents.
LLM-based vulnerability deduplication detects semantically similar findings and merges them into a single canonical entry.
Centralized configuration persists settings to ~/.strix/cli-config.json across sessions.
hcxtools introduces hcxpottool for converting mixed-encoding hashcat pot/out files to ASCII-hexified formats.
└──▷ GET THIS VERSION
$ git clone --branch 2026-01-13 https://github.com/ZerBea/hcxtools.git
# already have the repo? check out this version:$ git checkout 2026-01-13
Adds hcxpottool, a CLI tool for converting mixed-encoding hashcat output and pot files to ASCII-compatible pot or tab-separated output by hexifying non-printable characters.
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!hcxcommic has been removed; its functionality is now in hashcat (--hash-copy).
airgeddon v11.61 adds VM detection, Evil Twin audio alerts, and improved WPA3WPA3The third generation of the Wi-Fi Protected Access authentication and encryption standard, maintained by the Wi-Fi Alliance, offering stronger handshake protection and per-session encryption compared to WPA2. plugin support.
└──▷ GET THIS VERSION
$ git clone --branch v11.61 https://github.com/v1s1t0r1sh3r3/airgeddon.git
# already have the repo? check out this version:$ git checkout v11.61
Adds automatic detection of Virtual Machine environments at startup.
Adds beep sound alerts during Evil Twin attacks to signal key events.
New option to disable audio playback during Evil Twin attacks for silent operation.
Expands WPA3 menu to support additional WPA3 plugins.
Improves internet interface validation for VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. compatibility.
Akto discovers APIs, MCP servers and AI agents, tests and red-teams them, and enforces runtime guardrails and posture management.
Akto adds OpenClaw endpoint discovery, Guardrail policies, Claude CLI/LiteLLM/Databricks/Snowflake integrations, DevRev filtering, and Agentic Red Teaming probes.
Endpoint Visibility now shows employee usernames alongside endpoint IDs for discovered Agents on employee devices.
Define and enforce Guardrail policies to validate intent and block unsafe inputs in real time via Akto Atlas | Akto Argus.
Guardrail detections now report the exact violated policy and rule names for each flag.
Compliance-Mapped Threat Reports map threats to GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against., SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. and allow instant export of audit-ready reports.
Jira Data Center integration supports expanded two-way sync, severity mapping, and custom field enrichment for agentic tickets.
+7 moreshow less
DevRev Integration fetches can be filtered by part type to restrict results to specific DevRev parts via Akto Argus.
New Claude CLI Integration imports Claude CLI proxy traffic to validate prompts against security policies.
New LiteLLM integration monitors and secures AI agents for multi-model routing and management.
Snowflake Integration discovers AI agents on Snowflake Cortex and automatically fetches their data.
Databricks Integration monitors and secures agents running on Databricks platforms.
Datadog Integration ingests AI agent telemetry and observability signals into Akto.
Hugging Face Integration protects agents and models hosted or deployed via Hugging Face.
Security Edge adds JA4JA4A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies. TLS client fingerprinting for bot identification and rate limiting
└──▷ HOW TO FIND IT
Identify and block automated scraping tools that rotate IPs but maintain consistent TLS fingerprints.
📍JA4 fingerprinting is enabled by default in Security Edge with node version 6.7.4-1 and later.
Enables JA4 TLS fingerprinting in Security Edge to identify bots and automated tools via handshake characteristics.
Adds threat detection for known malicious tools (Burp Suite, sqlmap, scrapers) using JA4 fingerprints.
New GET endpoint to retrieve top attack data for a Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. workspace.
Adds the Get top attacks for a workspace API endpoint to the Next-Gen WAF service
Enables fetching top attack metrics sorted by request count within specified time ranges and aggregation options
Fastly Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. agent 4.74.0 introduces new Docker image and improved detections.
Adds sigsci-agent-slim Docker image (built from scratch) to Docker Hub for a smaller footprint.
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. custom dashboards now support the trend visualization type via the Custom dashboards API.
Mend SAST is a static application security testing service that scans source code for vulnerabilities and helps teams prioritize remediation.
Mend SAST 26.1.1 adds GitHub suppression approval workflows, C/C++ auto-remediation, Rust GA, .pbxproj secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it., and multi-threading.
└──▷ HOW TO FIND IT
Enable Rust scanning for a new project now that it is GA.
📍n/a (feature enabled via platform settings, not a CLI flag)
Scan Xcode projects for exposed secrets in .pbxproj configuration files.
📍n/a (native support, no new flag required)
Supports suppression approval workflows for GitHub repositories
Adds automated remediation suggestions for Code findings in C and C++ (CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-22, CWE-79, CWE-89, CWE-117, CWE-601)
Rust detection is now generally available with expanded CWE coverage
Added support for .pbxproj files in secret scanning
SAST detection for Android, Objective-C and Cold Fusion now supports multi-threading to reduce scan time
5 details in Everything
3 more releases in this issue
· 2026-01-05 → 2026-01-26
Mend SAST adds GitHub suppression workflows, C/C++ auto-remediation, GA Rust detection, and .pbxproj secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it..
Adds support for suppression approval workflows in GitHub repositories to let developers request suppressions while managers retain control
Adds automated remediation suggestions for Code findings in C and C++ covering CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-22, CWE-79, CWE-89, CWE-117, and CWE-601
Makes Mend SAST Rust detection generally available with expanded CWE coverage
Adds support for .pbxproj files in secret scanning to detect sensitive information in Xcode configuration files
Supports suppression approval workflows for Bitbucket repositories, allowing developers to request suppressions and security managers to approve or reject them.
Snyk Code announces expanded C# 14/.NET 10, Fiber, and Sequelize analysis for rollout on February 23, 2026.
Adds analysis support for C# 14 and .NET 10, including VB.NET applications on the .NET 10 framework
Improves coverage for grpc-spring based gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. clients in Java and Kotlin.
Adds analysis support for the Sequelize library in JavaScript and TypeScript
Adds detection support for the Fiber framework in Go
Adds analysis support for grpc-swift library in Swift
+1 moreshow less
Improves coverage for Spring WebFlux and Jax-RS in Kotlin
6 details in Everything
9 more releases in this issue
· 2026-01-08 → 2026-01-29
Snyk Container now supports scanning enterprise-scale projects with massive dependency graphs by introducing a graph pruning mechanism for CLI users via the --prune-repeated-subdependencies flag.
Snyk CLI v1.1302.0+ introduces improved snyk sbom test in Early Access, with additional control options and enriched output.
snyk sbom test command no longer requires the --experimental flag in CLI v1.1302.0+
New CLI options --severity-threshold, --reachability, and --reachability-filter for granular SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. scanning control
Snyk CLI v1.1302.0 adds pnpm lockfile support, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Scan capability, and improved Go/OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. container scanning.
Adds pnpm lockfile support to Snyk Container image scanning.
Integrated MCP Scan into Snyk CLI to test agent-based developer tools like Cursor and Claude Code
Added container scan support for cgo and stripped Go binaries
Added support for OCI images with manifests missing platform fields
Added deb, apk, and rpm support in SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. test
+3 moreshow less
Added PackageURL information to go.mod dependency graphs for snyk test
Improved PackageURLs in SBOM documents for go.mod projects
Snyk Container adds automatic pnpm-lock.yaml detection for Node.js applications in container images, bringing container scanning into parity with existing CLI and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations.
Snyk Open Source announces staged Yarn 4 and Ruby 4 support across CLI and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations, with PHP 8.5 and Swift 6.2 support still upcoming.
Adds Yarn 4 support in CLI v1.1302.0 from January 14, with a gradual SCM rollout during January; Fix PRs and Upgrade PRs are not supported for Yarn workspaces.
Announces upcoming support for PHP 8.5 and Swift 6.2 in Snyk Open Source
Connect DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. findings to Snyk Learn lessons
Snyk API & Web adds client-certificate configuration for mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. on Web, OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth., and Postman targets, enabled through Sales.
Adds a CLIENT AUTHENTICATION CERTIFICATE module to the Settings > Authentication tab for Web and API targets to support mutual TLS (mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with.).
v3.1.1 adds LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. provider flags, local endpoint support, and LLM agent detection
└──▷ GET THIS VERSION
$ git clone --branch v3.1.1 https://github.com/duriantaco/skylos.git
# already have the repo? check out this version:$ git checkout v3.1.1
--provider CLI flag forces openai or anthropic LLM provider
--base-url CLI flag for OpenAI compatible endpoints (eg. Ollama etc)
SKYLOS_LLM_PROVIDER, SKYLOS_LLM_BASE_URL, OPENAI_BASE_URL environment variables for configuration
Auto API key bypass for local endpoints (localhost, 127.0.0.1, 0.0.0.0)
New agent for LLM assisted detection
5 details in Everything
└──▷ BREAKING ON UPGRADE
!OpenAIAdapter now uses Chat Completions API (chat.completions.create) instead of Responses API
Mend SCA adds SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format.-ID field visibility and multi-license name support under single identifiers
SPDX-ID field visible in the license side panel for managing multiple distinct license names under a single SPDX identifier
Mend SCA adds three async account-level APIs to export Dependency reports in Excel format.
Adds asynchronous, account-level API endpoints for exporting Dependencies reports in EXCEL format with targeted filters for library name or finding ID.
Introducing GET /api/dependencies/report/excel/inventory and GET /api/dependencies/report/excel/findings account-level API endpoints for exporting Dependencies reports in EXCEL format
Adds targeted filter support for library_name and finding_id on the new Excel export endpoints
GitLab 18.8 adds Agent Platform GA, C/C++ Advanced SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., multi-container scanning, auto-dismiss policies, Credentials API, and SSH key disablement.
GitLab Duo Agent Platform is generally available with a central AI Catalog for managing agents and flows.
GitLab Duo Planner Agent is generally available to analyze backlogs and apply planning frameworks like RICE or MoSCoW.
GitLab Duo Security Analyst Agent is generally available to triage vulnerabilities via natural language in Agentic Chat.
Adds vulnerability management policies to auto-dismiss irrelevant vulnerabilities based on file path, directory, or identifier (CVE, CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances., OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against.).
Enables turning on or off the GitLab Duo Agent Platform and individual components for a top-level group or instance.
+6 moreshow less
Introduces group access control rules to define who can use GitLab Duo features within a group.
GitLab Duo Agent Platform for Self-Hosted (offline licensing) is generally available, supporting compatible models and AWS Bedrock/Azure OpenAI configurations.
C/C++ support in Advanced SAST is generally available with cross-file, cross-function scanning.
Multiple Container Scanning allows passing an array of images to be scanned in CI jobs.
Provides the Credentials Inventory API for group owners to programmatically manage Personal Access Tokens, Group Access Tokens, Project Access Tokens, SSH Keys, and GPG Keys.
Group Owners can disable SSH keys for all enterprise users in their group.
Veracode Scan Engine adds open port scanning, HTTP header/TLS/fingerprinting detections in Dynamic Analysis DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Enterprise Mode
└──▷ HOW TO FIND IT
Enable open port scanning in Dynamic Analysis to identify exposed services during DAST Enterprise scans.
📍In the scan configuration for Dynamic Analysis (DAST Enterprise Mode), enable the 'scan for open ports' option.
Review newly detected HTTP header, TLS, and fingerprinting issues in your DAST Enterprise scan reports.
📍Run a new Dynamic Analysis (DAST Enterprise Mode) scan on your web application and check the results for HTTP headers, TLS, and fingerprinting findings.
Dynamic Analysis and DAST Enterprise Mode now support scanning web applications for open ports.
Scan engine includes new detections for HTTP headers, TLS, and fingerprinting.
Veracode adds open port scanning, HTTP header, TLS, and fingerprinting detections to Dynamic Analysis DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Enterprise Mode
Dynamic Analysis and DAST Enterprise Mode now support scanning web applications for open ports
New detections for HTTP headers, TLS, and fingerprinting in the scan engine
SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scans now fail on vulnerability findings when error Build Action is configured.
Build Action: error configuration for SCA agent-based scans now fails the scan when vulnerabilities are found
Custom policies applied in Veracode Platform trigger failure behavior for SCA agent scans
Phoenix Security correlates scanner, cloud and runtime findings with exploitability and ownership, and uses AI agents to prioritise and open remediation pull requests.
Phoenix Security adds Detectify scanner integration for asset and vulnerability ingestion
└──▷ HOW TO FIND IT
Configure a new Detectify integration by creating an API key in Detectify and inputting it into the Phoenix Security web UI under Integrations.
📍Navigate to Integrations › Scanners, select the Detectify template under WEB scanners, enter your Server URL and API key, then click Create.
Adds a new Detectify scanner template under Integrations > Scanners > WEB scanners to ingest vulnerabilities and assets from Detectify.
Adds Finding Status to Fetch selection during integration setup to filter findings by Accepted Risk, False Positive, or Patched status.
2 details in Everything
2 more releases in this issue
· 2026-01-22 → 2026-01-30
Adds Polaris Platform SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. integration via new Polaris Platform scanner template and API secret configuration in Phoenix Security
└──▷ HOW TO FIND IT
Configure a new SAST integration by selecting the specific template and entering credentials.
📍In the Phoenix Security console, go to Integrations › Scanners, hover over SAST scanners, click the Polaris Platform template, and enter your API Secret in the Client Secret field.
Adds a new Polaris Platform scanner template under Integrations > Scanners > SAST scanners for importing assets and vulnerabilities from Polaris Platform.
Phoenix Security adds native integration with Orca Security scanners for asset and vulnerability data ingestion.
└──▷ HOW TO FIND IT
Ingest cloud security posture and vulnerability data from an existing Orca tenant into Phoenix Security without manual CSV imports.
📍1. Log in to Orca as Org Admin. 2. Go to Settings › Users and Permissions › API, then create a Service Token with Viewer role. 3. In Phoenix, navigate to Integrations › Scanners. 4. Hover over Cloud scanners, click the Orca template. 5. Enter Scanner Name, Server URL, and the Orca API key. 6. Choose target accounts and save.
Adds Orca scanner template under Integrations > Scanners to ingest assets and vulnerabilities from Orca Security accounts.
DeepSource introduces SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. multi-IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. support with provider selection screen for users accessing multiple identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
Introduces a provider selection screen during login for users who have access to multiple IDPs
Openlayer adds batch test re-runs, new Ruby/Strands/Gemini/Copilot integrations, and CSICSIAn ambiguous acronym spanning Container Storage Interface, Crime Scene Investigation, and other expansions — without more context about which domain this tool operates in, a reliable definition cannot be given. drift detection
Adds Batch test re-runs to recalculate results when new data is added retroactively
Adds Openlayer Ruby SDK support for programmatic interaction
Adds Strands Agents SDK integration
Adds Microsoft Copilot Studio integration
Adds Google Gemini API integration
+5 moreshow less
Adds Custom time range selection for test execution
Adds Manual test re-runs capability
Adds New primary key uniqueness constraint test type
Adds API endpoints for retrieving test results and managing projects
Adds Characteristic Stability Index (CSI) as a drift detection method
Bearer v2.0.0 upgrades to go-tree-sitter with improved language grammar support, Python dataflow for default parameters, and language info in dataflow reports.
└──▷ GET THIS VERSION
$ git clone --branch v2.0.0 https://github.com/Bearer/bearer.git
# already have the repo? check out this version:$ git checkout v2.0.0
Adds dataflow tracking for Python default parameter values, improving data-flow analysis accuracy in Python codebases.
Adds language information to the dataflow report output, making it easier to identify which languages are involved in detected flows.
Updates engine internals to go-tree-sitter with refreshed language grammars, enabling more file types to be successfully parsed and analyzed.
Alert table supports configurable display options for grouping and badge ordering.
Adds configurable display options to alert tables, allowing users to control how alerts are grouped and which badges (e.g., priority, severity, action) appear first.
Threat Feed API adds publishedAt field to result objects
Adds publishedAt field to Threat Feed API responses (ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 8601 or null)
Exposes new timestamp in GET /v0/orgs/{org_slug}/threat-feed endpoint
Socket Python SDK gains OpenVEXOpenVEXAn open specification and Go library, maintained by the OpenVEX community, for expressing VEX (Vulnerability Exploitability eXchange) statements in a standard JSON format so cyber tools can automate vulnerability triage. export, archive support, and env var token auth
Adds openvex_bom method for exporting Software Bill of MaterialsSoftware Bill of MaterialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. in OpenVEX format
Adds support for initializing API tokens via environment variables instead of only constructor arguments
Adds new endpoint modules for Alerts, full scan search, Fixes, Supported Files, Webhooks, and Telemetry to the Socket API
Adds archive upload support for .tar, .tar.gz, .tgz, and .zip files
Adds lazy file loading for improved performance when scanning large workspaces
+2 moreshow less
Adds full scan rescan support and archive download capabilities
Adds dependencies_trend method for dependency history analysis
sbomify v0.25 adds Sigstore attestation verification, SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format. download support, compliance badges, and product lifecycle tracking.
└──▷ GET THIS VERSION
$ git clone --branch v0.25 https://github.com/sbomify/sbomify.git
# already have the repo? check out this version:$ git checkout v0.25
└──▷ TRY IT
Download an SBOM in the new SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 2.3 format via the API.
View the compliance status badge on your product's public page via the UI.
📍Navigate to Products › <Product Name> › Compliance tab in the console.
GitHub Attestation Plugin verifies SBOM attestations via Sigstore/cosign with automatic retry logic
Download SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. in SPDX 2.3 format (in addition to existing CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. support)
Product Lifecycle tracks release date, end-of-support, and end-of-life dates
Contact Role Flags allow marking contacts as authors, security contacts, or technical contacts
Compliance Badges display compliance status on product listings and public pages
+1 moreshow less
Copy Badge Button generates markdown badge snippets for READMEs
6 details in Everything
└──▷ BREAKING ON UPGRADE
!API error messages no longer leak team/resource info, returning generic Access denied; use the error_code field instead.
2 more releases in this issue
· 2026-01-04 → 2026-01-20
sbomify v0.24 adds a plugin-based compliance assessment framework with built-in NTIA, CISA, CRA, and FDA plugins
└──▷ GET THIS VERSION
$ git clone --branch v0.24 https://github.com/sbomify/sbomify.git
# already have the repo? check out this version:$ git checkout v0.24
└──▷ HOW TO FIND IT
Enable compliance assessments for your team in the UI.
📍Navigate to Settings → Plugins and toggle the plugins you wish to enable for SBOM upload validation.
Adds Settings → Plugins UI entry to enable the new plugin-based compliance assessment framework that runs automatically on SBOM upload
Introduces built-in compliance plugins for NTIA Minimum Elements, CISA 2025 Minimum Elements, EU Cyber Resilience Act (CRA), FDA Medical Device Cybersecurity, and Checksum Verification
Enables per-team plugin enablement with feature gating based on billing plans
Renames Contact profiles to use a 3-level hierarchy (Profile → Entity → Contact) aligned with CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. specification
sbomify v0.23 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.3 and 1.4 generation support
└──▷ GET THIS VERSION
$ git clone --branch v0.23 https://github.com/sbomify/sbomify.git
# already have the repo? check out this version:$ git checkout v0.23
syft v1.40.0 adds binary cataloging for Istio, Envoy, Grafana, and Valkey, plus PNPMPNPMA Node.js package manager that stores dependencies in a single content-addressable cache and links them into projects, saving disk space and speeding installs compared with npm or Yarn. dev-dependency filtering.
└──▷ GET THIS VERSION
$ git clone --branch v1.40.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.40.0
Supports filtering out development and test dependencies for PNPM packages from the generated SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
Catalogs Istio binaries (pilot-discovery, pilot-agent) for version detection.
Catalogs Envoy binary for version detection.
Catalogs Grafana binary for version detection.
Adds a binary classifier for Valkey to detect its version.
Nexus Repository 3.88.0 adds Terraform proxy repos, SQL search, new APIs/configs for capabilities and security
└──▷ USE IT
Enable URL validation to block private network access for SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. protection in nexus.properties.
env
nexus.proxy.allowPrivateNetworks=false
Adds proxy repository support for Terraform to cache providers and modules from registry.terraform.io
Replaces Elasticsearch with SQL database for all search operations to improve consistency and simplify deployment
Adds GET /v1/capabilities/types API endpoint to programmatically retrieve capability types and metadata
Introduces Repository: Browse Trim capability and Repair - Repository trim browse tree task to manage empty browse nodes
Adds nexus.security.password.iterations and nexus.security.secrets.iterations config keys in nexus.properties to control PBKDF2 encryption strength
+1 moreshow less
Adds optional URL validation for SSRF protection via nexus.proxy.allowPrivateNetworks=false config key in nexus.properties
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The Repair - Execute Data Repair Plan task is disabled by default and fails if attempted, requiring nexus.reconcile.task.enabled=true to re-enable manually until support is restored
!SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. authentication now strictly requires the entityId in the IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. response to match the entityId configured in Nexus Repository
GuardDog v2.8.2 adds RubyGems scanning and new detections for DNS exfiltration, API obfuscation, and dynamic code execution.
└──▷ GET THIS VERSION
$ git clone --branch v2.8.2 https://github.com/DataDog/guarddog.git
# already have the repo? check out this version:$ git checkout v2.8.2
New detection: identifies sensitive data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. via DNS tunneling in Python packages.
Improved detection of base64 execution using codecs and importlib dynamic imports in Python.
Improved detection of code execution via compile() and vars() indirection in Python.
New API obfuscation detection rule for npm (JavaScript) packages.
Improved API obfuscation detection rule for Python packages.
+1 moreshow less
Adds support for scanning RubyGems packages alongside existing PyPI and npm support.
6 details in Everything
1 more release in this issue
· 2026-01-09 → 2026-01-16
Spectra Assure Community adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Registry support for AI server packages and AI-generated vulnerability summaries.
Adds MCP Registry support as a meta-index for npm, PyPI, and NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. packages labeled as MCP servers
Adds AI summary generation for detected vulnerabilities in community reports
2 details in Everything
1 more release in this issue
· 2026-01-15 → 2026-01-29
LavaMoat Node now returns the top-level export as the return value of runLava
└──▷ GET THIS VERSION
$ git clone --branch lavamoat-v10.1.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout lavamoat-v10.1.0
Apiiro maps an application's architecture and risk graph and runs AI-SAST, SCA, secrets, API and threat-modeling checks on AI- and human-written code.
Apiiro org-level API Inventory is GA: central view of APIs linked to runtime endpoints with filtering by method, language, app, repo, insights, or team.
Introduces the Org level API Inventory feature for a centralized view of all detected APIs across the organization.
Enables mapping the real API attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. by linking detected APIs to runtime endpoints from integrations like Akamai API Security or Salt Security.
Allows filtering and drilling down the inventory by HTTP method, language, app, repo, insights, or team for focused triage.
Invicti adds target config snapshots, proxy support for internal agents, and URL rewrite rules for DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans
Adds the ability to store a snapshot of target configuration for each scan
Adds proxy support when the internal scanning agent connects back to the platform
Adds custom URL rewrite rules for DAST scans on larger sites
3 details in Everything
2 more releases in this issue
· 2026-01-08 → 2026-01-22
Invicti adds target config snapshots, custom URL rewrites for DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces., and auto-pause for recurring scans.
Adds functionality to store a snapshot of target configuration for each scan
Introduces custom URL rewrite rules for DAST scans on larger sites to improve scan efficiency
Adds safeguards to automatically pause recurring scans after five consecutive failures
Supports IdP-initiatedIdP-initiatedA SAML or OIDC login flow where the identity provider starts the session and pushes an assertion to the service provider without the user first requesting access, removing the SP-side redirect step.SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. user provisioning and non-standard OAuth authorization flows in the scanning engine
Adds support for automatic user provisioning during IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.-initiated SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. login
Enhances the scanning engine to support non-standard OAuth authorization flows
nuclei v3.7.0 adds RSYNC protocol support and a new CDPCDPCisco Discovery Protocol, a Cisco-proprietary Layer 2 protocol that advertises device identity, capabilities, and topology between directly connected Cisco gear, giving cyber tools a passive way to map network infrastructure.WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. endpoint option for headless browser control.
└──▷ GET THIS VERSION
$ git clone --branch v3.7.0 https://github.com/projectdiscovery/nuclei.git
# already have the repo? check out this version:$ git checkout v3.7.0
└──▷ TRY IT
Connect headless scans to an already-running remote Chrome instance instead of spawning a local browser — useful in containerised or remote-browser setups.
Infisical v0.158 adds PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. defaults, ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. EAB skip, CircleCI sync, and OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code./Windows secret rotation
└──▷ GET THIS VERSION
$ git clone --branch v0.158.0 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.158.0
defaultTtl setting on certificate profiles in the UI to set default certificate validity periods
Certificate details page viewable from the PKI UI for inspecting issued certificates
--suborganization-id (parameter suborganizationSlug) on identity login API endpoints for multi-org accounts
circle-ci sync integration added under Integrations for automatic secret sync to CircleCI projects
skip-eab-validation option in the ACME enrollment configuration UI to bypass External Account Binding checks
+2 moreshow less
OpenRouter secret rotation target available under Secret Rotation for automated API key updates
Windows Local Account secret rotation target added for credential management on Windows hosts
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The API endpoint parameter suborganizationId is renamed to suborganizationSlug when logging in via identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.; existing integrations using the old name must update their requests.
12 more releases in this issue
· 2026-01-05 → 2026-01-29
New PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. approval workflows and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server support with tool selection in Infisical
└──▷ GET THIS VERSION
$ git clone --branch v0.157.0 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.157.0
└──▷ HOW TO FIND IT
Review and approve certificate requests through the new PKI workflow interface
📍Steps: Navigate to the Security tab, select PKI, then access Approvals to review pending certificate issuance requests.
Configure an MCP server endpoint to expose only specific tools or all available tools at once
📍Steps: In the Agent Settings, create a new MCP server endpoint and use the Select/Deselect All control in the tool configuration panel.
Introduces PKI approval workflows to manage certificate issuance via a review process
Adds gateway support for MCP servers in agent-sentinel
Adds select/deselect all tools option for MCP server endpoints
Add agent-sentinelPIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. filtering via config and a one-click approval UI button in the frontend.
└──▷ GET THIS VERSION
$ git clone --branch v0.156.0 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.156.0
Adds granular PII filtering for agent-sentinel with configurable entity types
Adds a approve and merge button to change requests in the frontend when conditions are met
Adds intermediate CA issuance via certificate profiles, Cassandra dynamic secrets in vault migration, and name-based RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. endpoints.
└──▷ GET THIS VERSION
$ git clone --branch v0.155.7 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.155.7
certificate_profiles now support issuing intermediate CAs
vault-migration adds cassandra dynamic secret support
agent-sentinel MCP endpoint RBAC now supports name conditions
Adds custom branding to secret shares and Bearer TokenBearer TokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. auth for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers
└──▷ GET THIS VERSION
$ git clone --branch v0.155.5 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.155.5
└──▷ HOW TO FIND IT
Allow practitioners to configure custom branding for shared secrets via the UI.
📍In the infisical service UI, navigate to Secret Share settings and enable custom branding options.
Enable Bearer Token authentication when configuring an MCP server in agent-sentinel.
📍In the agent-sentinel configuration for the MCP server, add bearer_token to the authentication section.
feat(secret-share): custom branding support enables custom branding on shared secrets.
feat(agent-sentinel): add Bearer Token authentication support for MCP servers adds Bearer Token auth to agent-sentinel MCP server integrations.
Adds Databricks secrets rotation, SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. events, Redis PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. access, and KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. key export
└──▷ GET THIS VERSION
$ git clone --branch v0.155.2 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.155.2
feature: add secrets rotation for Databricks introduces automated secrets rotation for the Databricks integration.
feat(scim): support for scim events adds support for processing incoming SCIM events.
feature: add redis resource access for PAM enables Privileged Access ManagementPrivileged Access ManagementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. (PAM) connections to Redis resources.
feat: add export support for kms keys allows exporting KMS keys.
Adds Oracle DB wallet support for self-hosted instances and PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. access modal callout
└──▷ GET THIS VERSION
$ git clone --branch v0.155.1 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.155.1
Enables use of Oracle Wallet for oracleDB connections in self-hosted Infisical installations via new configuration option.
Adds a request access modal callout to the Privileged Access ManagementPrivileged Access ManagementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. (PAM) flow.
Infisical v0.155.0 adds PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. integration, machine identity groups, dynamic secret audit logs, and SQL rotation queries
└──▷ GET THIS VERSION
$ git clone --branch v0.155.0 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.155.0
machine identity groups feature allows grouping of machine identities for easier management
add skip dns ownership validation option for acme cert profile to allow ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. certificate issuance without DNS validation checks
pam findByPath function improvement enables faster lookups by path in the Privileged Access ManagementPrivileged Access ManagementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. system
certificate based auth for ssh feature enables SSH authentication using certificates within PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.
octopus deploy app-connection + secret-sync integration adds support for syncing secrets to Octopus Deploy
+4 moreshow less
expose and rename external group mappings endpoint in SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. API documentation for better discoverability
audit logs for dynamic secrets and leases feature provides detailed logging of dynamic secret lifecycle events
sql rotation query option and password policy enforcement allows custom SQL queries for rotating credentials
agentic manager feature introduces new capabilities for managing agents within the platform
Secretlint v11.3.0 adds --format=github to output annotations for GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure.
└──▷ GET THIS VERSION
$ git clone --branch v11.3.0 https://github.com/secretlint/secretlint.git
# already have the repo? check out this version:$ git checkout v11.3.0
└──▷ USE IT
Scan files and output results as GitHub Workflow commands for inline PR annotations.
GitGuardian expands NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems. to Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. and AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. with unified identity mapping, risk scoring, and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication.
Expands NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. Governance integrations for Microsoft Entra ID and AWS IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. with an enriched graph of identities, policies, and secrets.
Introduces automatic risk criticality scoring to surface high-impact threats like leaked credentials and orphaned accounts
Enables credential-free, short-lived token-based access via OIDC for the new identity integrations
GitGuardian 2026.1 adds NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. integrations (Datadog, Snowflake, Okta, Auth0), GCP Marketplace deployment, enriched secret names, and Unified Identity Governance for Entra/AWS.
More NHI Integrations supports non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. discovery across Datadog, Snowflake, Okta, and Auth0
Unified Identity Governance offers risk-based prioritization for Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. and AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. with secret-less OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication
Google Cloud Marketplace availability enables GitGuardian deployment on GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. with consolidated billing
Secrets Detection Engine v2.153 includes 6 new detectors (HighLevel, Elastic, Google Cloud Keys, Socket Dev, Upstash Redis, Vapid Key)
+4 moreshow less
Secrets Detection Engine v2.154 adds 3 new detectors (Cloudflare R2, Azure SAS URL, MySQL) and 1 new checker (Tailscale SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.)
Secrets Detection Engine v2.155 includes 18 new detectors including Oracle, Azure Entra App Secret, GitLab SCIM, and MongoDB
Incident API now returns enriched secret names in CSV/JSON exports
Detector settings include a Recommended for business filter to identify non-business detectors disabled by default
9 details in Everything
└──▷ BREAKING ON UPGRADE
!KOTS Embedded installations must manually delete the PostgreSQL StatefulSet before upgrading to 2026.1
$ git clone --branch v2.13.2 https://github.com/Konloch/bytecode-viewer.git
# already have the repo? check out this version:$ git checkout v2.13.2
Adds native macOS menubar integration for a more platform-consistent UI experience.
Adds Russian language translation to the UI.
Supports Java 25 LTS in the build, enabling analysis of Java 25-compiled bytecode.
Updates ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. library to version 9.9, expanding bytecode parsing support.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The built-in obfuscator has been removed; workflows relying on it must use an alternative tool.
Adds organization- and project-level Jira integration settings for ticket creation, linking, and bulk management
Configures Jira integration settings at the organization level with optional project-level overrides
Creates Jira tickets for individual findings or SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. components, or generates them in bulk
Displays linked Jira ticket details directly within the Findings and BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. data tables
Allows unlinking of Jira tickets from findings or components when needed
Tracks all Jira ticket creation and management activity in the audit trail
5 details in Everything
1 more release in this issue
· 2026-01-08 → 2026-01-29
Capstone 6.0.0-Alpha6 adds M68K displacement size fields, broader x86 register semantics, and free-threaded CPython 3.14 support.
└──▷ GET THIS VERSION
$ git clone --branch 6.0.0-Alpha6 https://github.com/aquynh/capstone.git
# already have the repo? check out this version:$ git checkout 6.0.0-Alpha6
Adds displacement size fields to the M68K disassembler, exposing richer operand detail for M68K instructions.
Expands x86 read/written register tracking to cover call, interrupt, interrupt-return, string, loop, conditional jump, unconditional jump, system call, enter/leave, procedure return, and cmpxchg instructions.
Supports Python 3.14 free-threaded (no-GIL) CPython builds in the Python binding.
Handles previously ignored operands in M68K, including displacement and suppressed register details.
Builds static Capstone libraries with PIC enabled, enabling use in shared-library contexts.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The csh and value arguments of cs_option are now of type uintptr_t instead of their previous types, which may require source-level changes in code passing these arguments.
!Alpha architecture immediate operands are now typed as int64_t; code reading these fields as a narrower or unsigned type will need updating.
Frida 17.6.0 adds FORCE attach flag, removes Zygote injection for Android stability and reworks SELinuxSELinuxA mandatory access control system built into the Linux kernel, maintained by the NSA and Red Hat, that enforces fine-grained policies restricting what processes can access, even if they run as root. support.
Adds the Interceptor FORCE attach flag for inline hooking functions too small to patch safely; it may overwrite bytes past the function’s end and requires care.
Generalizes frida-helper.dex from non-rooted Android to the Linux and Droidy backends, adding activity launch and broadcast requests while eliminating internal system_server injection and the frida-java-bridge dependency.
osdfir-infrastructure 2.7.4 adds NGINX to the default OpenRelik Helm chart deployment.
└──▷ GET THIS VERSION
$ git clone --branch osdfir-infrastructure-2.7.4 https://github.com/google/osdfir-infrastructure.git
# already have the repo? check out this version:$ git checkout osdfir-infrastructure-2.7.4
2 more releases in this issue
· 2026-01-05 → 2026-01-27
Adds extra audiences config support to the Yeti Helm chart for flexible authentication setups.
└──▷ GET THIS VERSION
$ git clone --branch osdfir-infrastructure-2.7.1 https://github.com/google/osdfir-infrastructure.git
# already have the repo? check out this version:$ git checkout osdfir-infrastructure-2.7.1
osdfir-infrastructure 2.6.4 adds Celery Flower monitoring to the Timesketch, Yeti, and OpenRelik Helm charts.
└──▷ GET THIS VERSION
$ git clone --branch osdfir-infrastructure-2.6.4 https://github.com/google/osdfir-infrastructure.git
# already have the repo? check out this version:$ git checkout osdfir-infrastructure-2.6.4
Adds AbuseIPDB Report Responder analyzer in v3.7.3
└──▷ GET THIS VERSION
$ git clone --branch 3.7.3 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.7.3
└──▷ HOW TO FIND IT
Submit a malicious IP address to AbuseIPDB via TheHive or Cortex to trigger an automated report.
📍<no CLI entry point provided in release notes; requires integration into TheHive/Cortex playbook>
3 more releases in this issue
· 2026-01-05 → 2026-01-21
Cortex Analyzers 3.7.2 surfaces integration type and subscription info in analyzer/responder context.
└──▷ GET THIS VERSION
$ git clone --branch 3.7.2 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.7.2
Adds integration type and subscription info to the context available to analyzers and responders.
Cortex Analyzers 3.7.1 adds urlDNA.io integration for URL analysis.
└──▷ GET THIS VERSION
$ git clone --branch 3.7.1 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.7.1
Cortex Analyzers 3.7.0 adds a CrowdStrike Falcon Threat Intelligence analyzer.
└──▷ GET THIS VERSION
$ git clone --branch 3.7.0 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.7.0
Volatility 3 v2.27.0 adds PEB masquerade detection, Arrow/Parquet output, and enhanced DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls./VAD plugins.
└──▷ GET THIS VERSION
$ git clone --branch v2.27.0 https://github.com/volatilityfoundation/volatility3.git
# already have the repo? check out this version:$ git checkout v2.27.0
Adds Arrow/Parquet format renderer for structured, columnar output of analysis results.
Enhances windows.dlllist plugin with improved capabilities.
Improves linux.malfind and linux.lsof plugins.
Windows executable binary now included as part of the official release cycle.
Hindsight v2026.01 adds Chrome Sync Data parsing, permission_actions extraction, Login Data For Account support, and a richer CLI UI.
└──▷ GET THIS VERSION
$ git clone --branch v2026.01 https://github.com/obsidianforensics/hindsight.git
# already have the repo? check out this version:$ git checkout v2026.01
Adds parsing of Chrome Sync Data, including originator GUIDs and simplified labels for sync records.
Adds parsing of permission_actions from the Chrome Preferences file.
Adds support for parsing the Login Data For Account database in Chrome.
Adds translation of accountcapabilities from Preferences to human-readable values.
Introduces the rich library for improved CLI UI/UX and artifact processing output.
+5 moreshow less
Expands JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output with parsing for Chrome IndexedDB, Extension Storage, Sync Data, and Installed Extensions record types.
Improves SQLite output to be comparable to XLSX and JSONL outputs.
Adds updated parsing for changes to DIPS introduced in Chrome v142.
Adds new danger_type and interrupt_reason codes for download artifact analysis.
Adds generic parsing for simple preference timestamp values.
Joe Sandbox v44 adds SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access./HTTP proxy support for phishing evasion, Sentinel integration, and macOS Sonoma/Sequoia
└──▷ HOW TO FIND IT
Analyze a phishing URL using residential proxies in Joe Sandbox Cloud Pro to bypass bot detection.
📍Use the Joe Sandbox Cloud Pro interface to configure proxy settings (SOCKS/HTTP) for the analysis job.
Send suspicious artifacts from Microsoft Sentinel to Joe Sandbox and ingest the behavioral report back into Sentinel.
📍Configure the Joe Sandbox connector in Microsoft Sentinel workflows, pointing analysis requests to your Joe Sandbox API endpoint.
Added SOCKS / HTTP Proxy Support to Joe Sandbox Cloud Pro to evade IP-based reputation and bot detection during phishing analysis.
Added Module Proxy Detection to expose stealthy DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. loading techniques (e.g., proxying kernel32!LoadLibrary via ntdll) used to hide C2 beacons.
Added Microsoft Sentinel Integration to push Joe Sandbox analysis results back into Microsoft Sentinel workflows for enriched incident context.
Added Support for macOS Sonoma and Sequoia to the macOS analysis environment.
malwaredb-rs v0.3.0 adds Yara search and database migration admin feature
└──▷ GET THIS VERSION
$ git clone --branch v0.3.0 https://github.com/malwaredb/malwaredb-rs.git
# already have the repo? check out this version:$ git checkout v0.3.0
└──▷ TRY IT
Deploy the service using the new GitHub Container Registry image for v0.3.0.
$ docker pull ghcr.io/malwaredb/malwaredb:v0.3.0
Adds a new Yara search capability allowing users to search accessible files with Yara rules; completed searches expire after one day.
Introduces an experimental admin feature to migrate the database schema, required because SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications./256/384/512 hashes are now stored in Postgres as bytea and MD5/Import Hash as uuid.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!SHA-1, SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data., SHA-384, SHA-512 hashes are now stored in Postgres as bytea instead of their previous format.
!MD5 and Import Hash fields are now stored in Postgres as uuid instead of their previous format.
Cortex XSOAR 8.12 adds conflict-free playbook editing and syslog forwarding for Management Audit logs
Enables centralized monitoring and satisfies log retention requirements by allowing the tool to forward Management Audit, Integration, and Guard Rails logs to a configured syslog server
Displays unique logos and content pack indicators for playbook tasks to distinguish between integration commands, custom scripts, and system actions
2 details in Everything
1 more release in this issue
· 2026-01-04 → 2026-01-25
Cortex Analytics adds 12 new detection detectors for AWS enumeration and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. activity, plus updated logic for IMDS access.
Adds detection for AWS EBS discovery operation
Adds detection for AWS EC2 discovery operation
Adds detection for AWS EC2 infrastructure enumeration activity
Adds detection for AWS IAM account discovery operation
Adds detection for AWS IAM permission groups discovery operation with variant Unusual AWS IAM permission groups discovery operation
+7 moreshow less
Adds detection for AWS Lambda discovery operation
Adds detection for AWS Lambda infrastructure enumeration activity
Adds detection for AWS S3 Buckets enumeration activity
Adds detection for AWS S3 discovery operation
Adds detection for Cloud storage object discovery
Adds detection for Local user enumeration via SAMR with variant [Low] Local user enumeration via SAMR on an internet facing server
Modifies logic for Unusual cloud Instance Metadata Service (IMDS) access to raise severity to Medium for unusual known shell or web service processes
Sophos Firewall 22.0 adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline.-benchmarked health checks, a new hardened control plane, XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss./Taegis integration, and TLS 1.3 admin access.
└──▷ HOW TO FIND IT
Review your firewall's CIS benchmark compliance and security posture immediately after upgrading to 22.0.
📍In the web admin console, go to Control Center and review the Firewall health check panel, then select Firewall health check in the main menu to drill down into high-risk configurations and actionable recommendations.
Enable proactive web browsing alerts for schools or regulated environments to catch policy violations in real time.
📍In the web admin console, go to Web › Categories, locate the category or keyword rules you want to monitor, and turn on instant alerts to receive real-time email notifications including date, time, user, category, and domain.
Select an NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. Essentials data center region to satisfy data residency requirements instead of using the default lowest-latency region.
📍In the web admin console, navigate to the NDR Essentials settings and select your required data center region for flow analysis under the data center selection option.
Adds device_name field to syslog output identifying the hostname of the firewall that produced each log, enabling differentiation across multiple firewalls in XDR and Taegis environments.
Enables instant alerts for web categories and keywords when turned on in Web > Categories, delivering real-time email notifications with date, time, user, category, and domain details.
Adds data center region selection for NDR Essentials flow analysis to meet data residency requirements, defaulting to the lowest-latency region.
Adds threat score to Active Threat Response logs for NDR Essentials, enhancing visibility and analytics.
Adds a new Firewall Health Check feature that evaluates dozens of configurations against CIS benchmarks, accessible via a new panel on the Control Center page and the Firewall health check main menu item.
+14 moreshow less
Integrates Sophos XDR Sensor for Linux for continuous real-time system integrity monitoring, detecting unauthorized configurations, rule exports, malicious program execution attempts, and file tampering.
Introduces an all-new Xstream control plane enabling modularization, isolation, and containerization of services (such as IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection.) with complete privilege separation and self-healing capability.
Builds the next-generation Xstream architecture on a hardened Linux kernel v6.6+ with tighter process isolation, KASLR, stack canaries, hardened usercopy, and mitigations for Spectre, Meltdown, L1TF, MDS, Retbleed, ZenBleed, and Downfall.
Integrates Taegis XDR and MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. with Active Threat Response, allowing malicious IPs, domains, and URLs to be pushed from the Taegis portal to block threats across all firewall subsystems with no manual configuration.
Integrates the latest Sophos anti-malware engine with AI/ML model detections, zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. protection, global reputation lookups, and SophosLabs cloud database updates every five minutes or less.
Adds TLS 1.3 support for the web admin console, VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. portal, and user portal.
Adds public key authentication for SSH admin access, limited to the default admin for adding and deleting keys.
Adds granular logging controls for inbound and outbound traffic to reduce noise from repetitive events such as brute-force attacks.
Adds inbound forwarded traffic matching (WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. and DNAT) against MDR threat feeds, NDR Essentials, and third-party threat feeds, plus outgoing source matching for NDR Essentials and third-party threat feeds.
Includes a major upgrade to Samba components for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments.SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., adding improved support for Windows Server 2025 and removing older encryption protocols.
Adds pagination, search, and filter options for XFRM interfaces in the web admin console.
Creates individual incoming and outgoing firewall rules with zone-based traffic control for site-to-site IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. VPN connections instead of a single combined rule.
Enables navigation to any menu item or tab in the web admin console without waiting for the current page to load.
Optimizes DPDK memory in the DAQ layer for XGS 87/87w, 107/107w, and 116/116w desktop firewalls, eliminating out-of-memoryout-of-memoryAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process. instances.
19 details in Everything
└──▷ BREAKING ON UPGRADE
!SFOS 22.0 GA and later versions do not support XG and SG Series hardware appliances.
!Active Directory SSO Samba upgrade removes support for older encryption protocols, which may break AD authentication for environments relying on them.
!Existing allowed IP addresses for XML API access are automatically converted to IP host objects prefixed with apiconfig on upgrade.
Vectra AI v9.8 adds Traffic Lockdown firewall integration and Operational Overview Report.
└──▷ HOW TO FIND IT
Automatically block malicious hosts at the network edge by integrating with your firewall infrastructure.
📍Visit Traffic Lockdown for configuration instructions.
Monitor SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. performance metrics and investigation efficiency in a single visual dashboard.
📍Access the Operational Overview Report from your Vectra AI dashboard to view Mean Time to Assignment, Mean Time to Investigate, and Mean Time to Resolve.
Adds Traffic Lockdown, an automated network defense capability that publishes threat feed IPs to supported firewalls for immediate enforcement.
Introduces the Operational Overview Report, a visual dashboard displaying Mean Time to Assignment, Mean Time to Investigate, and Mean Time to Resolve alongside top detections and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. mappings.
Vectra AI v9.8 adds seven new Azure suspect operation detections, improves Smash and Grab accuracy, and introduces a native Threat Intelligence engine.
Introduces native detection for Azure Suspect Operation - DNS Security Policy Modification to identify deletion or modification of DNS Security Policy resources
Introduces native detection for Azure Suspect Operation - Flow Logs Disabled to identify deletion of Azure flow log resources
Introduces native detection for Azure Suspect Operation - Network Security Config Change to identify creation or modification of Azure network security groups or firewalls
Introduces native detection for Azure Suspect Operation - High-Risk Deletion to identify removal of sensitive backups and immutability policies
Adds new detection Azure AD Suspect Operation: Guest User Added to surface suspicious external guest user invitations inconsistent with behavioral profiles
+2 moreshow less
Adds new detection Azure AD Suspect Operation: Unusual Sign-On from a Proxy leveraging the new Threat Intelligence engine for sign-in behavior analysis
Improves Smash and Grab detection accuracy by ensuring destination domain names update correctly later in a session
Enhanced visibility for blocked Microsoft Teams attacks with expanded signal details and attachment analysis in Threat Log
└──▷ HOW TO FIND IT
Review the specific signals that caused a Teams message to be blocked to tune detection policies or reassure users.
📍Navigate to the Threat Log in the Abnormal AI console and select a blocked Teams message to view its threat details.
Blocked Microsoft Teams attacks now display human-readable threat reasons explaining the detection outcome.
Malicious URL analysis surfaces expanded data across 13+ signals including phishing likelihood, malware likelihood, suspicious URL patterns, redirects, domain age, DNS validation, and IP/country context.
Malicious attachment analysis provides deeper file inspection with static analysis results, prior Abnormal verdicts, Microsoft verdicts, and metadata such as name and size.
Abnormal AI adds structured explanations for misdirected email detections in the Outbound Log
└──▷ HOW TO FIND IT
Understand why an outbound message was flagged as misdirected by reviewing structured risk signals in the Outbound Log.
📍In the console, go to Outbound Log › click a detected item › Review the updated Analysis Overview for plain-language reasons and key risk signals
Compare who was intended vs. who received the email using new recipient context.
📍In the Outbound Log › click a detected item › View "more likely / less likely recipient" context
Investigate specific content contributing to the detection by viewing highlighted text.
📍In the Outbound Log › click a detected item › Switch to Text Analysis to see highlighted entities and phrases
Adds an updated Analysis Overview with plain-language reasons and key risk signals (such as rare recipient behavior and autofill risk) for misdirected email detections
Adds "more likely / less likely recipient" context to compare the intended recipient with who actually received the email
Adds a switch to Text Analysis to view highlighted entities and phrases in the email content that contributed to the misdirected email decision
Adds CC Managers in JIT Reminders setting to AI Phishing Coach for automated manager notifications.
└──▷ HOW TO FIND IT
Automate manager visibility for incomplete phishing training by enabling the new CC toggle in AI Phishing Coach advanced settings.
📍In the console, go to Settings › AI Phishing Coach › Simulation Settings, expand Advanced Settings and enable CC Managers in JIT Reminders.
Adds CC Managers in JIT Reminders toggle under Settings > AI Phishing Coach > Simulation Settings > Advanced Settings to automatically CC managers on JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. training reminder emails.
Snort 3.10.2.0 adds configurable midstream AppID discovery, QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. AppID priority, and a new show_flows utility for binary flow-state dumps.
└──▷ GET THIS VERSION
$ git clone --branch 3.10.2.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.10.2.0
└──▷ TRY IT
Convert a binary dump_flows capture to human-readable text for offline analysis or ingestion into a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
$ show_flows <path-to-binary-dump>
Adds configurable midstream service discovery in AppID, enabling detection of sessions that begin before Snort starts inspecting.
AppID now prefers QUIC client application ID over SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. when both are available, improving accuracy for QUIC traffic classification.
Refactors dump_flows command to output flow state in binary format for more efficient storage and processing.
Introduces show_flows utility program to convert dump_flows binary files into human-readable text containing flow state data for each flow.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The dump_flows command now outputs flow state in binary format instead of text; existing tooling or scripts that parse plain-text dump_flows output will break and must be updated to use the new show_flows utility.
1 more release in this issue
· 2026-01-13 → 2026-01-22
Snort3 3.10.1.0 adds AppID JSON logging, out-of-order packet inspection, mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing. parsing, MIME multipart/form-data content parsing, and ML client body scanning.
└──▷ GET THIS VERSION
$ git clone --branch 3.10.1.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.10.1.0
Adds AppID application-ID logging support to the alert_json output module.
Enables out-of-order packet inspection in the AppID third-party engine, now on by default.
Adds mDNS TXT record parsing and deviceinfo event generation in AppID.
Implements content parsing of multipart/form-data in the MIME processor.
Adds flow creation failure logging to surface the different ways a flow can fail to be established.
+9 moreshow less
Adds is_urlencoded method to the pub_sub API.
Adds urlencoded content-type to the http_inspect recognized content-type list.
Enables snort_ml client body scanning by default.
Adds snort_ml scanning of multipart form data.
Adds TransbridgeCodec encode function to the decoder.
Adds configurable cmd_len in ftp_telnet for improved command-length control.
Adds alerting on malformed FTP traffic in ftp_telnet.
Updates SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments./DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. filename and filesize handling in FileInfo to enable DLP evaluation for repeated transactions.
Adds SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. config command usage support.
CrowdSec v1.7.5 adds flexible key-value parsing and AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. transaction ID tracing for improved log analysis and request correlation.
└──▷ GET THIS VERSION
$ git clone --branch v1.7.5 https://github.com/crowdsecurity/crowdsec.git
# already have the repo? check out this version:$ git checkout v1.7.5
Adds ParseKVLax for flexible, lenient key-value parsing in parser expressions.
Supports transaction ID header injection in AppSec for end-to-end request tracing.
Adds JSON schema validation for the Docker datasource configuration.
Malcolm v26.01.0 replaces its file scanning framework with Strelka, adds JA4D log parsing, fuzzy hashing, and major Logstash pipeline performance improvements.
└──▷ GET THIS VERSION
$ git clone --branch v26.01.0 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v26.01.0
└──▷ USE IT
Tune the maximum search result window for large network dataset queries without hitting the default 10 000 document cap.
ini
# In ./config/opensearch.env
MALCOLM_INDEX_MAX_RESULT_WINDOW=50000
Switch FileBeat to fingerprint-based file identity so renamed or rotated log files are not re-ingested from the start.
ini
# In ./config/filebeat.env
FILEBEAT_WATCHER_POLLING=false
FILEBEAT_SCANNER_FINGERPRINT_OFFSET=0
FILEBEAT_SCANNER_FINGERPRINT_LENGTH=1024
Adds filescan.env, filescan-secret.env, and pipeline.env config files, plus variables in redis.env, to configure the new Strelka-based file scanning backend — replacing the previous EXTRACTED_FILE_ENABLE_CAPA, EXTRACTED_FILE_ENABLE_CLAMAV, and EXTRACTED_FILE_ENABLE_YARA env vars.
Adds FILEBEAT_SCANNER_FINGERPRINT_OFFSET and FILEBEAT_SCANNER_FINGERPRINT_LENGTH in filebeat.env to customize FileBeat filestream file identity and scanner fingerprint; FILEBEAT_WATCHER_POLLING now controls native- vs. fingerprint-based file identification.
Adds MALCOLM_INDEX_MAX_RESULT_WINDOW in opensearch.env to override index.max_result_window (default 10000) for searches of network and other data indexes.
Replaces the file scanning framework with Strelka, a real-time, container-based file scanning system for threat hunting, threat detection, and incident response, providing more features and improved extensibility.
Enables fuzzy hashing (SSDeep, TLSH) in addition to SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. for all Zeek-scanned files.
+6 moreshow less
Adds additional health check data (Redis, etc.) to the /mapi/ready API.
Enables parsing of JA4D log generated by Zeek alongside dhcp.log.
Enables MAC addressesMAC addressesA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. in Suricata events.
Updates default NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment.-enriched datasets (LOGSTASH_NETBOX_ENRICHMENT_DATASETS in logstash.env) to include filescan.strelka alongside existing Zeek and Suricata datasets.
Delivers major Logstash parse pipeline performance improvements: replaced the cidr filter with a custom Ruby filter, changed broadcast-and-drop communication to targeted messaging, and reworked the compact event filter to remove empty/null values before indexing.
Improves the IP Connections Tree dashboard.
11 details in Everything
└──▷ BREAKING ON UPGRADE
!The VTOT_API2_KEY environment variable for submitting extracted file SHA sums to VirusTotal is no longer used; use the Google Threat Intelligence service or another supported intelligence feed instead.
!Adding a new log source parsing pipeline to Logstash no longer uses LOGSTASH_PARSE_PIPELINE_ADDRESSES; a mapping file is now required instead.
!EXTRACTED_FILE_ENABLE_CAPA, EXTRACTED_FILE_ENABLE_CLAMAV, and EXTRACTED_FILE_ENABLE_YARA are no longer used; scanners are now configured via the Strelka backend config file.
!The quarantine/ and preserved/ subdirectories are no longer used in the Extracted Files web interface; files are browsed and downloaded from the Files or File Scanning dashboards in OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. Dashboards.
!Malcolm's Zeek container image now places Zeek-related files under /usr/local/zeek instead of /opt/zeek; update any custom volume mounts or references to /opt/zeek.
!zeek-secret.env has been removed; its values are now in filescan-secret.env.
Inspektor Gadget v0.48.0 adds a Snapshot File gadget, container selector exclusions, and a new from_rootfs field in trace_exec.
└──▷ GET THIS VERSION
$ git clone --branch v0.48.0 https://github.com/inspektor-gadget/inspektor-gadget.git
# already have the repo? check out this version:$ git checkout v0.48.0
New snapshot-file gadget captures a point-in-time view of open files across processes.
Supports exclusion filters and multiple values in container selectors, enabling finer-grained gadget targeting.
Adds from_rootfs field to trace_exec gadget to indicate whether an executed binary originates from the container root filesystem.
Enables clear-screen-before display mode for profile gadgets in the CLI, giving cleaner live output.
Helm charts now include Kubernetes recommended labels by default, improving resource discoverability and compatibility with standard tooling.
Minimus adds File Bundles, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. groups, Activity Log, and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Postgres images
└──▷ HOW TO FIND IT
Use File Bundles to update certificates for all private images at once.
📍In the Minimus console, go to File Bundles and upload your certificate bundle; new versions trigger automatic image builds.
Assign roles to control access to private images and user management.
📍In User Management, assign viewer, operator, or admin roles based on RBAC requirements.
Monitor team activity including logins and image changes.
📍View the Activity Log to see when users logged in/out, created/updated images, or were added/removed.
Adds File Bundles to centrally manage certificates and file bundles for private images with versioning that triggers automatic builds.
Adds User Roles (viewer, operator, admin) to support RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for creating/editing images and managing users.
Adds Activity Log to audit user logins, image creation/updates, and user membership changes.
Adds SAML groups support for managing SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. users.
New TDXTDXIntel Trust Domain Extensions, a CPU feature that creates hardware-isolated virtual machines whose memory is encrypted and inaccessible even to the hypervisor, letting tools run workloads in a confidential computing environment./SNP runtimeclasses, arm64 QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. support in runtime-rs, iommufd enforcement for confidential guest VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space., and containerd v2.0+ -info flag
└──▷ GET THIS VERSION
$ git clone --branch 3.26.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:$ git checkout 3.26.0
kata-deploy now includes runtime-rs TDX / SNP runtimeclasses for deploying Intel Trust Domain Extensions and AMD Secure Nested Paging workloads.
The runtime-rs binary adds arm64 QEMU support, enabling the Rust runtime on ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. hosts without relying on the legacy Go implementation.
The shim now enforces iommufd for confidential guest VFIO device assignment, ensuring strict IOMMU isolation for secure VMs.
Both runtime and runtime-rs add -info flag support to query metadata for containerd v2.0+ compatibility.
4 details in Everything
1 more release in this issue
· 2026-01-19 → 2026-01-29
Kata Containers 3.25.0 adds VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space.-AP support on s390x, measured rootfs build support, and a kata-remote Helm runtime class.
└──▷ GET THIS VERSION
$ git clone --branch 3.25.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:$ git checkout 3.25.0
└──▷ USE IT
Verify the Kata agent is healthy after Helm installation.
shell
helm install kata kata/kata-containers --set kata.postInstallVerification.enabled=true
Build a measured rootfs using the new Makefile targets.
shell
cd src/runtime-rs
make measured-rootfs # Uses dedicated configuration keys
runtime-rs enables VFIO-AP hardware pass-through (hotplug only) for s390x platforms
kata-deploy adds post-install verification for the Helm chart via the post-install hook
runtime-rs supports measured rootfs builds through dedicated Makefile targets and configuration keys
Helm release provides a kata-remote runtime class definition
4 details in Everything
└──▷ BREAKING ON UPGRADE
!runk is officially deprecated in 3.25.0 and will be removed in 3.26.0
Docker CLI 29.2.0 adds experimental NRI support, image identity metadata, gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. native socket, and new Go SDK option
docker info now includes an nri section with experimental NRI support.
Inspection output now includes the identity field showing trusted origin information, build ref, remote registry repository, and verified signature info for signed provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. attestation.
Go SDK adds WithAPIClientOptions option in cli/command to configure the APIClient.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!On Windows, %PROGRAMDATA%\Docker\cli-plugins is removed from the list of paths used for CLI plugins (replaced by %ProgramFiles%\Docker\cli-plugins).
Trivy is a comprehensive security scanner that finds vulnerabilities, misconfigurations, secrets, and SBOM in containers, Kubernetes, code repositories, and clouds
Trivy 0.69.0 adds Julia scanning, Ansible misconf support, AnalyzedBy JSON field, and more
└──▷ GET THIS VERSION
$ git clone --branch 0.69.0 https://github.com/aquasecurity/trivy.git
# already have the repo? check out this version:$ git checkout 0.69.0
Adds initial ansible scanning support for infrastructure-as-code misconfigurations
Enables vulnerability scanning for the Julia language ecosystem
Adds support for ActiveState images
Adds AnalyzedBy field to track which analyzer detected packages
Adds JSON Schema for trivy.yaml configuration file via the flag feature
+3 moreshow less
Adds sslCertDir parameter to helm subcommand for custom certificate directories
Enables modular package vulnerability detection for rocky Linux
Supports per-repo TLS configuration for VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. sources
8 details in Everything
└──▷ BREAKING ON UPGRADE
!misconf: providers mapping now uses ID instead of AVDID
OpenSandbox java/code-interpreter v1.0.3 adds egress traffic control rules when creating sandboxes.
└──▷ GET THIS VERSION
$ git clone --branch java/code-interpreter/v1.0.3 https://github.com/opensandbox-group/OpenSandbox.git
# already have the repo? check out this version:$ git checkout java/code-interpreter/v1.0.3
Supports network policy configuration at sandbox creation time, with allow/deny rules for outbound (egress) traffic control.
1 detail in Everything
13 more releases in this issue
· 2026-01-07 → 2026-01-28
Adds network policy support for controlling egress traffic in OpenSandbox sandboxes
└──▷ GET THIS VERSION
$ git clone --branch python/sandbox/v0.1.4 https://github.com/opensandbox-group/OpenSandbox.git
# already have the repo? check out this version:$ git checkout python/sandbox/v0.1.4
Supports outbound (egress) traffic control with allow/deny rules when creating a sandbox.
OpenSandbox v0.1.3 adds network policy configuration for sandbox egress rules
└──▷ GET THIS VERSION
$ git clone --branch js/sandbox/v0.1.3 https://github.com/opensandbox-group/OpenSandbox.git
# already have the repo? check out this version:$ git checkout js/sandbox/v0.1.3
OpenSandbox v1.0.3 adds egress rule support for sandbox network policies
└──▷ GET THIS VERSION
$ git clone --branch java/sandbox/v1.0.3 https://github.com/opensandbox-group/OpenSandbox.git
# already have the repo? check out this version:$ git checkout java/sandbox/v1.0.3
OpenSandbox execd v1.0.4 adds configurable log output file and switches bootstrap shell to bash.
└──▷ GET THIS VERSION
$ git clone --branch docker/execd/v1.0.4 https://github.com/opensandbox-group/OpenSandbox.git
# already have the repo? check out this version:$ git checkout docker/execd/v1.0.4
└──▷ TRY IT
Redirect execd logs to a persistent volume path instead of stdout/stderr.
$ EXECD_LOG_FILE=/var/log/opensandbox/execd.log docker run opensandbox/execd:v1.0.4
Adds EXECD_LOG_FILE environment variable to configure the log output file path
Replaces sh with bash for bootstrap execution under docker/execd
Supports configuring the API grace shutdown timeout via the EXECD_API_GRACE_SHUTDOWN environment variable
└──▷ GET THIS VERSION
$ git clone --branch docker/execd/v1.0.3 https://github.com/opensandbox-group/OpenSandbox.git
# already have the repo? check out this version:$ git checkout docker/execd/v1.0.3
└──▷ TRY IT
Control how long the tool waits for in-flight SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. connections to close before terminating
$ EXECD_API_GRACE_SHUTDOWN=30s docker run opensandbox/execd:v1.0.3
Adds support for the EXECD_API_GRACE_SHUTDOWN environment variable to configure the SSE API grace shutdown timeout
Modifies the web framework from the previous implementation to Gin (#94)
OpenSandbox code-interpreter v1.0.1 allows appending to EXECD_ENVS
└──▷ GET THIS VERSION
$ git clone --branch docker/code-interpreter/v1.0.1 https://github.com/opensandbox-group/OpenSandbox.git
# already have the repo? check out this version:$ git checkout docker/code-interpreter/v1.0.1
Adds support for appending environment variables to the EXECD_ENVS configuration variable
$ git clone --branch docker/execd/v1.0.2 https://github.com/opensandbox-group/OpenSandbox.git
# already have the repo? check out this version:$ git checkout docker/execd/v1.0.2
└──▷ TRY IT
Query the new context management endpoints to inspect code state.
OpenSandbox v1.0.1 adds code context management API and run overloads
└──▷ GET THIS VERSION
$ git clone --branch java/code-interpreter/v1.0.1 https://github.com/opensandbox-group/OpenSandbox.git
# already have the repo? check out this version:$ git checkout java/code-interpreter/v1.0.1
Adds getContext, listContexts, createContext, deleteContext, and deleteContexts(language) methods to manage code execution contexts.
Adds convenience overloads for run: run(code, context), run(code, language), and run(code, language, handlers).
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Removed duplicated sandbox lifecycle methods (endpoint/info/metrics/renew/pause/resume/kill) from CodeInterpreter; must use sandbox directly.
OpenSandbox v0.1.1 adds code context management API and language-aware run convenience
└──▷ GET THIS VERSION
$ git clone --branch python/code-interpreter/v0.1.1 https://github.com/opensandbox-group/OpenSandbox.git
# already have the repo? check out this version:$ git checkout python/code-interpreter/v0.1.1
OpenSandbox SDK adds resumer entrypoint, extension map support, and /v1 API base URL.
└──▷ GET THIS VERSION
$ git clone --branch java/sandbox/v1.0.1 https://github.com/opensandbox-group/OpenSandbox.git
# already have the repo? check out this version:$ git checkout java/sandbox/v1.0.1
ConnectionConfig.getBaseUrl() now automatically appends /v1 to the base URL.
Sandbox.id is now a String instead of UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide..
Adds skipHealthCheck option for create, connect, and resume flows.
Adds dedicated Sandbox.resumer() entrypoint for resuming sandbox sessions.
OpenSandbox v0.1.1 adds skip_health_check flag, extension support, SandboxState constants, and response return for renew.
└──▷ GET THIS VERSION
$ git clone --branch python/sandbox/v0.1.1 https://github.com/opensandbox-group/OpenSandbox.git
# already have the repo? check out this version:$ git checkout python/sandbox/v0.1.1
└──▷ USE IT
Bypass slow health checks when creating a sandbox for quick local testing.
python
sandbox.create(skip_health_check=True)
Pass custom extensions when provisioning a new sandbox environment.
Adds skip_health_check parameter to Sandbox.create(...), Sandbox.connect(...), and Sandbox.resume(...) to bypass readiness checks
Adds extensions parameter to sandbox creation request, passed through to the lifecycle API
Adds SandboxState constants for expanded sandbox lifecycle state modeling
Sandbox.renew(...) and SandboxManager.renew_sandbox(...) now return a SandboxRenewResponse object containing expires_at
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The API base URL now requires /v1; ConnectionConfig.get_base_url() appends /v1, so if OPEN_SANDBOX_DOMAIN already contained /v1 you must remove it to avoid a double suffix.
!Sandbox IDs have changed from UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. type to str type across Sandbox, SandboxManager, and lifecycle models like SandboxInfo and SandboxCreateResponse.
OpenSandbox v1.0.0 adds a Kubernetes-native ingress controller for transparent L7 proxy routing.
└──▷ GET THIS VERSION
$ git clone --branch docker/ingress/v1.0.0 https://github.com/opensandbox-group/OpenSandbox.git
# already have the repo? check out this version:$ git checkout docker/ingress/v1.0.0
OpenSandbox execd v1.0.1 adds Windows support, CR-delimited output, and beta command status APIs
└──▷ GET THIS VERSION
$ git clone --branch docker/execd/v1.0.1 https://github.com/opensandbox-group/OpenSandbox.git
# already have the repo? check out this version:$ git checkout docker/execd/v1.0.1
Adds Windows platform support for the execd image.
Supports CR-delimited output format for command responses.
[beta] Exposes API endpoints to get command status and output, including exit info with RFC3339 timestamps.
Adds arg-max-count and arg-max-len settings to firejail.config to cap the number and length of arguments passed to sandboxed programs.
Adds env-max-count and env-max-len settings to firejail.config to cap the number and length of environment variables in the sandbox.
New --xephyr-extra-params= command allows passing additional parameters to Xephyr when running sandboxed X11 sessions.
New --allow-bwrap command forces use of the real bubblewrap (bwrap) binary; by default, Firejail now substitutes a dummy fbwrap program to work around glycin 2.0.0/gdk-pixbuf2 compatibility issues.
Adds new sandbox profiles for: ne (text editor), trivalent, openra, gzdoom/lzdoom/uzdoom, and quakespasm.
+1 moreshow less
rlimit values now accept uppercase suffixes (e.g., K, M, G) for human-readable resource limit configuration.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The --disable-globalcfg configure option has been removed; any build scripts using it will fail.
!Overlayfs support and the --overlay commands have been removed; profiles or scripts relying on --overlay will break.
!The Intrusion Detection System (IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity.) / fids component has been removed; any workflows invoking fids will break.
AzureHound v2.9.0 adds custom User-Agent flag, Jira transfer support, and Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. last logon timestamps.
└──▷ GET THIS VERSION
$ git clone --branch v2.9.0 https://github.com/SpecterOps/AzureHound.git
# already have the repo? check out this version:$ git checkout v2.9.0
└──▷ TRY IT
Blend AzureHound traffic into expected enterprise tooling patterns by spoofing a corporate User-Agent during a red team engagement.
$ azurehound --user-agent "Mozilla/5.0 (compatible; EnterpriseScanner/1.0)" list --tenant <tenant-id>
Adds a global --user-agent flag to customize the HTTP User-Agent string sent during collection.
Adds Jira transfer capability, enabling collected data to be sent directly to a Jira destination.
Collects Entra ID User Last Logon Timestamp as a property on AZUser nodes.
Cloud Custodian 0.9.49 adds AWS resolver-rule and Azure Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. resources, ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy. listener-rule filter, and HCL error failing for shift-left.
└──▷ GET THIS VERSION
$ git clone --branch 0.9.49.0 https://github.com/cloud-custodian/cloud-custodian.git
# already have the repo? check out this version:$ git checkout 0.9.49.0
└──▷ TRY IT
Inventory all Route 53 Resolver rules in your account to find shared or overly-permissive DNS forwarding rules.
$ custodian run -s out resolver-rules.yml
# resolver-rules.yml:
policies:
- name: resolver-rule-inventory
resource: aws.resolver-rule
Adds new aws.resolver-rule resource for managing Route 53 Resolver rules in policies.
Adds listener-rule filter to aws.app-elb for inspecting ALB routing rules.
Adds new azure.entraid-group resource for managing Entra ID groups.
Adds new azure.entraid-organization resource for managing Entra ID organization settings.
Extends the aws.vpcdhcp-options filter with an amazon synthetic value for matching AWS-provided DHCP option sets.
+3 moreshow less
Adds config-compliance filter to aws.comprehend-flywheel, aws.sagemaker-model-bias-job-definition, and aws.ses-dedicated-ip-pool resources.
Adds json-diff filter to aws.app-elb-target-group, aws.artifact-domain, aws.comprehend-flywheel, aws.datasync-agent, aws.glue-database, aws.sagemaker-data-quality-job-definition, aws.sagemaker-model-bias-job-definition, aws.sagemaker-model-explainability-job-definition, aws.sagemaker-model-quality-job-definition, aws.ses-dedicated-ip-pool, and aws.transfer-server resources.
Enables c7n-left (shift-left) to fail runs on HCL parse errors, surfacing misconfigured Terraform before policy evaluation.
KSPMKSPMKubernetes Security Posture Management: a category of tooling that continuously audits Kubernetes clusters against configuration best practices and compliance policies to surface misconfigurations before attackers exploit them. Analyzer v1.47.0 adds Kubernetes 1.29–1.32 support and MCR Docker audit skip.
Added support for Kubernetes versions 1.29 through 1.32 with new compliance audits
Improved Docker audits to skip evaluation when Mirantis Container Runtime (MCR) is detected
2 details in Everything
2 more releases in this issue
· 2026-01-19 → 2026-01-27
Prowler 5.17.0 adds Attack Paths visualization, Cloudflare provider, AWS EUSC support, 10 new GCP checks, and three new CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. compliance frameworks.
└──▷ GET THIS VERSION
$ git clone --branch 5.17.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 5.17.0
└──▷ TRY IT
Filter findings by resource group (e.g., only Compute resources) to triage the highest-risk category after upgrading.
New Attack Paths feature powered by Cartography and Neo4j lets security teams execute graph-based queries, visualize attack vectors, and identify privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. and lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. paths across AWS environments.
New Cloudflare provider (CLI) enables scanning of Cloudflare infrastructure for misconfigurations across zones, DNS, email security (SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders., DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit., DMARC), WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server., bot protection, and TLS/SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. configuration.
Full Alibaba Cloud provider support in the Prowler App and API, including UI-based provider management, security scanning, findings views, and ThreatScore calculation.
Adds support for AWS European Sovereign Cloud regions, enabling data-residency-constrained organizations to run Prowler security scans.
New Resource Groups Overview aggregates cloud resources by security-relevant categories (Compute, Storage, Network, Identity) with finding severity breakdowns via new /api/v1/overviews/resource-groups endpoint.
+10 moreshow less
New Compliance Watchlist component on the Overview page and /api/v1/overviews/compliance-watchlist API endpoint for monitoring critical compliance frameworks at a glance.
ThreatScore pillar breakdown added to the Compliance Summary page, showing per-pillar (Identity, Data Protection, Network Security, etc.) contribution to overall risk score.
Adds /api/v1/attack-paths-scans API endpoint for AWS providers backed by Neo4j to programmatically trigger and query Attack Paths scans.
New group filter on GET /findings and GET /findings/metadata/latest endpoints for resource-group-based finding queries.
Adds CIS Azure Foundations Benchmark v5.0, CIS Microsoft 365 Benchmark v6.0, and CIS KubernetesCIS KubernetesHardening benchmarks published by the Center for Internet Security for Kubernetes clusters, giving cyber tools a concrete, versioned checklist of configuration checks to run and report against. Benchmark v1.12 compliance frameworks.
Adds 10 new GCP Compute checks: compute_instance_group_multiple_zones, compute_instance_group_autohealing_enabled, compute_instance_group_load_balancer_attached, compute_instance_disk_auto_delete_disabled, compute_configuration_changes, compute_instance_single_network_interface, compute_image_not_publicly_shared, compute_snapshot_not_outdated, compute_project_os_login_2fa_enabled, and compute_instance_on_host_maintenance_migrate.
AI Skills Pack added for Claude Code, OpenCode, and Codex following the agentskills.io standard to help AI coding assistants understand and contribute to Prowler's codebase.
Redesigned findings table with improved multi-select filtering UX, enhanced table interactions, and resource group filter integration.
Provider and resource group label filters added to the Resources page in the UI.
Search bar added when adding a new provider in the UI.
15 details in Everything
└──▷ BREAKING ON UPGRADE
!Azure service principals used to scan Azure must now be granted the AuditLog.Read.AllMicrosoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs. permission due to an additional API call required for the Azure Entra performance enhancement.
!Resource group data will only populate from scans executed after upgrading to v5.17.0; previous scan data will not include resource group information.
!The resource_group filter parameter is renamed to group in the Resources page and Overview cards API.
IsMalicious is a threat intelligence platform that checks IPs, domains, URLs, emails, phones and crypto wallets against indexed threat indicators.
Adds AlienVault OTXOTXAlienVault's Open Threat Exchange, a community platform where researchers share indicators of compromise; cyber tools integrate it to pull live threat intelligence feeds without building their own collection infrastructure. and Emerging Threats to the correlation engine (17 feeds total)
Integrates AlienVault OTX as a new threat intelligence source in the multi-source correlation engine.
Integrates Emerging Threats as a new threat intelligence source in the multi-source correlation engine, bringing the total feed count to 17.
2 details in Everything
1 more release in this issue
· 2026-01-01 → 2026-01-28
AlienVault OTXOTXAlienVault's Open Threat Exchange, a community platform where researchers share indicators of compromise; cyber tools integrate it to pull live threat intelligence feeds without building their own collection infrastructure. and Emerging Threats added as new threat intel feeds in January 2026 release.
└──▷ TRY IT
Verify that new threat intel sources are recognized by the correlation methodology.
$ GET /methodology
Adds AlienVault OTX to the multi-source correlation engine
Adds Emerging Threats to the multi-source correlation engine
IntelOwl v6.5.0 adds six new analyzers including JoeSandbox, GuardDog, and YaraX, plus a new Related Investigations API and VisualizableImage component.
└──▷ GET THIS VERSION
$ git clone --branch v6.5.0 https://github.com/intelowlproject/IntelOwl.git
# already have the repo? check out this version:$ git checkout v6.5.0
└──▷ HOW TO FIND IT
Detonate a suspicious file in JoeSandbox directly from IntelOwl to get dynamic analysis results alongside other analyzers.
📍Navigate to IntelOwl UI › Submit › File, upload the sample, and select the JoeSandbox analyzer from the analyzer list before submitting.
Scan an open-source package for malicious indicators using the GuardDog analyzer before adding it to your supply chain.
📍Navigate to IntelOwl UI › Submit › Observable, enter the package name, select the GuardDog analyzer, and submit.
Run YARA rules from the Yara-Forge repository against a suspicious file using the new YaraX Analyzer.
📍Navigate to IntelOwl UI › Submit › File, upload the file, and select the YaraX analyzer to scan with the integrated Yara-Forge rule repository.
New Phunter Analyzer for phone number intelligence lookups.
New HuntingAbuseAPI Analyzer for abuse threat hunting.
New GuardDog Analyzer for malicious package detection.
New JoeSandbox Analyzer for dynamic malware sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls..
New YaraX Analyzer with Yara-Forge Rule Repository integration for YARA-based file scanning.
+5 moreshow less
New CommandSequenceAPI added to the GreedyBear integration.
New Expand URL Analyzer for resolving and analyzing shortened/redirected URLs.
New Related Investigation API for linking jobs to related investigations.
New VisualizableImage component in the frontend visualizer for rendering image-based analysis output.
New analyzables page and user events modal added to the frontend.
OpenCTI 6.9.7 adds new Rules Engine inference rules, multi-file upload at entity creation, and file download during import.
└──▷ GET THIS VERSION
$ git clone --branch 6.9.7 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.9.7
Adds new Rules Engine inference rule: if a Report contains an IP address and that IP belongs to an ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses., the Report is inferred to contain that ASN.
Adds a new inference rule on attribution relationships in the Rules Engine.
Supports uploading multiple files simultaneously at the time of entity creation.
OpenCTI 6.9.6 adds Taxii feed import/export, form intake auto-defanging, and playbook file support
└──▷ GET THIS VERSION
$ git clone --branch 6.9.6 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.9.6
TaxiiFeeds import/export capability allows importing and exporting TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. feeds directly within the platform.
Form Intakes now automatically defang and de-sanitize observables during ingestion.
Playbook container wrapper now supports passing files as inputs to containerized tasks.
Users are limited to a configurable maximum number of concurrent sessions.
OpenTAXII 0.10.0b1 adds --public/--id CLI params, enables TAXII 2.1TAXII 2.1An OASIS-standard HTTP-based protocol for exchanging cyber threat intelligence, letting cyber tools publish and subscribe to structured threat data across organizations without custom integration work. by default, and boosts get-objects performance.
└──▷ GET THIS VERSION
$ git clone --branch 0.10.0b1 https://github.com/eclecticiq/OpenTAXII.git
# already have the repo? check out this version:$ git checkout 0.10.0b1
└──▷ TRY IT
Register a new public API root with a specific ID when setting up a multi-tenant TAXII 2.1 server.
ThreatStream adds ServiceNow OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. support with assignment group/category mapping and consolidates Polyswarm sandbox results.
Adds OAuth 2.0 credential support for the ServiceNow integration to allow assigning an assignment group and category when creating or updating security incidents
Consolidates Polyswarm sandbox detonation reports into a single column on the Sandbox page, displaying platform, scan results, confidence score, and malicious detection count
ThreatStream GA: User & Role Management enables platform-wide RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.
User & Role Management is generally available, establishing role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for the Anomali platform.
Search adds haversine trigonometric function and automatic CEFCEFCommon Event Format, an ArcSight (Micro Focus) log standard that defines a fixed header plus extensible key-value pairs so cyber tools can emit and ingest alerts in a predictable, parseable structure./key-value extractions.
calc enables the haversine function to calculate distances between sequential login events for identifying geographically improbable logins
Automatic extraction of JSON, Common Event Format (CEF), and key-value field pairs on-the-fly using dotted notation
Adds Google SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. log ingestion support for curated and custom alerts.
ThreatStream adds support for MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v18.0 techniques and sub-techniques.
Adds Bad ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. check engine to Cyberbro
└──▷ GET THIS VERSION
$ git clone --branch v0.10.2 https://github.com/stanfrbd/cyberbro.git
# already have the repo? check out this version:$ git checkout v0.10.2
Add Bad asn check engine introduces a new scanning capability for Bad Autonomous System Numbers.
MISP v2.5.32 adds three new workflow modules/triggers, bucketed attachment storage, and configurable password-reset emails.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.32 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.32
└──▷ HOW TO FIND IT
Act on event deletions in a workflow — e.g., to notify an external system or log deletions before they occur.
📍In the MISP console, go to Event Actions › Workflows, create a new workflow, and add the trigger-event-before-delete trigger as the starting node.
Customize the forgot-password email body to match your organization's branding or include SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. contact details.
📍In the MISP console, go to Administration › Server Settings & Maintenance › MISP Settings and update the forgot password email text field.
New Aggregate Comparator workflow module to aggregate and compare field values for use in IF conditions.
New Timestamp Filter workflow module enabling filtering of events based on timestamp values.
New Event Deletion Trigger (trigger-event-before-delete) to act on event deletion in workflows.
New bucketed storage system for file attachments to prevent filesystem issues caused by too many files in a single directory.
Forgot password email text is now configurable via the server settings interface.
+2 moreshow less
New OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth setting to skip or enforce global MISP proxy settings.
Faster JSON decoding from files via simdjson_decode_from_stream.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The toggle field is renamed to enable in the ids-operation workflow module — any workflow using the old toggle field will need to be updated.
Flashpoint Ignite adds AI-summarized alert briefings, daily email digest, and domain-intent refinement for alert rules.
└──▷ HOW TO FIND IT
Generate a quick intelligence brief for a specific alert rule directly from the inbox.
📍In My Alert Results tab, select an alert rule, click Summarize.
Refine the summary focus using a domain-specific intent before generation.
📍Before clicking Summarize, select Summary Intent: CTI or provide custom prompt like 'Identify and prioritize immediate financial or account takeover risks'.
Automate daily intelligence updates for stakeholders via email.
📍In alert rule settings, enable Daily AI Summary Emails.
Adds Summarize button in the My Alert Results tab to generate structured, reference-backed intelligence briefs from a selected alert rule
Adds configurable Summary Intent options (CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context., Fraud, Physical Security, Executive Risk) and custom guidance fields to refine AI summaries before generation
Adds Daily AI Summary Emails feature, enabling automatic bundling of the previous 24 hours of alert activity into structured emails sent to designated recipients
Feedly Threat Intelligence adds automatic IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself.-to-actor attribution, Ask AI IOC cards, and MISP verification.
Research IoCs with rich context in seconds, not hours feature automates attribution to threat actors, malware, and cyberattacks via Real-Time Threat Graph.
Added IOC Insights Cards to Ask AI responses for instant contextual data.
Adds optional auto-categorization of captures, user-configurable default Playwright browser, and category support for capture import/export
└──▷ GET THIS VERSION
$ git clone --branch v1.36.1 https://github.com/Lookyloo/lookyloo.git
# already have the repo? check out this version:$ git checkout v1.36.1
skip.authors and include.labels are not present; this release adds automatic categorization that detects non-JS content in the init script (typically form spam bots) and assigns a category.
Adds default_browser config setting to override the Playwright browser used for captures, defaulting to Firefox Desktop to better bypass bot detection.
Adds categories support for capture import and export operations.
New Integration Management APIs, Customer Settings APIs, multi-signal investigations, and new UI swimlane view.
Adds Integration Management APIs to list, create, update, test, enable/disable, and delete integrations
Adds Customer APIs to manage response actions, configure investigation thresholds, and manage global company settings
Introduces multi-signal alert investigations that break large SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. cases into focused sub-investigations with a single consolidated conclusion
Adds new insight tags Invalid Credentials and Research Scanner for better signal clarity
Expands integration coverage with Azure Monitor / Log Analytics, Vectra AI, and Exabeam (Beta)
+1 moreshow less
Launches a new investigation list view with swimlanes for faster prioritization
ESET PROTECT 7.0 adds Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments./AD integrations, AI Advisor, advanced search, subscription licensing, and MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. dashboard visuals.
Adds Marketplace section for integrations
Adds integration with Microsoft Entra ID
Adds integration with Microsoft Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments.
Adds Advanced Search section with detail pages for Indicators, Executables, and Processes
Adds Visualization of Incidents
+11 moreshow less
Adds Incident-focused AI Advisor
Adds Affected Identities in Incident details
Adds Triggering Event Type and Argument columns in Detections list
Adds Quarantined file download for advanced analysis
Adds Transition to subscription-based licensing
Adds Service Hub link in product navigation
Adds New MDR dashboard visuals for customers without service-created security incidents
Adds Trigger Event filter in Detections list within Incident Management
Adds IP Address filter in Detections list within Incident Management
Adds Detection Name filter in Detections list within Incident Management
Adds redirect from Detection detail to the Triggered Event detail page within Incident Management
Huntress adds GA Notifications log report for SAT admins to audit notifications across SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure., API, Slack, and Teams.
4 more releases in this issue
· 2026-01-02 → 2026-01-30
ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. Data Exfiltration Timeline now available in incident reports to show adversary activity chronology.
Adds a new Data Exfiltration Timeline view within ITDR incident reports for subscribers
Chronologically records compromise start time, Microsoft log receipt time, and Huntress action time
Huntress ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. adds Audit.General and Audit.Sharepoint log ingestion for all users
Makes the new audit log data available to all Huntress users for threat detection via Huntress SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. functionality, without requiring a separate SIEM subscription.
Trend Vision One allows creating custom widgets directly from XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Data Explorer search results to build dashboards without leaving the investigation workflow.
Local response detection filters now available for Windows endpoints in Trend Vision One.
Adds capability to deploy local response detection filters on Windows endpoints via the UI
Enables automatic process termination on matched detection filters for Windows endpoints
Adds navigation path Endpoint Security Configuration > Endpoint Security Policies > Policies > XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. for Endpoints (EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.) to view local response filters
Trend Vision One adds Protocol traffic analysis tab for filtering and drill-down in XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Data Explorer
Adds Protocol traffic analysis tab to Network Overview for filtering traffic by protocol groups or specific protocols
Trend Vision One adds SentinelOne Singularity integration for Cyber Risk Exposure Management
Adds SentinelOne Singularity as a supported third-party EPP/EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. platform in Third-Party Integrations for continuous asset discovery and telemetry ingestion.
Enables SentinelOne vulnerability exposure, misconfiguration, and security event data to contribute to the Cyber Risk Index for unified risk scoring.
Trend Vision One Cloud Email Gateway Protection adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support for outbound email traffic and user-defined server configuration
Endpoint Security Policies UI now allows selecting multiple exclusion lists for Anti-Malware and Trusted Programs.
Adds support in the Endpoint Security Policies UI to select up to 10 exclusion lists (directory, file, extension, hash) per policy for Anti-Malware scan exclusions
Adds RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. audit log collection for Gardener and custom rule ConfigMap support
Support for RBAC audit log collections for Gardener clusters
Provides an option to specify a ConfigMap for rule-loader to load custom rules
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Removed legacy Splunk support feature from the Scout component.
Service Gateway Firmware 3.0.26 adds a CLISH command for pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. collection and MicroK8s cert refresh support
Container Protection for Amazon ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. v2 introduces automatic sensor patching for Fargate tasks.
Adds automatic patching of the runtime sensor in Amazon ECS Fargate tasks and services to the latest version
Removes the need for a manual process to keep the runtime sensor up to date
Trend Vision One ZTSAZTSAZero Trust Security Architecture: a network access model where no user or device is trusted by default, requiring continuous verification before granting access, letting cyber tools enforce least-privilege policies across any environment. Gateway 1.0.77 adds Microsoft Copilot for Bing support and LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. model info in logs
Adds support for a new entry used by Microsoft Copilot for Bing in AI Secure Access.
Enhances activity and detection logs with the associated LLM model information for AI Secure Access.
Sophos AP6 Series MR8 adds WPA2/WPA3WPA3The third generation of the Wi-Fi Protected Access authentication and encryption standard, maintained by the Wi-Fi Alliance, offering stronger handshake protection and per-session encryption compared to WPA2. Enterprise Authentication and raises MAC filter list to 4096 addresses per SSID.
Exabeam adds an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for AI assistants to interact with API documentation.
└──▷ HOW TO FIND IT
Connect an AI assistant to Exabeam for exploring APIs via natural language.
📍Configure your AI client (e.g., Claude, ChatGPT) to use the Exabeam MCP server endpoint as documented at https://developers.exabeam.com/exabeam/docs/exabeam-mcp-server-for-developers.
Exabeam New-Scale SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. adds Gmail and Palo Alto XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. cloud collectors, Context Management key icon, and Host to IP enrichment customization.
Adds Gmail BigQuery Cloud Collector for ingesting gmail logs
Adds Host To IP Excluded Hosts pre-built detection context table to exclude domain controllers or host servers from enrichment
+2 moreshow less
Enables customization of the Host to IP enrichment condition via the HostToIP platform enrichment rule in the Log Stream Enrichment tab
Reduces the default SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS certificate lifetime to 100 days for Site Collectors
OpenAI GPT-5.2 Codex available as a Databricks-hosted model via Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves.
Managed MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers enter Public Preview, allowing AI agents to connect Databricks resources with external APIs.
Adds Managed MCP servers in Public Preview for agent connectivity
Databricks adds beta support for storing and querying MLflow traces as OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. events in Unity Catalog Delta tables
Databricks Model Serving now hosts OpenAI GPT-5.1 Codex Max and Mini for code tasks
Adds support for OpenAI GPT-5.1 Codex Max as a Databricks-hosted model in Mosaic AI Model Serving.
Adds support for OpenAI GPT-5.1 Codex Mini as a Databricks-hosted model in Mosaic AI Model Serving.
Enables access to the new Codex models via Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves. pay-per-token pricing.
Databricks GA adds automatic email notifications for expiring personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.
Google SecOps adds direct GCP_MODEL_ARMOR log ingestion and new parser docs for 17 sources.
└──▷ HOW TO FIND IT
Ingest Model Armor logs directly into Google SecOps to monitor for prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools..
📍In the GCP console, configure Cloud Logging export filters for the GCP_MODEL_ARMOR log type and route them to Google SecOps.
Wazuh v4.14.2 adds -a never,task Audit rule detection in FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification. whodata for Linux and a Windows Server 2025 SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. Policy.
└──▷ GET THIS VERSION
$ git clone --branch v4.14.2 https://github.com/wazuh/wazuh.git
# already have the repo? check out this version:$ git checkout v4.14.2
RunReveal RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., Custom Views, JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. provisioning, health check thresholds, and new data sources
Adds Role-Based Access ControlRole-Based Access ControlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC) with separate management and data plane permissions assignable to users and API tokens.
Adds Custom Views allowing JSON log fields to be mapped to structured, queryable columns via dot notation paths.
Adds Just-In-Time (JIT) provisioning for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. user accounts to eliminate manual invitations.
Adds multiple health checks per source with custom volume thresholds and notification frequency limits.
Adds keyboard shortcuts Command + k (Mac) and Ctrl + k (Windows) for rapid navigation.
+1 moreshow less
Adds support for Duo Security, Fireblocks, GitHub Rulesets, and n8n as new data sources.
ClickHouse 26.1 adds Keeper HTTP API/Web UI, async insert deduplication with materialized views, rcfg command, and Variant type support.
Adds rcfg four-letter command for ClickHouse Keeper to change cluster configuration via JSON string over TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. interface
Adds new system table zookeeper_info to expose Keeper metadata
Enables async insert deduplication when dependent materialized views are present, filtering conflicting rows by block_id
Makes the Hash output format independent of block sizes, producing stable hash values regardless of block size
Adds support for the Variant type in all functions
+4 moreshow less
Adds max_min_fair value to concurrent_threads_scheduler server setting for max-min fair concurrency control
Allows DDL queries with ON CLAUSE for Replicated Database when ignore_on_cluster_for_replicated_database is enabled
Adds icebergLocalCluster table function for local Iceberg integration
Adds use_primary_key setting to disable granule pruning based on primary key
9 details in Everything
└──▷ BREAKING ON UPGRADE
!DEFLATE_QPL and ZSTD_QAT codecs are removed; users must convert existing data before upgrading
!The Lazy database engine is removed and no longer available
!The escape_index_filenames setting is required to handle indices with non-ASCII characters created in previous versions, otherwise loading fails
!Format settings exact_rows_before_limit, rows_before_aggregation, cross_to_inner_join_rewrite, regexp_dict_allow_hyperscan, regexp_dict_flag_case_insensitive, regexp_dict_flag_dotall and dictionary_use_async_executor are now regular settings; specifying them in Iceberg/DeltaLake/Kafka/S3/etc. table engine definitions throws an error
!joinGet/joinGetOrNull functions now enforce SELECT privileges on the underlying Join table, requiring explicit grants or failing with ACCESS_DENIED
Tenzir v5.25 adds periodic summarize emission, AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. auth for cloud operators, and RFC 6587 syslog parsing
Adds octet_counting parameter to parse_syslog operator to support RFC 6587 framing
Adds aws_iam configuration option to load_sqs, save_sqs, from_s3, to_s3, from_kafka, and to_kafka operators for AWS IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. authentication
Adds top-level aws_region option to SQS and Kafka operators for region/MSK configuration
Enables periodic emission in the summarize operator via new frequency and mode options
Tenzir v1.27.0 adds SEAWeed S3 Caddy proxy, server-side token storage, and configurable CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks./security headers.
Adds TENZIR_ENABLE_CADDY=true to enable optional Caddy reverse proxy for SEAWeed S3 storage error handling
Adds TENZIR_PLATFORM_UI_ENABLE_RESPONSE_HEADERS_DEFAULT=true, TENZIR_PLATFORM_UI_RESPONSE_HEADERS_DEFAULT, TENZIR_PLATFORM_UI_ENABLE_RESPONSE_HEADERS_HSTS=true, and TENZIR_PLATFORM_UI_ENABLE_RESPONSE_HEADERS_CSP=true config keys to control security headers and CSP for standalone deployments
pySigma v1.1.0 adds any wildcard support for Sigma Filters rule references.
└──▷ GET THIS VERSION
$ git clone --branch v1.1.0 https://github.com/sigmahq/pysigma.git
# already have the repo? check out this version:$ git checkout v1.1.0
└──▷ USE IT
Apply a Sigma Filter to all rules at once using any instead of listing individual rule IDs — useful for broad suppression filters that should span every detection.
v5.20.0 adds 25 new detections across browser hijacking, Kubernetes eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. telemetry, suspicious user agents, AI-abusing malware, and Cisco edge device threats.
└──▷ GET THIS VERSION
$ git clone --branch v5.20.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v5.20.0
Adds 5 new Analytic Stories: Browser Hijacking, Cisco Isovalent Suspicious Activity, PromptFlux, SesameOp, and Suspicious User Agents.
New browser hijacking detections identify Chrome auto-update disabling, unauthorized extension allowlisting and force-loading, and command-line flag abuse for persistence.
New Cisco Isovalent detections leverage kernel-level eBPF telemetry to surface container escapes, offensive tooling in pods, anomalous kprobe activity, cloud metadata access, and suspicious shell/network behavior in Kubernetes environments.
New HTTP user agent detections identify suspicious strings tied to C2 frameworks, malware, RMM tools, PUAs, and scripting tools blending into normal HTTP traffic.
New detections for SesameOp and PromptFlux cover AI API abuse as C2 channels and introduce coverage for Windows Potential AppDomainManager Hijack Artifacts Creation.
+1 moreshow less
New Cisco IOS and Cisco Secure Firewall detections cover privileged HTTP command execution, SSH connections to non-standard ports, and SSH connections to sshd_operns, correlated via risk-based searches for privileged account creation.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The Windows Default RDP File Creation detection is removed; replace with Windows Default RDP File Creation By Non MSTSC Process.
!The Windows Java Spawning Shells detection is removed; replace with Web or Application Server Spawning a Shell.
!The Linux Java Spawning Shell detection is removed; replace with Web or Application Server Spawning a Shell.
!The W3WP Spawning Shell detection is removed; replace with Web or Application Server Spawning a Shell.
!The Wget Download and Bash Execution detection is removed; replace with File Download or Read to Pipe Execution.
!The Curl Download and Bash Execution detection is removed; replace with File Download or Read to Pipe Execution.
!The Wmiprsve LOLBAS Execution Process Spawn detection is removed; replace with Wmiprvse LOLBAS Execution Process Spawn.
37 new Sigma detection rules added covering EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. evasion, AppX abuse, OpenCanary honeypot scans, AMSI/Credential Guard tampering, and more.
└──▷ GET THIS VERSION
$ git clone --branch r2026-01-01 https://github.com/SigmaHQ/sigma.git
# already have the repo? check out this version:$ git checkout r2026-01-01
Adds detection for AMSI being disabled via registry modification and via command-line registry tampering.
Adds detection for Windows Credential Guard being disabled, tampered with via command-line, or having related registry values deleted.
Adds five OpenCanary honeypot detections: SYN port scan, NMAP FIN/NULL/OS/XMAS scans, and RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. new connection attempts.
Adds EDR-Freeze attack detections: suspicious process access to MsMpEng by WerFaultSecure and WerFaultSecure loading DbgCore/DbgHelp from uncommon locations.
Adds detection for Dbgcore/Dbghelp DLLs loaded from uncommon locations and used to access LSASS.
+18 moreshow less
Adds detection for HVCI (Hypervisor-protected Code Integrity) registry tampering via command-line.
Adds detection for Vulnerable Driver Blocklist being disabled and tampered with via command-line.
Adds detection for PUA - Kernel Driver Utility (KDU) execution.
Adds detection for OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant.DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. redirection via registry modification.
Adds detection for MSIX/AppX package installation scenarios: successful installs, unsigned packages, full trust packages, and MSIX Package Support Framework AI_STUBS execution.
Adds detection for GitHub Self-Hosted Runner execution.
Adds Linux detections for setuid and setgid capabilities set on binaries via the setcap utility.
Adds detection for suspicious child processes spawned from Node.js (React2Shell) on both Windows and Linux.
Adds detection for cmd launched with hidden start flags to suspicious targets.
Adds detection for Devcon execution disabling the VMware VMCI device.
Adds detection for HTML files opened from the Downloads folder.
Adds detection for legitimate applications writing files to uncommon locations.
Adds detection for suspicious ArcSOC.exe child processes and files created by ArcSOC.exe.
Adds detection for suspicious Shell Open Command registry modifications.
Adds detection for User Shell Folders registry modification via command-line.
Extends Invoke-DNSExfiltrator coverage across PowerShell commandlet and script detection rules.
Extends github.com to file-sharing and suspicious download detection rules across Bitsadmin, curl, wget, certutil, and network connection rules.
Extends EDR-Freeze hacktools rule with additional coverage.
Cribl Stream 4.16 adds VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. Flow Logs Event Breaker, Wiz Defend Destination, Outpost Groups, and Configurable TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. Log Levels
Adds Azure Virtual Network (VNet) Flow logs Event Breaker type for parsing Microsoft's recommended successor to NSG Flow logs
Adds Wiz Defend Destination using an HECHECAn HTTP API endpoint provided by Splunk that lets applications stream JSON-formatted events directly into a Splunk index without a forwarder agent, reducing pipeline complexity for log-shipping tools.-compatible HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. endpoint for direct log and metric delivery
Adds Outpost Groups with configurable disconnected retention time, filtering tags, and target product version settings
Adds TTL (time-to-livetime-to-liveTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit.) setting support in on-prem deployments to temporarily change log levels for up to 24 hours
Adds Directory batch size setting to Amazon S3, Amazon Security Lake, Azure Blob Storage, Azure Data Explorer, Exabeam, Filesystem/NFS, Google Cloud Storage, and MinIO Destinations
+5 moreshow less
Adds Enable Source IP Spoofing setting to Netflow Destination to preserve original Source IP from __srcIpPort
Adds Salt file hash toggle to File Monitor to differentiate files with identical hashes
Adds Use legacy collection for LastLog option in System State Source (Linux) Advanced Settings
Adds HTTP Connection Timeout setting to Prometheus Scraper Collector
New Monitoring charts for Sources, Destinations, Data Fields, Packs, Pipelines, Projects, Routes, Subscriptions, CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. Load, Free Memory, and Bytes In/Out now support configurable local time range pickers
NodeZero 2026.01 adds No Longer Found VMH status, Cortex XSOAR fetch-incidents command, USER role subclient API access, and Federal external attack support
Adds "No Longer Found" status to Vulnerability Management Hub (VMH) for tracking remediated vulnerabilities
Adds fetch-incidents command to Palo Alto Cortex XSOAR integration for automated weakness retrieval
Extends authorization roles to allow the USER role to access subclient account endpoints via API
Enables NodeZero Federal external attack capabilities across all federal environments
Rapid7 adds new Cloud security insights/compliance packs, Velociraptor polling interval reduction, and API role-aware filtering.
Adds ap-southeast-6 to AWS region support for harvesting strategy dropdown
Adds Advanced Filter on Vulnerability Proof in the visual interface
Adds new Query Filters including Resource Does Not Support TLS 1.3 Minimum and Secret is Expired for cloud resource identification
Adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. AWS End User Compute Services Benchmark v1.2.0 as a new Compliance Pack
Adds support for AWS ElastiCache has_pending_update column and requires elasticache:DescribeServiceUpdates/elasticache:DescribeUpdateActions permissions
+8 moreshow less
Adds TLS encryption detection and minimal TLS version support for AWS Database Clusters (Neptune, DocumentDB, Aurora MySQL/PostgreSQL)
Adds new Query Filter Database Cluster Encryption In Transit Disabled for CIS AWS Database Services Benchmark 1.0.0 Recommendation 7.4
Adds storage account VHD encryption type and volume network access checks via new insights and Query Filters
Adds filter_id parameter support to the paginated insights endpoint /v4/iac/insights
Enhanced fingerprinting for Citrix Virtual Apps and Desktops using additional system components
Allows custom properties to be managed directly from the Console host's text-based command console
Enables asset group exclusion directly within scan schedules regardless of creation time
Reduces Velociraptor client polling interval from ten minutes to three minutes for faster job initiation
DefectDojo 2.54.3 adds Trivy misconfiguration fields, dynamic file upload validation, and Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. header settings.
└──▷ GET THIS VERSION
$ git clone --branch 2.54.3 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.54.3
Adds Trivy misconfiguration fields to enrich findings imported from Trivy scans.
Updates file upload field to accept dynamic file types with validation for supported extensions.
Adds Permissions-Policy header settings to settings.dist.py / local_settings.py.
3 details in Everything
3 more releases in this issue
· 2026-01-05 → 2026-01-26
DefectDojo 2.54.0 adds PingCastle and Prowler parsers, admin API token reset, batch reimport, AND-logic tag filtering, and pghistory audit logging.
└──▷ GET THIS VERSION
$ git clone --branch 2.54.0 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.54.0
└──▷ HOW TO FIND IT
Export findings with the new status and notes columns for offline triage or reporting.
📍In the DefectDojo UI, navigate to a Product or Engagement's findings list, then use Findings › Export › CSV (or Excel) — the exported file now includes status and notes columns automatically.
Filter findings to only those matching ALL specified tags simultaneously using the new AND logic in the UI.
📍In the DefectDojo UI, go to Findings, open the Tag filter, select multiple tags — results now return only findings that have ALL selected tags (AND logic).
New PingCastle vulnerability parser for ingesting PingCastle scan results.
New Prowler scan parser for cloud security posture findings.
Adds status and notes columns to CSV/Excel finding exports.
Enables admins to reset any user's API tokens via the API and UI.
Reimport now matches findings in configurable batches for better scalability.
+14 moreshow less
Switches audit logging to pghistory, adding per-process and per-Celery-task context.
UI tag filtering now supports AND logic across multiple tags.
Adds ICSA vulnerability ID support.
Adds test_type mismatch validation during reimport to catch scan type errors.
Adds fix_available field to Legitify parser output.
Metrics now use mitigated_date for closed findings in reports and the UI.
BurpRawRequestResponseViewSet gains permission classes and a refined queryset.
Adds management command to reimport sample scans for testing and validation.
Allows configuring tag truncate length via settings.dist.py / local_settings.py.
Twistlock parser now uses discoveredDate for the finding date.
SonarQube parser now uses creationDate for the finding date.
Helm HPA configuration is now more Argo-friendly.
Adds startup checker for the broker service.
Finding template refactored with API, UI, and database migration changes.
19 details in Everything
└──▷ BREAKING ON UPGRADE
!Finding template refactor (#13946) includes a database migration — existing finding template data structures are changed; review the upgrade notes before migrating.
!Audit log backend switched to pghistory (#13587) with a database migration — the previous audit log backend is replaced; existing audit records may not be accessible via the new backend without migration.
!The djnago.mediaPersistentVolume.fsGroup Helm value is dropped (#13813) — Helm deployments using this key will fail on upgrade.
New Orca Security connector, Open Connector for static file ingestion, multi-tenant Tenable One aggregation, and dashboard widget drill-down capabilities
Adds Orca Security third-party connector to ingest assets and findings from agentless platform
Introduces Tenable Open Connector (Phase 1) for manual ingestion of asset and vulnerability data via static file upload (CSV, JSON)
Enables connecting multiple distinct Tenable One Vulnerability Management accounts into a single workspace for centralized risk assessment
Adds Widget Drill Down capability allowing click-through from dashboard widgets to Assets or Findings Inventory pages with persistent filtering
Adds Dashboard Grid Mode with toggleable gridlines and Snap to Grid alignment in the dashboard creator/editor
5 details in Everything
5 more releases in this issue
· 2026-01-08 → 2026-01-28
Adds global Plugin Download Concurrency settings and Agent Profile CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. Utilization Controls
Adds Plugin Download Concurrency global setting for linked Tenable Nessus scanners to limit simultaneous plugin downloads
Adds Plugin Download Concurrency global setting for linked Tenable Agents to limit simultaneous plugin downloads
Adds CPU Utilization Controls setting to agent profiles to configure maximum CPU percentage used by agents on Windows or Linux
Adds FedRAMP ModerateFedRAMP ModerateA US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts. availability for mobilization services with bi-directional Jira Cloud and ServiceNow ticket creation via Exposure Response initiatives.
Adds FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. Moderate availability for mobilization services in Tenable One Vulnerability Management.
Enables automatic or manual bi-directional ticket creation via Exposure Response initiatives, synchronizing security findings with Jira Cloud or ServiceNow.
Adds Plugin Download Concurrency settings and CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. Utilization Controls to agent profiles.
Adds two global settings for Plugin Download Concurrency (one for linked Tenable Nessus scanners, one for linked Tenable Agents) to manage simultaneous plugin download rates
Adds CPU Utilization Controls setting to agent profiles in the UI to configure max CPU percentage for Windows or Linux hosts
OpenCVE v2.3.0 adds CVE tracking with assignee/status, AI report summaries via LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code., and Slack notifications.
└──▷ GET THIS VERSION
$ git clone --branch v2.3.0 https://github.com/opencve/opencve.git
# already have the repo? check out this version:$ git checkout v2.3.0
Add CVE tracking with assignee and status management
Add two-factor authentication (2FA) option for users
Add Slack notifications support
Add AI-powered report summarization using user-provided LLM
Edgescan reports now include EXF, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. and CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. indicators for each vulnerability.
1 more release in this issue
· 2026-01-14 → 2026-01-29
Brinqa 11.33.98 adds drill-down on dashboard charts via BQL and fixes due date preservation.
Adds initial support for drill-down functionality on dashboard charts using complex BQL queries with relationship conditions (e.g., FIND Asset THAT HAS Finding).
Extends due date behavior to preserve the extended due date on findings associated with expired exception requests.
2 details in Everything
1 more release in this issue
· 2026-01-19 → 2026-01-27
Faraday Agent Dispatcher 3.9.1 raises the default max_size limit for agent payloads.
└──▷ GET THIS VERSION
$ git clone --branch 3.9.1 https://github.com/infobyte/faraday_agent_dispatcher.git
# already have the repo? check out this version:$ git checkout 3.9.1
Increases the default max_size value, enabling agents to handle larger payloads without manual configuration.
New Worklets added to remove legacy Automox Remote Control components on Windows and macOS
Adds a new base Worklet Software Lifecycle- Remove Automox Remote Control Application for Windows devices to clean up legacy Automox Assist components.
Adds a new base Worklet Software Lifecycle- Remove Automox Remote Control Application for macOS devices to clean up legacy Automox Assist components.
Windows Package Manager v1.12.460 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server support, font install/uninstall capabilities, and updates App Installer to WinUI 3.
└──▷ GET THIS VERSION
$ git clone --branch v1.12.460 https://github.com/microsoft/winget-cli.git
# already have the repo? check out this version:$ git checkout v1.12.460
└──▷ USE IT
Search for fonts specifically using the new dedicated source.
shell
winget search font -s winget-font
Adds winget mcp subcommand for connecting to a Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. client
Adds winget-fonts source and Font installer types to manifest schema (InstallerType, NestedInstallerType)
Updates App Installer dependency from WinUI 2 to Windows App Runtime 1.8
An asset discovery and inventory platform that identifies and maps all devices on networks without requiring agents.
runZero 4.0 syncs NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. custom fields and fixes inventory query performance
New NetBox synchronization includes custom field values in inventory data.
1 detail in Everything
6 more releases in this issue
· 2026-01-05 → 2026-01-23
runZero 4.0.260118.0 updates Wiz and NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. integrations; stops IMDSv2 ping outside AWS.
Wiz integration now merges similar vulnerability reports within the same system
NetBox integration now supports versions 4.3.0 and newer
runZero 4.0.260105.0 adds task credential injection via API, detailed TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. stats, and Azure GCC endpoint fix.
The hosted scanner no longer ignores assets with internal IPs.
The scanner now collects detailed statistics for every TCP connection.
The AWS integration now collects additional information for failed logins.
You can now specify task credentials within scan templates through the API.
Munki 7.0.5 adds version_script pkginfo key for dynamic version checks and sidebar customization.
└──▷ GET THIS VERSION
$ git clone --branch v7.0.5 https://github.com/munki/munki.git
# already have the repo? check out this version:$ git checkout v7.0.5
Adds version_script key to pkginfo items for dynamic software version detection via an executable script that outputs a version string
Allows Managed Software Center sidebar customization through external configuration files
Adds --uninstallpkg flag to makepkginfo and munkiimport as an alias for --uninstalleritem
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The startosinstall installer_type is no longer supported in Munki 7; use stage_os_installer instead
!Installation of Apple software updates is removed from Munki 7 for both Intel and Apple Silicon Macs; admins must use native macOS tools
!The apple_update_metadata installer_type is no longer supported
!Adobe installer_types (AdobeSetup, AdobeUberInstaller, AdobeAcrobatUpdater, AdobeCS5AAMEEPackage, AdobeCS5PatchInstaller, AdobeCCPInstaller) and uninstall_methods (AdobeSetup, AdobeUberUninstaller, AdobeCS5AAMEEPackage, AdobeCCPUninstaller) are removed
!The profile installer_type for configuration profiles is removed; admins must use an MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. solution
!The appdmg installer_type is no longer supported (deprecated for over a decade)
!The suppress_bundle_relocation pkginfo key is no longer supported
Fleet 4.79.0 adds Android MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. management, team-specific labels, Windows SCEPSCEPSimple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention. renewal, and ADE OS-update enforcement.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.79.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.79.0
└──▷ TRY IT
Retrieve paginated MDM command history for auditing or review — the endpoint now returns pagination metadata alongside results.
Adds ability to view past and upcoming MDM commands for a host in the Fleet UI.
Adds support for applying Android app configurations.
Adds support for resending Windows MDM profiles.
Adds support for renewal of custom SCEP profiles for Windows.
Adds team-specific labels, creatable via spec endpoints and GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control..
+9 moreshow less
Adds ability to create, list, and delete Android certificates from the UI.
Adds Android agent application (auto-deployed via Android MDM) to support automated SCEP certificate installation on Android hosts.
Adds ability to indicate that new macOS hosts enrolling via ADE should be updated to the latest OS version.
Adds ability to edit Android software configuration in the UI.
Adds support for ingesting Windows certificates via osquery.
Adds audit activities for certificate template creation and deletion.
Implements streaming for the GET /hosts API to improve performance at scale.
Adds pagination metadata to the GET /mdm/commands endpoint.
Adds ability to search teams in the dropdown when transferring hosts between teams.
Acronis Cyber Protect combines backup, disaster recovery, and endpoint protection in one platform for businesses and managed service providers.
Per-user SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. selector, Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. provisioning, partner-level VPPM management, and DR failover PDF reports
Adds per-user sign-on method selection in the Cyber Protect Cloud console to switch individual accounts between local credentials and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Identity Provider.
Enables Just-in-Time (JIT) user provisioning from Microsoft Entra ID via SAML, automatically creating or updating accounts on first and subsequent logins.
Introduces Partner-level management for Vulnerability Assessment and Patch Management within protection plans for unified policy application across all customers.
Commvault Cloud is a backup, recovery, and cyber-resilience platform for hybrid, multi-cloud, and SaaS workloads.
Commvault Cloud January 2026 adds API for threat intelligence imports, synthetic file recovery, and HaloPSA integration.
Adds APIs to import malicious file-hash feeds and YARA rules into Threat Detection Plans
Synthetic Recovery for Files and Objects composes clean recovery points automatically
Adds automatic HaloPSA ticket creation from Commvault alerts
Cloud Rewind now rebuilds Azure Firewall, SQL Server, Storage Account, and VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. peering configurations during recovery
Threat Scan dashboard enables direct response actions including asset marking and restore initiation
+17 moreshow less
Automatic Intellisnap Enablement for GCP VMs simplifies backup configuration
Automatic discovery for Azure SQL instances, Azure MySQL, and Azure PostgreSQL instances simplifies plan assignment
Arlie Insights provides AI-generated threat overviews and recommendations in Threat Detection dashboard
Automated cleanroom deployment in AWS sets up isolated network settings automatically
Express configuration based Azure Application deployment enables single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for cleanroom setup
Recovery Calendar View overlays threat indicators to differentiate clean versus infected recovery points
Manage and configure plans for Threat Scan operations across multiple workloads
Multi-tenant Cleanroom Recovery support allows tenant admins to create individual recoverymanager users
New Threat Scan User Experience and Dashboard consolidates triage, coverage, and historical telemetry
New Threat Scan architecture supports hypervisor-less, schedule-based scanning for VMs and cloud objects
Recover resources into a pre-created cleanroom directly from Threat Indicators dashboard
Runbook experience for Cleanroom Recovery allows creation of recovery groups and ordered workflows
Threat Scan of VMs in Cleanroom for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. detects threats during recovery into AWS or Azure
Incremental backup support for Microsoft SQL Server databases improves performance
Enables Customer Managed Encryption Keys and Service Account Configuration during Google Cloud instance replication
Modernized vSphere Client Integration with Remote Plugin FrameworkPlugin FrameworkA structured API and runtime that lets developers extend an application by dropping in self-contained modules without modifying the core codebase, reducing integration effort for third-party contributors. supports latest vSphere versions
Windows 1-Touch removes Minisetup option and adds Post-Boot Script Support
22 details in Everything
└──▷ BREAKING ON UPGRADE
!The Minisetup option has been removed from 1-Touch recovery
Druva adds Data Anomaly monitoring for Azure VMs and AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware./EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives., plus Rollback Action for AWS S3 backups
Adds Data Anomaly detection for Azure Virtual Machines and AWS Workloads (EC2 and EBS Volume) to proactively monitor cloud backups for suspicious activity
Adds Rollback Action support to recover deleted backed up data for Amazon Web Service (AWS) S3 backup sets
Druva for Google Workspace enhances security posture and usability by allowing read-only API credential generation in DCP and redesigning the Audit Trails UI.
Druva introduces automated Readiness prechecks for Azure SQL and Azure VM backup/restore workflows to validate environment compatibility before job execution.
Adds automated prechecks for Azure SQL backups and restores that validate environment prerequisites—such as credentials, VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. rules, and subnet delegation—to prevent authentication failures.
Adds automated prechecks for Azure VM restores that validate target infrastructure configuration—including VNet/Subnet mappings, instance types, availability zones, and resource naming collisions—to prevent restore failures.
Druva introduces Threat Watch for automated backup scanning and Oracle/Azure SQL restore enhancements
Adds Threat Watch feature: continuous post-backup scanning of snapshots with automated quarantine and SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents./email/in-app alerts.
Adds file-level search bar in the Restore wizard for Oracle DTC backups to filter database files by name or path.
Adds automated Azure SQL Readiness checks that validate credentials, VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. rules, and subnet delegation before backup/restore jobs.
Adds automated Azure VM Restore Readiness checks that validate Instance Type, Availability Zone, Subnet compatibility, and resource naming conflicts.
Druva AWS Workloads introduces Threat Watch, an automated, continuous backup scanning feature for ransomware detection.
Adds Threat Watch as a new cyber tooling capability that performs continuous post-backup scanning and automated risk containment via auto-quarantine and instant alerts.
Enables retroactive rescan of backups up to 30 days old when new IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. are added to the IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. library.
New monitoring and alerting capabilities for AD/LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. synchronization ensure faster identification of provisioning issues.
Druva for Microsoft 365 adds AD/LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. sync job monitoring, real-time status display, and proactive alerts.
Adds Last Sync Status in the management console to display the current user synchronization state based on the configured auto sync interval
Adds new proactive alert types for AD/LDAP sync: AD Account Not Reachable (triggered when the host is unreachable), Invalid AD mapping (triggered if AD mapping or destination OU/group cannot be located), and Customer Action Required
Druva Endpoints adds real-time AD/LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. sync status monitoring and proactive alerts for configuration errors
Adds Last Sync Status display in the management console to show the current user synchronization state based on the configured auto sync interval.
Druva introduces Threat Watch for automated backup scanning and quarantine with SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents./email alerts
Threat Watch feature in Global Navigation Menu > Cyber Resiliency > Posture & Observability enables continuous post-backup scanning three times daily.
Threat Watch APIs available to perform Threat Watch related actions programmatically.
Auto-Quarantine automatically isolates infected snapshots upon detection within the backup lifecycle.
A new cron job runs hourly to eliminate older diagnostic log files when the volume storing Veeam logs exceeds 90% capacity on Veeam Software Appliances.
Acronis Cyber Infrastructure is hyperconverged software that pools storage, compute, and networking on commodity servers, often as a backup storage target.
Acronis Cyber Infrastructure 7.0 adds S3 IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only., bucket policy UI builder, SSD wear-level alerts, and multi-subnet external networks.
└──▷ HOW TO FIND IT
Reclaim wasted space on an external S3 or NFS backup storage target by running the new compacting utility against it.
📍Run the compacting command-line utility against your external backup storage target (S3 or NFS) to scan for unnecessary overhead and remove it, reducing overall storage consumption.
Upload a custom JSON bucket policy for an S3 bucket when the built-in policy builder does not cover your access-control requirements.
📍In the self-service panel, navigate to your S3 bucket, open the Bucket Policy section, select Upload JSON policy definition, and paste or upload your custom JSON policy document.
Introduces a new command-line compacting utility to scan and remove unnecessary overhead from external backup storage (S3 and NFS), reducing storage consumption.
Adds IPv6 support to the S3 service for improved connectivity in large, clustered environments where IPv4 is limiting.
Adds an S3 bucket policy builder in the self-service panel UI, supporting both a guided policy builder for beginners and custom JSON policy uploads for advanced users.
Increases object storage read (GET) throughput to approximately 12 GB/s per node through internal optimizations.
Adds automatic SSD/NVMe wear-level detection that alerts at below 10% remaining lifetime (warning) and 5% (critical), and places affected chunk services into maintenance mode at the wearout threshold.
+2 moreshow less
Adds automatic cleanup of service configurations for nodes removed from compute, management, or storage clusters, preventing cluster issues on rejoin.
Adds support for defining and managing multiple subnets within a single external infrastructure network.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The Compute API will be unavailable for up to 15 minutes during the update, temporarily disabling the ability to manage compute workloads.
!Rejoining a node that was removed from a cluster requires reinstallation; certificate removal must still be performed manually by the administrator.
Veeam Kasten is a Kubernetes-native platform for backing up, restoring, and migrating containerized applications and their persistent data.
Kasten K10 8.5.1 adds ACM Observability integration and Blueprint hook support for custom resources.
Adds support for integrating Veeam Kasten with Red Hat Advanced Cluster Management (ACM) Observability Service, including automated cluster name and ID detection from OpenShift infrastructure, Prometheus remote write configuration, and external labels for ACM integration.
Adds support for performing backupPrehook and backupPosthook Blueprint actions on custom resources.
2 details in Everything
1 more release in this issue
· 2026-01-08 → 2026-01-22
Kasten K10 8.5.0 adds VM-centric policies, file recovery via SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel./SFTP CLI, Azure Key Vault, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. profiles, and Prometheus remote write.
└──▷ TRY IT
Set a longer validation timeout when creating a Kasten DR install via Helm in environments with many KDR restore points.
Adds k10.kasten.io/virtualMachineRef selector to backup policies for fine-grained, dependency-aware protection of individual Virtual Machines.
Adds kastenDisasterRecovery.validationTimeout Helm parameter to configure the timeout for KDR restore point validation.
Adds FileRecoverySession API and k10tools CLI/SFTP interface for browsing and recovering individual files from exported restore points.
Adds Restore Point Validation to verify integrity of exported restore points, supporting both full Filesystem mode PVC scans and faster metadata-only scans.
Adds Azure Key Vault integration for managing KDR passphrases and encryption keys for restore point data.
+11 moreshow less
Adds Azure Federated Identity support for Location Profiles to access Azure Blob Storage without long-lived credentials.
Adds SMB-based Location Profiles, allowing Location Profiles backed by SMB shares mounted to the cluster.
Supports Azure Files CSICSIAn ambiguous acronym spanning Container Storage Interface, Crime Scene Investigation, and other expansions — without more context about which domain this tool operates in, a reliable definition cannot be given. v1.33.4 or later for protecting shared volumes via Kasten and volume snapshots.
Adds Prometheus Remote WritePrometheus Remote WriteA protocol for streaming time-series metrics from a Prometheus instance to a remote storage backend, letting cyber tools offload long-term metric retention and query load to a dedicated system. support, allowing the built-in Prometheus instance to forward metrics to any external Prometheus-compatible monitoring system.
Adds VM-centric protection policies that select Virtual Machines as first-class resources with automatic dependency discovery.
Adds batch restore for Virtual Machines, enabling selection of multiple VMs across namespaces in a single restore operation.
Supports restoring individual disks within a VM, allowing recovery of specific data volumes or OS volumes independently.
Supports retaining original MAC addressesMAC addressesA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. of VM network interfaces during restore for consistent network identity.
Adds Virtual Machine support to the Restore Points page for managing and restoring VM-based restore points.
Adds OpenShift 4.20 support.
Enables management of local or externally-managed PasskeysPasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. for encrypting exported data directly from the Dashboard UI.
Varonis adds encrypted labels for more file types, DAGDAGA directed acyclic graph — a data structure of nodes connected by one-way edges with no cycles — used by tools to model task pipelines or data flows where execution order and dependencies must be enforced without loops. API staleness fields, unified Entity filter, and BulkOps CSV/PS onboarding
Adds isStale (Boolean) and staleSinceTimestamp (DateTime) fields to the DAG API to identify dormant access
Introduces Hide Nested Group Members of Excluded Groups filter in the Managed User Level Permissions report
Enables bulk upload of managed folders and groups via structured CSV and PowerShell module in BulkOps
Adds Classification record type (direct) column and filter to show matched patterns/dictionaries for files, messages, and aggregated items
Supports applying labels with encryption to .txt, .bmp, and .xml file types
+4 moreshow less
Displays Data Access Governance (DAG) reports directly in the UI with up to 50,000 results without export
Adds Entity unified identity filter to investigate activity across all user accounts on supported platforms
Enables filtering SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. (CIFS) and NFS file-access events by application protocol-type metadata
Supports NetApp ONTAP Cluster Mode access-denied events via FPolicy including NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. permission failures from ONTAP 9.13.1
Varonis adds KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. key policy visibility to AWS access analysis for better data exposure insights.
Incorporates KMS key policies into AWS access analysis to clarify who can access encrypted data
Enterprise Browser disables Google AI by default; Patient Zero notifications add multilingual support
Sets the default Enterprise Browser policy to disable Google AI features, tightening privacy and security out-of-the-box.
Adds German, Spanish, French, Italian, Japanese, Chinese, Korean, Portuguese, and Brazilian language support for Patient Zero user notifications in Netskope Secure Web Gateway.
Bytebase 3.14.1 adds Google Cloud SQL IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. authentication support and improves result masking performance.
└──▷ GET THIS VERSION
$ git clone --branch 3.14.1 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 3.14.1
Adds Google Cloud SQL IAM authentication support for database connections
Improves result masking performance for queries spanning multiple databases and enhances masking coverage
2 details in Everything
1 more release in this issue
· 2026-01-15 → 2026-01-29
Bytebase v3.14 introduces refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API., granular masking/exemption policies, Terraform project settings, and Workload Identity support.
└──▷ GET THIS VERSION
$ git clone --branch 3.14.0 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 3.14.0
└──▷ HOW TO FIND IT
Allow a Project Releaser to manually create rollouts when SQL review fails but the issue is approved.
📍grant bb.rollouts.create to project releaser
Grant granular access to manage masking rules, previously lumped into broader admin roles.
📍grant bb.policies.createMaskingRulePolicy, bb.policies.getMaskingRulePolicy, bb.policies.updateMaskingRulePolicy, bb.policies.deleteMaskingRulePolicy to role Data Privacy Lead
Configure the Terraform project resource with new SQL review and approval controls.
Adds bb.rollouts.create permission to control who can initiate a rollout
Adds eight new policy permissions for masking rules and exemptions (bb.policies.*MaskingRulePolicy, bb.policies.*MaskingExemptionPolicy)
Adds four new settings permissions (bb.settings.getEnvironment, bb.settings.setEnvironment, bb.settings.getWorkspaceProfile, bb.settings.setWorkspaceProfile)
Removes drifted field from Database message proto and drifted filter from ListDatabases API, ending Schema Drift Detection
Adds support for allow_request_role, data_classification_config_id, enforce_sql_review, force_issue_labels, issue_labels, labels, require_issue_approval, require_plan_check_no_error in the Terraform bytebase_project resource
+1 moreshow less
Supports Workload Identity authentication with GitLab CI for user groups
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Removes drifted field from Database message in v1/database_service.proto and drifted filter option from ListDatabases API
!Removes dump_version field from ChangelogPayload in store proto
!Replaces maximum_connections in Instance Settings with Parallel tasks per rollout in Project Settings and removes the old setting
!Updates notification_types for project webhooks to ISSUE_CREATED, ISSUE_APPROVAL_REQUESTED, ISSUE_SENT_BACK, PIPELINE_FAILED and PIPELINE_COMPLETED
!Releases are now identified by release_id with automatic train/RC iteration numbering; title and digest fields are removed from the Release API
!Revokes bb.settings.get, bb.settings.list, bb.projects.list from Workspace Members role
JumpCloud adds granular OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. token configuration including per-app lifetimes and O/JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store.access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. strategy
└──▷ HOW TO FIND IT
Configure a strict 1-hour expiration for refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. in an OIDC app via the new Advanced Settings.
📍Navigate to the application's SSO with OIDC settings, open the Advanced Settings section, and set Refresh Token Expiration to 3600 seconds.
Switch access token format to JWT for a specific resource server compatibility requirement.
📍In the OIDC app's Access Token Strategy setting, toggle the format to JWT.
Adds Advanced Settings section for OIDC SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. applications enabling granular control over session security and token architecture.
Enables manual setting of distinct expiration windows (10 minutes to 90 days) for ID, Access, and Refresh tokens.
Adds a toggle to choose between Opaque and JWT formats for access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. via the Access Token Strategy setting.
Supports up to 5 additional access token audiences for complex microservices integrations.
JumpCloud adds selection of specific MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. factors (e.g., JumpCloud Go, TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip.) within Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. Policies.
└──▷ HOW TO FIND IT
Configure a policy to require only FIDO2FIDO2The open standard behind passkeys and hardware security keys, where a website checks a signature from the user's device instead of a password. Because the key is bound to the site, phishing pages cannot use it. or TOTP for sensitive applications.
📍Navigate to the Conditional Access Policies editor and select JumpCloud Go or TOTP from the Multi-factor Authenticators dropdown.
New notification capability alerts teams when sensitive data is shared in AI conversations
Adds the ability to create notifications that alert your team when sensitive data, like PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., secrets, or financial info, is shared in AI conversations.
Allows configuring alerts based on the type of data detected or at the app level.
Enables routing these sensitive data alerts to Slack, Microsoft Teams, email, or a webhook.
Adds Vultr, Tailscale, Grafana, Buildkite, and Bitrise as new connected apps for centralized SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. visibility.
New JumpCloud integration adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. activity visibility.
Connects to JumpCloud for automatic discovery of apps and accounts.
Nudge Security adds Workday as a new connected app for monitoring misconfigurations and identity risks.
Adds Workday as a new connected application to monitor user and identity risks, including missing MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone..
Adds logout+jwt token type for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. logout tokens and allows SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. encryption certs without private keys
└──▷ GET THIS VERSION
$ git clone --branch version/2025.12.2 https://github.com/goauthentik/authentik.git
# already have the repo? check out this version:$ git checkout version/2025.12.2
The logout+jwt token type is a new value for an existing configuration field (token_type) in OIDC providers.
1 detail in Everything
2 more releases in this issue
· 2026-01-13 → 2026-01-30
Adds property mapping override for OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. scope claims in access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions..
└──▷ GET THIS VERSION
$ git clone --branch version/2025.12.1 https://github.com/goauthentik/authentik.git
# already have the repo? check out this version:$ git checkout version/2025.12.1
agent config now exposes license status via endpoints and proxyv2 stale session fix.
└──▷ GET THIS VERSION
$ git clone --branch version/2025.12.0 https://github.com/goauthentik/authentik.git
# already have the repo? check out this version:$ git checkout version/2025.12.0
endpoints agent configuration now includes license status details.
1Password SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Manager adds Dayforce, Claude, Workato, and other new integrations; upgrades Okta/Zoom/Travelperk support
Adds Dayforce (Identity) integration for Accounts and Teams management
Adds Claude (Usage) integration with provisioning, deprovisioning, and usage metrics
Adds Workato (Usage) integration with provisioning, deprovisioning, and account roles
Adds Codacy (Usage) integration with groups, accounts, activity, and provisioning
Adds Vanta (Usage) integration for Accounts and Groups
+10 moreshow less
Adds Sweet Show (Usage) integration with provisioning and deprovisioning
Adds Expent (Contracts) integration for accounts, roles, contracts, and provisioning
Adds WPS Office (Usage) integration with licenses, accounts, and provisioning
Adds Pylon (Usage) integration with groups, accounts, and provisioning
Adds DBT Labs (Usage) integration for groups, accounts, and provisioning
Extends Okta integration to support Devices and Roles data
Adds filterable user fields Webinars and Large meetings to the Zoom integration
Adds Provisioning and Deprovisioning capabilities to the Travelperk integration
Removes Enterprise plan requirement for deprovisioning in the Monday.com integration
Increases UKG Ready sync frequency from daily to hourly
15 details in Everything
4 more releases in this issue10 more releases in this issue · 2026-01-14 → 2026-01-31
1Password for Windows 8.12 adds Passkey item support setting and G-SYNC performance tuning
Adds Passkey item support setting to control visibility of the Windows PasskeysPasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. setup prompt.
Adds settings to reduce lag and choppy performance on high refresh rate G-SYNC monitors.
1Password for Windows 8.12.2 beta adds support for a wider set of custom trusted browsers
custom_trusted_browsers now accepts a wider range of browser executables or identifiers on Windows, allowing more custom browsers to be trusted for auto-fill and context passing.
1Password for Windows 8.12.0-11 adds PasskeyPasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. item support setting and high refresh rate performance tuning.
Adds conditional PasskeysPasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. setup prompt based on the Passkey item support setting
Beta update focusing on macOS Tahoe UI styling (Dark Mode, clear icons) and localization improvements. Bug fixes include Bitwarden TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. import vault creation issues.
Adds Dark Mode support for the macOS Tahoe interface
Introduces clear 1Password icons optimized for macOS Tahoe
Introduces the Email Risk API beta and announces frontend SDK error events in Event Log Streaming beginning January 30, 2026.
Adds the Check Email Risk beta API (https://stytch.com/docs/fraud/api/check-email-risk) to return ALLOW, BLOCK, or CHALLENGE actions and risk scores for email addresses. Contact the fraud team for beta access.
Announces that Event Log Streaming will include frontend SDK error events beginning January 30, 2026.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Removing Start events from the Event Log stream starting 2026-01-30 means API events will no longer generate duplicate Start records; alerting or monitoring relying on Start events must be updated to use Success or Error events instead.
Ory adds multi-region identity search, configurable SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit., Hydra skipped consent handling, Kratos webhook headers, and admin endpoint prefix fix.
└──▷ USE IT
For Hydra Enterprise, discard skipped-consent payloads to reduce SQL storage; this disables OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. client front- and back-channel logout.
yaml
feature_flags:
discard_skipped_consents: true
Hydra Enterprise can enable feature_flags.discard_skipped_consents to store only temporary identifiers for skipped consents; OAuth2 front- and back-channel logout then stop working.
SAML Response expiry is configurable via ttlInMinutes attribute in Identity Federation apps (default 10 minutes)
A documented allow list of user request headers is available as ctx.request_headers in HTTP delivery-channel webhooks for SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels./email one-time codes.
Login and Registration events now include SelfServiceMethodUsed and SelfServiceFlowName attributes (SelfServiceStrategyUsed deprecated)
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Advanced Identity Search API collection name changed from identities-<PROJECT-ID> to identities
!Full-text identity search results limited to first 1000; pagination support dropped (use ListIdentities API for full list)
Client Connector 4.8.0.115 adds RSC control via App Profiles and fixes posture/proxy issues
Adds support for controlling how Zscaler Client Connector interacts with the Receive Segment Coalescing (RSC) feature on network adapters to resolve compatibility issues.
1 detail in Everything
36 more releases in this issue
· 2026-01-06 → 2026-01-30
New HCL BigFix Computers and three SentinelOne connector streams for asset and security data ingestion.
Adds HCL BigFix Computers connector to retrieve computer IDs, hostnames, OS, IP, and hardware details
Adds SentinelOne Assets stream to ingest managed devices, cloud assets, and unmanaged devices
Adds SentinelOne Alerts stream to ingest security alerts for centralized monitoring in Zscaler SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation.
Adds SentinelOne CNS Findings stream to ingest vulnerabilities and misconfigurations from xSPM module
Adds HCL BigFix Computers and SentinelOne connectors with new asset, alert, and xSPM finding streams to Zscaler Asset Exposure Management.
Adds the HCL BigFix Computers connector which retrieves computer IDs, hostnames, OS details, IP addresses, and hardware properties from a BigFix deployment
Adds three new SentinelOne connector streams: SentinelOne Assets for managed/unmanaged/cloud endpoints, SentinelOne Alerts for security alerts, and SentinelOne CNS Findings for xSPM vulnerabilities and misconfigurations
Mandiant ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. connector available to retrieve entities and issues.
└──▷ HOW TO FIND IT
Configure the UVM service to ingest attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. data.
📍Configuring the Mandiant ASM Connector
Adds the Mandiant ASM connector integration
Supports Mandiant ASM Entities stream (domains, IPs, SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certs)
New Mandiant ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. connector for AEM to ingest assets and issues
ZIA adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. transaction logging, MSIX DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest./File Type support, Atlassian AI controls, adjustable SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. scan intervals, DLP collaborator scoping, and password-protected PDF sand
Embedded AI and Embedded AI Prompts fields added to the Add/Edit Productivity and CRM Tools Rule window for granular control of embedded AI applications on Atlassian sites.
MCP application activity added to Web Insights Logs to log Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. transactions in the ZIA Admin Portal.
MSIX files supported in the Executable category for File Type Control and Data Loss Prevention (DLP) policies.
Admin Quarantine action available on the Edit DLP Rule window for quarantining files from all file sharing apps (Box, Dropbox, Confluence, ShareFile, Smartsheet) to a desired location.
Number of internal and external collaborators added as scoping criteria for SaaS Security Data at Rest Scanning DLP policies for file sharing applications.
+2 moreshow less
Polling interval configurable in Policy > SaaS Security > Scan Configuration > Add Scan Schedule for SaaS application tenants.
Zscaler Isolation now supports sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls. password-protected PDF files for ZIA; users are prompted for the password within the isolated session.
Zero Trust Branch 8.0.8P2 improves ZPA provisioning reliability, DHCP relay stability for inactive VLANs, bonded interface MAC handling, PBR Balanced mode WAN link awareness, and HA status display correctness post-upgrade.
OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. Client Credentials supported for SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning
ZDX now supports IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. visibility and stores logs in Canada.
Enables storage of ZDX logs and data in Canada alongside existing US, EU, Singapore, and Australia East regions.
Zscaler Authentication Service integrates Management Portal for Partners with SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support
New Sandbox Verdict logging, AWS profile scaling to 512 accounts, email time fields, and Virtual Service Edge resource increases.
Adds new Sandbox Verdict NSS log type to stream sandbox analysis data to SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. systems
Adds %s{zs_rcv_time} and %s{zs_sent_time} fields to NSS Feed Output Format for Email DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. logs
Increases AWS account ID limit to 512 per tenant profile in Tenant Profiles
Adds Zscaler Sent Time and Zscaler Received Time columns to Email DLP Insights Logs
Enables Virtual Service Edge deployment with 64 GB RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed. and 3 AV engines on VMware ESXi, Azure, GCP, Hyper-V, AWS, and AWS with GWLB
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Deprecation of SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. policies Set Automated Notifications for New and Trending Cloud Applications in Our Organization and Set Automated Notification for New OAuth Applications Connected to Your Corporate Environment for Microsoft 365
ZIA sandbox now analyzes ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. optical disc image files across all cloud platforms
Adds iso (Optical Disc Image) file type support to the Zscaler Sandbox
Client Connector 4.1 adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, Z-Tunnel 2.0 bypass options, and Authentication Service management features.
Adds Redirect Web Traffic to Zscaler Client Connector Listening Proxy and Use Z-Tunnel 2.0 for Proxied Web Traffic options for the Z-Tunnel 2.0 protocol bypass feature
Enables IPv6 traffic forwarding from IPv6-only Android devices to ZIA and ZPA
Adds force remove, quarantine/unquarantine, OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. support, and remote log fetching capabilities for Authentication Service users in the Client Connector Portal
Supports packaging the Client Connector Portal configuration into an encrypted log file during export
Enables automatic discovery of the optimal path MTU for Z-Tunnel 2.0
ZIA adds MSIX DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest./File Type support, Sandbox Verdict logging to NSS and Insights UI, and Extranet App Support enhancements
Adds Sandbox Verdict as a new log type for NSS feeds to stream sandbox analysis data to SIEMsSIEMsSecurity Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point.
Adds Sandbox Verdict Insights Logs page (Analytics > Sandbox Verdict Insights) to view behavioral analysis activity logs in the ZIA Admin Portal
Adds MSIX file support to File Type Control and DLP policies in the Executable category
Enables bidirectional configuration for Extranet Application Support with custom IP pools, static IPs, GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. tunnels, sublocations, Firewall Control, and IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control
Adds Extranet Resource filter and column to DNS, Firewall, and Web Insights Logs
+1 moreshow less
Adds %s{extranet_name} field to NSS/Web, NSS/Firewall, and NSS/DNS log outputs
ZIA adds Sandbox Verdict insights logging and NSS feed support; scopes for partner admin management.
Introduces the Sandbox Verdict Insights page (Analytics > Sandbox Verdict Insights) in the ZIA Admin Portal to view recent sandbox analysis activity logs.
Adds a new Sandbox Verdict log type available for configuring in the Nanolog Streaming Service (NSS) or Cloud NSS feeds to stream sandbox analysis data to SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. systems.
Introduces scopes as a new method to manage multi-tenant, multi-cloud admin and tenant assignments for partners via Authentication Service.
Adds Aqua Security connector to UVM for retrieving cloud-native security data across 7 streams.
Adds Aqua Security Connector integration to retrieve vulnerability data for functions, hosts, container images, running containers, cloud misconfigurations, compliance violations, and security alerts.
ZIA adds Hyper-V and Nutanix NSS support, URL filter OR/AND operators, AWS tenant profile limits, performance tool masking, and API status workflow changes
Adds Hyper-V support for Nanolog Streaming Service (NSS) VM deployment to stream logs to a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. system.
Adds Nutanix support for Nanolog Streaming Service (NSS) VM deployment to stream web or firewall logs to a SIEM system.
Enables OR and AND logical operators between Users, Groups, and Departments criteria in URL Filtering Policy rules.
Adds up to three additional Groups fields (groups2, groups3) to the Add/Edit URL Filtering Rule window for granular group-based filtering.
Adds usersAndGroupsSet, groupsAndDepartmentsSet, groups2, and groups3 fields to the UrlFilteringRule model in the /urlFilteringRules API.
+3 moreshow less
Increases AWS account ID limits in Tenant Profiles to 512 per profile and 4,096 across all profiles.
Adds username masking in the Zscaler Cloud Performance Test Tool, displaying only domain parts of traffic or email (e.g., xxxxxxxxx@zscaler.com).
Changes Admin Audit and Event Logs API report generation endpoints to return an HTTP 200 status code with a statusId query parameter instead of a 204 code.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!The POST /auditlogEntryReport and POST /eventlogEntryReport endpoints now return an HTTP 200 status code with a statusId in the response body (previously 204), requiring scripts to parse and pass this statusId as a query parameter in subsequent calls to check status, download, or cancel the report.
Adds RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. decoys, Terraform support for Cloud Deception, and VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. configuration options for AWS RDS/VM image decoys.
Deploys RADIUS decoys via Internal decoys to mimic real RADIUS servers and lure attackers.
Adds Terraform package for provisioning Zscaler Deception components and decoys in AWS and Azure.
Allows specifying VPC or subnet information when deploying RDS and VM image decoys in AWS.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Deploying RDS and VM image decoys in the default VPC is no longer supported.
Adds interactive Application Map for Microsegmentation to visualize network data and aid policy configuration
Introduces the Application Map UI feature providing an interactive graph with widgets for resource groups, Public Internet, and VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware./VNET data
ZIA supports password-protected PDF sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls., adjustable SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. scan intervals, and new DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. scoping/quarantine actions for file sharing apps.
Sandboxing of password-protected PDF files now available in ZIA Isolation
New SaaS Tenants tab added to the Settings page in 3rd-Party App Governance and Advanced SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications.
New Notifications tab added to the Settings page for Slack and email configuration
New Connect drop-down menu on the App Dashboard to select platforms for 3rd-Party App Governance or Advanced SSPM
UVM now ingests external policy compliance and application inventory data from Rapid7 InsightVM and Veracode respectively via new limited-availability streams.
Adds Rapid7 InsightVM Policy Compliance stream to ingest policy compliance data via async export jobs and Parquet files
Adds Veracode Applications stream to retrieve a paginated list of applications from the Veracode connector
Asset Exposure Management adds OS End of Life policy coverage for RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence., ESXi, iOS, and new integration streams for Rapid7 InsightVM and Veracode.
Adds support for RHEL (Red Hat Enterprise Linux), VMware ESXi, Apple iOS, IBM AIX, Oracle Linux, Oracle Solaris, Rocky Linux, FortiOS, PAN-OS, and SLES (SUSE Linux Enterprise Server) to the OS End of Life policy.
Adds Rapid7 InsightVM Policy Compliance stream integration for ingesting compliance data via asynchronous export jobs downloaded as Parquet files.
Adds Veracode Applications stream integration for retrieving a paginated list of applications from Veracode.
Sophos ZTNA 2.2 adds VMware ESXi and Hyper-V hypervisor support for on-premises and cloud gateway deployments.
└──▷ BREAKING ON UPGRADE
!Upgrading to ZTNA 2.2 is mandatory — the release includes essential support for the new VMware ESXi and Hyper-V capabilities and must be applied to all gateways.
SSH logins now use the standard Authorization Code grant instead of Device Code for faster browser login.
Adds support for reverse tunneling via the ssh_upstream_tunnel runtime flag to reach hosts behind NAT or edge devices.
Enables jump-host (ProxyJump) mode through the ssh_allow_direct_tcpip runtime flag, allowing policy enforcement without upstream trust of Pomerium's User CA.
Introduces an interactive routes portal enabled by the ssh_routes_portal runtime flag for selecting destinations from a picker.
Allows per-key session revocation listed in the Pomerium UI.
New tctl alerts rm command, tbot SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. DaemonSet chart, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. ID token injection
└──▷ GET THIS VERSION
$ git clone --branch v18.6.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v18.6.5
└──▷ TRY IT
Remove a specific alert from the cluster using its ID.
$ tctl alerts rm <alertID>
Install tbot as a systemd service with a custom PID file location for better process management.
Deploy tbot agents as a DaemonSet to serve SPIFFE SVIDsSPIFFE SVIDsShort-lived, cryptographically verifiable identity documents issued by the SPIFFE open standard, giving workloads a provable identity so cyber tools can authenticate service-to-service calls without passwords or API keys. to local Kubernetes pods.
Added the tctl alerts rm <alertID> command to delete specific cluster alerts.
Added support for injecting Teleport-issued ID tokens into outgoing MCP requests for OAuth/OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. validation.
Introduced the tbot-spiffe-daemon-set Helm chart for deploying tbot agents via SPIFFE Workload API in Kubernetes.
Added the --pid-file flag to the tbot systemd install command.
Added opt-in support to bootstrap the teleport-plugin-event-handler Helm chart with Multi-Cluster Instance (MWI) auto-join capabilities.
+3 moreshow less
Exported additional_trusted_keys in tctl auth export and the /webapi/auth/export endpoint to include certificates from the init rotation phase.
Added a Terraform module to configure Teleport and AWS for EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. discovery in an AWS account.
8 details in Everything
3 more releases in this issue
· 2026-01-08 → 2026-01-29
Teleport v17.7.13 adds support for new AWS regions in IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. joining and respects region field in external audit storage configuration.
└──▷ GET THIS VERSION
$ git clone --branch v17.7.13 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.7.13
Agent Proxy 1.28 adds S3 chunked upload signing and Secrets Manager PNA for username/password
private network access support for HTTP Basic Auth Credential Providers using AWS Secrets Manager
process name and process username added as Client Workload Identifiers
Extended AWS S3 support to include all SigV4SigV4AWS's request-signing protocol that authenticates HTTP calls by hashing the request body, headers, and credentials into a signature; cyber tools use it to talk to AWS APIs without embedding long-lived secrets. headers, enabling required signing type specification
3 details in Everything
1 more release in this issue
· 2026-01-13 → 2026-01-16
New GitHub Action for CI/CD credential injection, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Authorization Server beta, PNA support, and Access Policy Builder UI.
Adds official GitHub Action to inject credentials into CI/CD workflows using workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. federation
Introduces MCP Authorization Server (beta) securing Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. workloads with OAuth 2.1OAuth 2.1A consolidated draft of the OAuth authorization framework that merges OAuth 2.0 with its most important security BCP updates, dropping unsafe flows so tools can delegate user access without handling credentials directly. authorization code flow
Enables Private Network Access (PNA) for AWS Secrets Manager Credential Provider to retrieve secrets from private VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules.
Adds an opt-in Access Policy Builder with card-based navigation and inline component creation; enable Use new access policy in user profile preferences.
Automated authorized representative approval delegation for QWAC and QWAC PSD2 certificates in CertCentral Europe via API and UI.
Adds automated approval delegation workflow for QWAC and QWAC PSD2 orders, allowing an authorized representative to delegate authority to Administrators, Managers, or Service Users.
Adds Request authority delegation action in the CertCentral Europe UI under Account > Users > [User Details] > Authorized representative delegation.
Mondoo adds new OS support, updated CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. policies, and improved EOL asset scoring in January 2026.
Adds support for new operating systems across the cyber tooling stack
Updates existing CIS policies with new checks and rules
Improves scoring accuracy for End-of-Life (EOL) assets
Drata requires explicit group scoping for Microsoft 365, Okta, and Google IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. connections to limit synced users.
Requires selection between Sync all personnel or Sync only selected groups when connecting Microsoft 365 (including GCC HighGCC HighA Microsoft 365 cloud environment restricted to US government contractors handling controlled unclassified information, meeting compliance requirements like ITAR and DFARS that standard commercial tenants cannot satisfy.), Okta, or Google as an Identity Provider
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!Existing IdP connections for Microsoft 365, Microsoft 365 GCC High, Okta, or Google may require review to ensure scoping aligns with current user access needs.
Adds Hexnode and OpenProject integrations via new Integrations menu paths for device and project tracking sync.
Adds Hexnode integration accessible via Integrations -> Mobile Device Management to sync mobile device managementmobile device managementMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. data into Scrut.
1 detail in Everything
5 more releases in this issue
· 2026-01-07 → 2026-01-11
Enhanced Notification Center consolidates over 100 notifications across core workflows.
Expands the existing Notification Center, accessible through the top-right bell icon, with more than 100 notifications across artifacts, comments, tasks, reviews, exports, assessments, and user-access workflows.
Vanta adds Issues reporting, code-changes access for lower tiers, URL evidence, Agent memory/framework overlap drill-down and TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. intake form.
Adds /code-changes page access to Essentials and Plus packages, replacing the old /changes experience
Adds URL Evidence in Issue Management allowing URLs to be attached directly to issues as evidence
Adds Agent Memory (M1: Create and Use Memory) to store company-specific context for personalized responses
Adds Framework Evidence Overlap Drill-Down showing exactly which tests and documents overlap across frameworks
Adds [GA] TPRM Intake Form with configurable vendor fields, evidence uploads, magic links, and default risk assignment
+1 moreshow less
Adds Issues report surfaced in UI with trends by severity/status, filters by owner/status/source/audit, and near real-time updates
6 details in Everything
2 more releases in this issue
· 2026-01-11 → 2026-01-31
Vanta adds AI Shadow Mode for SOC2SOC2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. scoping, Jira linking, Agent UX improvements and DPIADPIAA Data Protection Impact Assessment — a structured process, required under GDPR, for identifying and mitigating privacy risks before deploying a system that processes personal data at scale. history
Enables AI Auto Consent & Provisioning Agents (Shadow Mode) for SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2 Studio Pilot users to auto-generate policies from public data without applying changes yet.
Adds approval workflows for impact assessments, allowing users to assign approvers and track status within Vanta.
Makes the Vanta Agent globally available via top navigation with context-aware prompts on any page.
Links existing Jira issues to Vanta documents to improve traceability without creating duplicate tickets.
Expands Personnel Tools for the Vanta Agent to answer questions about task completion, training, and background checks via natural language.
+2 moreshow less
Adds business unit segmentation for tests, enabling views of impacted units, resource counts, and segment-specific remediation.
Introduces versioning and history tracking for Impact Assessments (DPIAs) with draft creation from approved versions and comparison capabilities.
AI Auto Consent agents in shadow mode, Jira doc linking, Vanta Agent global availability, and scalable product tests.
Adds AI-driven provisioning agents for SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. policy generation (shadow mode) that auto-opt Core and Core Plus domains
Enables linking existing Jira issues directly to Vanta documents for traceability
Makes the Vanta Agent globally available via top navigation with context-aware prompts
Allows assigning approvers and tracking status within the impact assessment workflow
Supports personnel queries for the Vanta Agent including training progress, background checks, and policy acceptance rates
+2 moreshow less
Links impact assessments to processing activities bidirectionally
Redesigns product test infrastructure with paginated processing to support large data volumes
Automated supplier asset discovery for External Monitoring and January 2026 framework updates
Adds automatic asset discovery to External Monitoring, surfacing security signals across a supplier's full digital footprint without manual input.
Updates the Standardised Assessment Framework (January 2026) with refreshed controls for domains D (IT Operations), E (Software Development), F (Network & Cloud Security), and K (Artificial Intelligence).
Adds Data Protection controls to the Small Framework.
Conveyor adds an AI Trust Center Agent that auto-fills customer security questionnaires via chat upload.
Adds Trust Center Agent to automatically analyze uploaded security questionnaires and generate answers from your Knowledge Library without requiring additional credits
Allows account admins to toggle the Agent on and enable questionnaire filling in Trust Center settings
2 details in Everything
1 more release in this issue
· 2026-01-07 → 2026-01-21
Panorays Q4’25 adds Smart Match autofill from compliance docs, DORA RoI submission workflow, segment-level custom factors, and API entity expansion.
Smart Match now analyzes uploaded compliance documentation (certifications, attestations, formats like SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria.) using Gemini-powered intelligence to generate referenced answer suggestions
New DORA Register of Information solution with automated tools for submission-ready ZIP file generation that complies with regulatory and technical formatting requirements
Activity Center captures new events including additional remediation details, reminders, and API tokens with timestamps
Segments now support assigning a dedicated business owner, applying unique Custom Factors at the segment level, generating Approval Snapshots, and adding internal notes/comments/tagging colleagues
Smart Validation adds an explanation field to provide context behind AI-suggested questionnaire reviews
+1 moreshow less
Public API expanded to support additional platform entities and workflows for custom integrations
CISO Assistant v3.10.4 adds manager-level review of user assignments, SUM/AVG audit score aggregation, tab titles, and a BIO2 library.
└──▷ GET THIS VERSION
$ git clone --branch v3.10.4 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.10.4
Adds SUM or Average as options for audit score aggregation via the new UI control
Enables managers to review other users' assignments through the 'review other users assignments' feature in PRO tier
Adds dynamic tab titles to the UX interface
Includes the new BIO2 library (lib)
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The fix!: multiple improvements and simplifications on GDPR module indicates a breaking change in the GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. module logic, potentially resetting legal basis values to defaults.
6 more releases in this issue
· 2026-01-02 → 2026-01-27
CISO Assistant v3.10.3 adds domain focus mode and a kanban view for applied controls with table filter support.
└──▷ GET THIS VERSION
$ git clone --branch v3.10.3 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.10.3
└──▷ HOW TO FIND IT
Restrict all listed objects to a specific domain in the interface.
📍In the console, go to the main view and enable domain focus mode for the target domain
Visualize applied controls as cards while keeping current table filters active.
📍In the console, go to the applied controls view and switch to kanban mode
Adds domain focus mode to filter UI objects by a specific domain
Introduces kanban mode for applied controls that respects existing table filters
Adds CIS Controls v8 and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. cache, enhances assignments and incident filtering in CISO Assistant v3.10.2
└──▷ GET THIS VERSION
$ git clone --branch v3.10.2 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.10.2
feat(tool) adds CIS Controls v8 to NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0 & ISO27001:2022 mapping tools
feat adds cache for IAM operations
feat expands my assignments page to support teams-related assignments
feat allows incidents with identical names within the same domain if they have different ref_ids
Adds quick filter for updatable libraries and refactors actor visibility rules
└──▷ GET THIS VERSION
$ git clone --branch v3.10.1 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.10.1
Migrates additional relations from User to Actor type for better granular access control
New clica backup/restore command, EBIOS RMEBIOS RMA French risk-management method published by ANSSI for analysing cyber threats and selecting countermeasures; tools use it to structure risk assessments that satisfy French and EU regulatory expectations. Excel import/export, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support for TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. and risk assessment skills
└──▷ GET THIS VERSION
$ git clone --branch v3.10.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.10.0
Adds clica CLI command for full backup/restore operations
Enables exporting and importing EBIOS RM data via Excel files with the new beta feature
Expands the MCP server to support management of TPRM objects
Adds a new AI skill for basic risk assessment on the MCP server
Supports Microsoft Cloud Security Benchmark in the library
CISO Assistant v3.9.2 adds Estonian E-ITS framework support, simplified Chinese translation, and optional enclave visibility in the org tree.
└──▷ GET THIS VERSION
$ git clone --branch v3.9.2 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.9.2
└──▷ HOW TO FIND IT
Use the new Estonian E-ITS framework for compliance mapping instead of previous frameworks.
📍Select Estonian E-ITS from the framework dropdown in the dashboard.
Switch the application interface to simplified Chinese.
📍Navigate to Settings › Language and select Chinese (Simplified).
Hide cloud or external enclaves from the organisation hierarchy view for clarity.
📍In the Organisation tree view, toggle the Show/Hide Enclaves switch.
Supports the Estonian E-ITS framework
Adds simplified Chinese (zh-hans) translation
Enables toggling enclave visibility on the organisation tree view
CISO Assistant v3.9.1 adds CI/CD test for enterprise backup/restore and improves audit performance.
└──▷ GET THIS VERSION
$ git clone --branch v3.9.1 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.9.1
Adds ci/cd test for enterprise backup/restore in community edition to validate recovery workflows
mcp-security secops-v0.5.1 adds custom time-range support to UDM search and event search tools.
└──▷ GET THIS VERSION
$ git clone --branch secops-v0.5.1 https://github.com/google/mcp-security.git
# already have the repo? check out this version:$ git checkout secops-v0.5.1
Runlayer is an MCP gateway that enforces identity-mapped permissions and detects threats across the agents and MCP servers employees use.
Runlayer v1.25.0 introduces Deploy from Catalog, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Watch, Agent Accounts, and security scanner management tools.
Adds ability to deploy servers directly from the Catalog with Runlayer Deploy
Adds MCP Watch for shadow MCP discovery, tracking, and migration identification in Analytics
Adds capability to trigger re-analysis of discovered MCP servers from the UI via MCP Watch
Adds Microsoft Agent 365 integration with full OAuth broker support and catalog servers
Enterprise Gateway 2.0.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. GA, unified rerank API, new budget condition keys, inline images plugin, and dynamic pricing.
MCP GatewayMCP GatewayA server that sits between MCP clients and one or more Model Context Protocol backends, routing tool calls and aggregating context sources so a single endpoint exposes many AI-agent integrations at once. is now Generally Available with centralized server management, OAuth 2.1OAuth 2.1A consolidated draft of the OAuth authorization framework that merges OAuth 2.0 with its most important security BCP updates, dropping unsafe flows so tools can delegate user access without handling credentials directly./API key auth, workspace-level provisioning, and full observability
/rerank unified endpoint provides consistent rerankingrerankingA model that re-scores a first batch of search results against the query and reorders them, more accurately than the fast first-stage search. across Cohere, Jina, and Voyage AI without code changes
New condition keys for budget/rate limit policies: virtual_key, provider, config, prompt, and model (with wildcard support)
Inline Image URLs Plugin converts external image URLs to inline base64 data for VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware.-SC environments
MODEL_CONFIGS_PROXY_FETCH_ENABLED=ON environment variable enables dynamic model pricing fetch in Air-Gapped deployments via Backend service
+1 moreshow less
GCP Workload Identity support for keyless authentication in GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. environments accessing GCS and VertexAI
6 details in Everything
7 more releases in this issue
· 2026-01-06 → 2026-01-28
Adds CrowdStrike AIDR partner plugin integration for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. input/output scanning in Enterprise Gateway 1.17.15
Portkey Backend 1.7.3 adds tag support for integrations/providers, MCP OAuthMCP OAuthAn authentication layer for the Model Context Protocol that lets MCP clients obtain delegated access tokens so cyber tools can call MCP servers on a user's behalf without handling raw credentials. email/username fields, and JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. scopes.
Adds tags parameter support when creating or updating integrations/providers and allows filtering by tags in list endpoints
MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. OAuth token introspection endpoint now returns email and username fields for richer user context
Added read and list scopes to control plane resources for JWT-authenticated requests
Portkey Enterprise Gateway 1.17.12 adds Responses API Hooks, Azure Shield Prompt/Protected Material guardrails, and sequential execution.
Apply input/output guardrails and custom webhooks to /v1/responses endpoint via new Responses API Hooks support
Detect jailbreak and prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. attacks using Shield Prompt Azure AI Content Safety integration
Detect copyrighted or protected text content in LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. outputs using Protected Material Azure AI Content Safety integration
Execute guardrails sequentially using the new sequential flag instead of parallel execution
Add real-time voice interaction support for xAI via Realtime Voice Agent API (Grok Voice API) with WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. connections
+5 moreshow less
Add Google Maps grounding support for Gemini/Vertex AI models
Support new parameters for gpt-image-1: moderation, output_format, output_compression, background, partial_images, and stream
Specify custom authentication scopes for Azure OpenAI Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. auth using the x-portkey-azure-entra-scope header
Support output_expires_after parameter for batch creation, plus input_blob and output_folder for Azure OpenAI blob-based inputs
Enable Anthropic citations feature via native Messages API format on Bedrock /v1/messages route
Portkey Backend v1.7.0 adds workspace deployment restrictions, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. auto-provisioning, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. provider support, and new model configuration environment variables.
Adds workspace-based deployment restrictions to gateways for multi-tenant isolation
Adds endpoints to assign workspaces during gateway create/update operations
Adds a new API endpoint to retrieve entities (API keys, workspaces, users) associated with usage and rate limit policies
Enables automatic provisioning of first-time SSO users via OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. or SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.
Adds Oracle Cloud Infrastructure (OCI) Generative AI as a supported provider
+2 moreshow less
Adds MODEL_CONFIGS_PROXY_FETCH_ENABLED, MODEL_CONFIGS_PROXY_URL, MODEL_CONFIGS_PRICING_LOG_STORE_PATH, MODEL_CONFIGS_CAPABILITIES_LOG_STORE_PATH, MODEL_CONFIGS_CAPABILITIES_LOCAL_PATH, and MODEL_CONFIGS_PRICING_LOCAL_PATH environment variables for model config sourcing
Enables automatic reactivation of exhausted workspace budgets when credit limits are increased
Portkey Backend 1.6.2 adds auto-expiry for API keys and MySQL SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. configuration via env vars.
Expired API keys are now automatically marked as expired by a background worker process
Added support for external MySQL SSL connection modes via the DB_SSL environment variable
Zenity discovers, secures and governs enterprise AI agents from buildtime to runtime across SaaS, endpoint and cloud.
Introducing Data Lens for AI agent runtime data visibility and oversight.
Launches Data Lens, a new capability within Zenity AI Observability that aggregates AI activity to show which data items agents touch, how frequently, and to whom at runtime.
ToolHive v0.8.3 adds configurable UserInfo mapping for OAuth authserver and header forwarding support in MCPRemoteProxy CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. and workloads API
└──▷ GET THIS VERSION
$ git clone --branch v0.8.3 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.8.3
Adds headerForward to the MCPRemoteProxyCustom Resource DefinitionCustom Resource DefinitionA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. (CRD)
Adds headerForward field to the workloads REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. for proxying HTTP headers
Adds configurable UserInfo field mapping and support in the authserver's OAuth provider
3 details in Everything
21 more releases in this issue
· 2026-01-05 → 2026-01-29
ToolHive Operator adds headerForward to workloads REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.106 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.106
Adds the headerForward field to the workloads REST API for forwarding HTTP headers
Adds a VERSION file to support release process improvements
ToolHive Operator v0.0.105 adds configurable UserInfo mapping and headerForward to MCPRemoteProxy CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.105 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.105
Adds userInfoFieldMapping configuration option to the authserver for custom OAuth provider claims.
Adds headerForward field to MCPRemoteProxy CRD to forward HTTP headers.
ToolHive v0.8.1 adds header forwarding, EMBEDDING_SERVERCRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it., POST /oauth/register endpoint, and token persistence
└──▷ GET THIS VERSION
$ git clone --branch v0.8.1 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.8.1
Add --header-forward CLI flags to configure header forward configuration for remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers
Add EmbeddingServer CRD for deploying HuggingFace embedding modelsembedding modelsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. in Kubernetes
Add POST /oauth/register endpoint handler for dynamic client registration in the authserver
Adds header forwarding middleware via new configuration and K8s status reporting capability
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.104 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.104
Adds forward_headers configuration option to wire a header forward middleware in the runner
Adds EmbeddingServer CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. for deploying HuggingFace embedding modelsembedding modelsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.103 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.103
Adds a token endpoint handler to the authentication server component
Adds a KeyManager for signing key lifecycle management to the authserver
ToolHive operator adds EmbeddingServer CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. for deploying HuggingFace models and auth server signing key lifecycle management
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.5.27 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.5.27
EmbeddingServer CRD enables deployment of HuggingFace embedding modelsembedding modelsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. via the operator.
KeyManager handles signing key lifecycle for the authserver.
Adds header forward middleware for remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.102 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.102
Adds bearerToken field to MCPExternalAuthConfig CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. for external auth
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.100 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.100
Maps thvCABundle to OIDCConfig.CACertPath and updates token injection behavior.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.99 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.99
Adds OIDCConfig.CACertPath field in the CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. to map from thvCABundle for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. CA configuration
Changes operator logic to skip token injection when token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. is active
ToolHive v0.8.0 adds thv status CLI command, OAuth userinfo fetching, and VMCP dynamic/static mode support
└──▷ GET THIS VERSION
$ git clone --branch v0.8.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.8.0
Adds the thv status subcommand to retrieve detailed information about running ToolHive workloads
Adds UserInfo fetching support to the authserver's upstream OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. provider for identity enrichment
Enables dynamic and static mode configuration in the VirtualMCPServer operator via the mode setting
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Removes support for the none secrets provider; workloads using this provider must migrate to a different secret backend
Adds thv status CLI command for detailed workload info and OAuth handler infrastructure in ToolHive
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.97 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.97
Adds thv status CLI subcommand to retrieve detailed information about running ToolHive workloads
Adds new OAuth handler infrastructure including discovery endpoints for the authserver
Adds UserInfo fetching support within the authserver's upstream OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. provider
Adds support for dynamic/static modes in the VirtualMCPServer operator
ToolHive v0.7.2 adds proxy_port support to the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server registry and initial OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. authorization server capabilities
└──▷ GET THIS VERSION
$ git clone --branch v0.7.2 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.7.2
proxy_port configuration key in MCP server registry settings
authserver component with base OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 provider implementation
config block for OAuth2 authorization server with JWKSJWKSA JSON Web Key Set, a published collection of cryptographic keys. Applications use it to find the public key needed to verify a token's signature. utilities support
Adds proxy_port configuration key to the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server registry in toolhive-operator v0.5.24
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.5.24 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.5.24
ToolHive CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. 0.0.95 adds OAuth loopback support and CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. config migration
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.95 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.95
Adds OAuth client factory with RFC 8252 loopback support to authserver
Migrates Remaining VirtualMCPServer Fields to spec.config
2 details in Everything
└──▷ BREAKING ON UPGRADE
!VirtualMCPServer fields are now nested under spec.config instead of the top level.
toolhive-operator-0.5.22 adds a new Helm chart for deployment and OAuth auth server storage/interfaces
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.5.22 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.5.22
Add OAuth authorization server storage interfaces and types
authserver: Add OAuth session management for JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. claims and IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. linking
ToolHive v0.6.17 adds bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. authentication flags and group control feature flags.
└──▷ GET THIS VERSION
$ git clone --branch v0.6.17 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.6.17
Enables control over controller groups via new feature flags
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!The rawConfig field is removed from the vMCP configuration structure in favor of camelCase keys
Adds X-Forwarded-Prefix support for SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. endpoint URL rewriting in the Helm chart
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.91 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.91
ToolHive adds bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. authentication support with dynamic discovery and CLI flags.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.89 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.89
Adds --bearer-token and --bearer-token-file CLI flags for specifying credentials
Implements DynamicRegistry with version-based cache invalidation for backend discovery
Adds reactive 401 detection logic for bearer token authentication failures
Extends the Transport interface with remote server configuration methods
Adds feature flags to enable/disable controller groups
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.5.19 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.5.19
--controller-groups flag added to allow users to enable or disable specific controller groups in the ToolHive Operator
Ai-Safe2-Framework provides governance, risk, and compliance controls for securing agentic AI systems and non-human identities.
v2.1 adds specialized sub-domains for Swarm Intelligence, Non-Human Identity governance, and memory security to the AI Safe² framework.
└──▷ GET THIS VERSION
$ git clone --branch v2.1 https://github.com/CyberStrategyInstitute/ai-safe2-framework.git
# already have the repo? check out this version:$ git checkout v2.1
Introduces Supply Chain Artifact Validation via OpenSSF Model Signing (OMS) under Pillar 1.
Adds real-time Non-Human Identity (NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls.) secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. with GitGuardian integration.
Adds Multi-Agent Boundary Enforcement with Agent-to-AgentAgent-to-AgentAgent2Agent, an open protocol started by Google for AI agents from different vendors to discover each other, delegate tasks and exchange results. It complements MCP, which connects an agent to tools. (A2AA2AAgent2Agent, an open protocol started by Google for AI agents from different vendors to discover each other, delegate tasks and exchange results. It complements MCP, which connects an agent to tools.) protocol restrictions.
Introduces NHI Access Control featuring automated provisioning/decommissioning and Just-In-Time (JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility.) privilege elevation.
Enhances Audit capabilities with Consensus Voting Validation for swarms and cryptographic Agent State Verification using SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hashing.
+8 moreshow less
Mandates a Swarm Topology Map to document multi-agent communication patterns under Inventory.
Introduces centralized kill switches for multi-agent systems under Fail-Safe.
Expands Recovery to cover Agent State & Memory Snapshots and RAGRAGRetrieval-augmented generation: looking up relevant documents and adding them to the prompt before the model answers. It grounds responses in private or current data without retraining./Knowledge Base versioning with rollback capabilities.
Formalizes Consensus Failure Escalation for human intervention when agents disagree.
Delivers real-time Distributed Agent Health & Consensus Monitoring.
Adds advanced Memory Poisoning Monitoring to detect adversarial trigger phrases and semantic drift.
Achieves Universal GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. Tagging mapping every sub-domain to seven external frameworks including ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 42001.
Adds reasoning guardrail connector and GLiNER for open PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. detection
└──▷ GET THIS VERSION
$ git clone --branch v0.20.0 https://github.com/NVIDIA-NeMo/Guardrails.git
# already have the repo? check out this version:$ git checkout v0.20.0
Add support to auto select multilingual refusal bot messages
Adding GLiNER for PII detection (open alternative to PrivateAI)
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The streaming field has been removed from the config
arsenal-ng v0.7 adds SprayHound to its curated command reference toolkit.
└──▷ GET THIS VERSION
$ git clone --branch v0.7 https://github.com/halilkirazkaya/arsenal-ng.git
# already have the repo? check out this version:$ git checkout v0.7
Adds SprayHound to the command cheatsheet collection for password sprayingpassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password. workflows.
Obsidian v1.11.4 adds SecretStorage API, Keychain UI section, paneType URI param, and daily note format selector.
Adds the SecretStorage API and SecretComponent for plugins to share secrets across multiple plugins via a user-provided name
Adds Keychain settings section in the UI for storing plugin secrets
New setting Files & links › Default file to open allows choosing between Last opened files, New note, Specific note, or Daily note
URI actions (new, open, daily) now support the paneType parameter with values tab, split, and window
Adds new setting Community Plugins › Automatically check for plugin updates to enable background checks every 3 days
+2 moreshow less
Adds Copy path submenu item to the file context menu
Daily notes format can now be selected from a list of predefined formats
7 details in Everything
└──▷ BREAKING ON UPGRADE
!Users previously using the Daily notes option to Open daily note on startup must update their vault to use the new setting Files & links › Default file to open instead.
SysReptor 2026.1 adds LaTeX math in Markdown, Mistral AI support, higher-res PDF charts, and images in Excalidraw notes.
└──▷ GET THIS VERSION
$ git clone --branch 2026.1 https://github.com/Syslifters/sysreptor.git
# already have the repo? check out this version:$ git checkout 2026.1
Supports LaTeX math expressions in the Markdown editor for rendering equations in reports.
Adds Mistral AI as a provider option for the AI agent.
Increases resolution of charts and Mermaid diagrams exported to PDF.
Supports embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. images in Excalidraw notes.
Allows deleting users who are currently members of a project.
bpf-linker v0.10.0 adds in-memory linking, LLVM IR file support, and macOS/Linux ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. release builds.
└──▷ GET THIS VERSION
$ git clone --branch v0.10.0 https://github.com/aya-rs/bpf-linker.git
# already have the repo? check out this version:$ git checkout v0.10.0
Adds in-memory linking, enabling BPF programs to be linked without writing intermediate files to disk.
Supports LLVM IR files as linker inputs, broadening the set of accepted input formats.
Releases now available for macOS and Linux ARM platforms, using LLVM from Rust CI.
Cloudflare is a connectivity cloud platform delivering internet security, performance, and developer infrastructure services.
Magic WAN and Transit customers can now configure BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. peering over IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications./GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. tunnels via the dashboard (beta)
Enables establishing eBGP sessions between customer devices and Magic WAN/Magic Transit services when connected via IPsec or GRE tunnel on-ramps
Adds MD5 authentication support for BGP sessions to prevent route hijacking or misconfiguration
2 details in Everything
35 more releases in this issue36 more releases in this issue · 2026-01-01 → 2026-01-30
Windows WARP client adds NetBIOS over TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./IP management and improves multi-user MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. association
Improves Multi-user mode so that switching from pre-login to user registration no longer loses MDM configuration association
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!NetBIOS over TCP/IP is now disabled by default in the Windows WARP client; it must be explicitly enabled in device profile settings.
Adds configurable IPv4 source IP range (100.64.0.0/12 by default) for traffic to private networks in Unified Routing (beta)
Introduces new requirement: Cloudflare One Networks Write permission to configure source IPs
Extends supported connectors to GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation., IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications., CNI, WARP Connector, and WARP Client for Unified Routing mode
New granular API token permissions added for Cloudflare Access
Adds Access: Organizations Revoke permission for revoking user sessions in a Zero Trust organization
Adds Access: Population Read permission for read-only access to SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. users and groups synced from an identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.
Adds Access: Population Write permission for creating or modifying SCIM users and groups synced from an identity provider
Cloudflare Rulesets adds encode_base64() and sha256() functions for in-rule cryptography
Adds encode_base64(input, flags) function to enable Base64 encoding directly within Cloudflare Ruleset expressions.
Adds sha256(input) function to compute SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. digests of strings for use as request attributes or signatures.
Cloudflare Terraform Provider v5.16.0 adds BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. support for Magic WAN tunnels and automatic routing attributes
Adds automatic_return_routing attribute to magic_wan_gre_tunnel resource for automatic routing control
Adds automatic_return_routing attribute to magic_wan_ipsec_tunnel resource for automatic routing control
Adds BGP configuration support with new bgp_model attribute to magic_wan_gre_tunnel resource
Adds BGP configuration support with new bgp_model attribute to magic_wan_ipsec_tunnel resource
Adds bgp_status computed attribute to magic_wan_gre_tunnel resource for BGP connection status information
+9 moreshow less
Adds bgp_status computed attribute to magic_wan_ipsec_tunnel resource for BGP connection status information
Adds custom_remote_identities attribute to magic_wan_ipsec_tunnel resource for custom identity configuration
Enhances schema with BGP-related attributes and validators in magic_wan_gre_tunnel resource
Enhances schema with BGP and identity-related attributes in magic_wan_ipsec_tunnel resource
Adds request body buffering support to ruleset resource
Enhances ruleset data source with additional configuration options
Adds waf_challenge as new supported error page type identifier in custom_pages resource and data source schemas
Adds observability logs attributes to list data source model in workers_script
Enhances list data source schema with additional configuration options in workers_script
Cloudflare now terminates HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer. client cancellations immediately and logs them as status 499.
HTTP/3 clients cancelling requests are now terminated immediately at the edge rather than forwarded to the origin.
Logs for terminated HTTP/3 request streams now report 499 status codes instead of upstream response codes.
WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. release updates Managed Ruleset detections to block SQL Injection by default
Cloudflare Managed Ruleset rule ...ad7dad3e (SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. - String Function) now blocks instead of logs, merged into rule ...d32b798c.
Cloudflare Managed Ruleset rule ...9e553ad3 (SQLi - Sub Query) now blocks instead of logs, merged into rule ...743e66b1.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Managed ruleset detections previously logging SQL Injection attempts are now actively blocking traffic.
Workers AI now offers FLUX.2 [klein] 4B for fast image generation with multi-reference support.
Launches the @cf/black-forest-labs/flux-2-klein-4b model on Workers AI, a distilled variant optimized for speed and cost.
Enables multi-reference image styling via the input_image_0 through input_image_3 multipart parameters in the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
Exposes a new fixed 4-step inference process for the FLUX.2 [klein] model via the Workers AI runtime.
Cloudflare dashboard reorganizes Network Services navigation under Routes, Connectors, and Insights.
Renames Magic Firewall policies to Firewall Policies in the dashboard navigation
Moves Magic Transit and Magic WAN configuration items (IP Prefixes, GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation./IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. Tunnels) under new top-level navigation sections Routes and Connectors
Relocates network analytics, health, and real-time analytics to the Insights section of the menu
Renames Magic WAN Connectors and Connector On-Ramps to Appliances and Appliance profiles under Connectors > Appliances
WARP for Windows GA introduces external signal connectivity management and Antivirus posture check
Adds the ability to manage WARP client connectivity for all devices using an external signal from an on-premises HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. endpoint
Adds a new WARP client device posture check for Antivirus that verifies presence and update status
Adds support for transparent HTTP proxying in addition to CONNECT-based proxying in Proxy mode
macOS WARP 2025.10.186 adds proxy mode support for transparent HTTP and global external signal management.
Proxy mode now supports transparent HTTP proxying in addition to the existing CONNECT-based proxying.
Administrators can now manage WARP client connectivity for all devices in their fleet using an external signal sent from an on-premises HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. endpoint to force disconnect or reconnect clients.
Linux WARP client GA adds non-filesystem disk encryption posture check, transparent HTTP proxying support, and global device connectivity management via external signal.
Adds Linux disk encryption posture check support for dm-crypt and other non-filesystem encryption types
Adds transparent HTTP proxying to the existing CONNECT-based Proxy mode
Adds the ability to manage WARP client connectivity for all devices in a fleet using an external signal from an on-premises HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. endpoint
Admin activity logs now capture creation of DNS over HTTP (DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring.) users.
Cloudflare Workers now supports building and deploying microfrontend applications via a new template with router logic.
Adds a microfrontends template to Cloudflare Workers that automatically creates a router Worker for splitting applications into independently deployable units.
Enables framework flexibility by allowing multi-framework applications (e.g., Astro, Remix, Next.js) within a single microfrontend setup.
Provides built-in request routing, HTML/CSS/header rewriting, asset path rewrites, preload capabilities, and View Transitions API support via the router Worker.
Cloudflare TS SDK v6 adds D1 Time Travel, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server support in Access, and AI Search CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information.
Adds client.d1.database.timeTravel methods getBookmark() and restore() for point-in-time recovery
Adds client.aisearch client with full CRUD operations for Instances, Items, Jobs, and Tokens
Adds createV1, listV1 and new sub-resources Sinks and Streams to the Pipelines client (client.pipelines) for v1 migration
Adds mcp and mcp_portal as new ApplicationType values in Zero-Trust Access Applications
Adds client.zeroTrust.access.aiControls.mcp client with CRUD methods for Portals and Servers
+1 moreshow less
Adds detections.get() method to the Leaked Credential Checks client
6 details in Everything
└──▷ BREAKING ON UPGRADE
!DNS record interfaces renamed: e.g. RecordResponse.ARecord is now RecordResponse.A
!Pipelines v0 API is deprecated; use createV1, listV1 methods instead
!Origin CA csr, hostnames, and request_type params are now required in OriginCACertificateCreateParams
!Radar V2 methods require the dimension parameter
!Pipelines ConfigurationUpdateParams.properties is removed; use normalize
!Removed CloudflaredCreateResponse, CloudflaredListResponse, CloudflaredDeleteResponse, CloudflaredEditResponse, CloudflaredGetResponse from Zero-Trust Tunnels
Arcade adds Ed25519Ed25519A fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe. support to MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers and dashboard expiring API key management.
arcade-mcp supports the Ed25519 algorithm for server authentication
Dashboard now includes UI controls to manage expiring API keys
2 details in Everything
1 more release in this issue
· 2026-01-09 → 2026-01-16
Arcade introduces OAuth for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Gateways, per-project secret sharing, member listing APIs, and new Google/ PagerDuty toolkits
Adds OAuth support for MCP Gateways to enable federated authentication flows
Allows the same secret to be stored in multiple projects via shared reference
Supports listing members and invited users for a given project via API
Adds optional image_url and hex_color fields for organization and project resources
Enables [Google Contacts] phone number support in the MCP App
+1 moreshow less
Converts [Gmail] integration to an optimized MCP App with improved performance
THE CYBER TOOLCHAIN