The Cyber Toolchain — issue -008, November 30, 2025
THE CYBER TOOLCHAIN
NO. -008
Tail
THE DAILY RELEASE FIREHOSE
PUBLISHED NOVEMBER 30, 2025 · EVERY DAY
EDITIONStail|grep|head|ls|diff|uniq
The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
Scan a raw IP address directly when the target has no hostname or DNS record.
shell
strix scan 192.168.1.50
Adds --instruction flag to accept file-based pentest configs instead of CLI strings
Enables real-time results persistence: findings are written to disk as they are discovered
Adds a live agent stats panel (vulnerabilities, tokens, cost, active agents) in both TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. and CLI
Adds IP address scanning support for targets not fronted by hostnames
Adds prompt modules for Open Redirect, Subdomain Takeover, and Info Disclosure
5 details in Everything
1 more release in this issue
· 2025-11-01 → 2025-11-25
The open-source wireless research platform for ESP32.
GhostESP v1.8.1 introduces HTTP Digest auth, WPA2/WPA3WPA3The third generation of the Wi-Fi Protected Access authentication and encryption standard, maintained by the Wi-Fi Alliance, offering stronger handshake protection and per-session encryption compared to WPA2. mixed AP mode, and a new universal IR file.
└──▷ GET THIS VERSION
$ git clone --branch v1.8.1 https://github.com/GhostESP-Revival/GhostESP.git
# already have the repo? check out this version:$ git checkout v1.8.1
Replaces Basic HTTP auth with HTTP Digest (RFC2617) using HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it.-signed stateless nonces in the WebUI
Changes default AP authmode to WPA2/WPA3 mixed for ESP32‑C5 and ESP32‑C6
Adds included TURNHISTVOFF universal IR file with popular TV Power buttons
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Basic HTTP auth is replaced by HTTP Digest, requiring clients to support RFC2617
The firmware for the HackRF+PortaPack H1/H2/H4/H4M.
Mayhem v2.3.1 adds EPIRB reception, standalone app API v3, dynamic screen support, and Morse trainer game.
└──▷ GET THIS VERSION
$ git clone --branch v2.3.1 https://github.com/portapack-mayhem/mayhem-firmware.git
# already have the repo? check out this version:$ git checkout v2.3.1
└──▷ HOW TO FIND IT
Deploy firmware assets to the device for offline map and app support.
📍Unzip mayhem_v2.3.1_COPY_TO_SDCARD.zip contents to a FAT32 MicroSD card.
Adds implementation of EPIRB receiver for 406 MHz distress beacon detection
Adds Standalone app api v3 enabling external application development
Adds Multi screen support with dynamic alignment for better UI rendering
Adds Openstreetmap support for map-based visualizations
Adds Morse trainer game for practice and learning
+2 moreshow less
Adds Adult toy controller as an external app
Adds sht4x sensor support for environmental monitoring
A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32.
v1.8.10 adds a channel summary graph and allows CLI control of GPS pins on CYD hardware.
└──▷ GET THIS VERSION
$ git clone --branch v1.8.10 https://github.com/justcallmekoko/ESP32Marauder.git
# already have the repo? check out this version:$ git checkout v1.8.10
A portable multi-tool for pentesters and geeks; this is its official firmware.
Flipper Zero 1.4.2 adds nfc and buzzer CLI commands, 9 new Sub-GHzSub-GHzRadio frequencies below 1 GHz (typically 300–900 MHz) used by IoT devices, key fobs, garage doors, and industrial sensors; cyber tools target this band to capture, replay, or analyze those wireless signals. protocols, JS GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. bindings, and iButton TM01x write support
└──▷ GET THIS VERSION
$ git clone --branch 1.4.2 https://github.com/flipperdevices/flipperzero-firmware.git
# already have the repo? check out this version:$ git checkout 1.4.2
Adds nfc CLI command for low-level NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. interaction
Adds 9 new Sub-GHz protocols to existing supported list
Adds buzzer CLI command to control the device buzzer
Adds binding to more JS GUI elements for advanced script UIs
Adds support for writing TM01x Dallas ID keys in iButton module
+1 moreshow less
Adds country name display for FDX-B animal tags in LF RFID reader
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Existing BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems. device pairings are potentially susceptible to brute-force attack; users must un-pair all devices from Flipper's settings and re-pair them
airgeddon v11.60 adds WPA3WPA3The third generation of the Wi-Fi Protected Access authentication and encryption standard, maintained by the Wi-Fi Alliance, offering stronger handshake protection and per-session encryption compared to WPA2. downgrade attack and hashcat hash file support for offline decryption
└──▷ GET THIS VERSION
$ git clone --branch v11.60 https://github.com/v1s1t0r1sh3r3/airgeddon.git
# already have the repo? check out this version:$ git checkout v11.60
Adds downgrade attack against WPA2/WPA3 Transitional (Mixed Mode) networks in the WPA3 menu
Supports Handshake and PMKIDPMKIDA 128-bit identifier derived from a PMK, the access point MAC, and the client MAC in WPA2 handshakes, allowing offline cracking of Wi-Fi passwords without capturing a full four-way handshake. hashcat hash files in the personal offline decryption menu
Improves Enterprise fake AP compatibility for Evil Twin attacks
Modifies lighttpd web server configuration during Evil Twin captive portal attacks to enable plugin integration
Metasploit Pro 4.22.9 adds ReDoc detection, NCR RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. and Windows startup persistence modules; pro_tasks -a CLI flag
Adds new module #20594 for detecting publicly exposed ReDoc API documentation pages
Adds new unauthenticated RCE module #20650 for NCR Command Center Agent via malicious XML
Adds new persistence module #20662 for Windows startup folder (user or system-wide)
Adds support for aarch64 payloads to exploit/multi/http/gitea_git_fetch_rce (#20661)
Dradis Pro 4.19 adds Dradis Echo AI integration, Gateway webhooks, and IssueLibrary CSV import.
Adds dradis-echo optional LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. integration to summarize scanner output, rewrite notes, and enhance remediation advice
Adds webhooks for Dradis Gateway events (contributor requests, remediation progress, project completions) to trigger automated actions
Adds CSV upload capability to the IssueLibrary for bulk-importing custom issues
Adds bulk-delete action for entries in the IssueLibrary view
Adds QA status visibility when adding IssueLibrary entries to a project
+1 moreshow less
Adds inline code and highlight code buttons to the Release Notes Editor toolbar
Instaloader v4.15 adds Post.video_play_count property and updates headers to Chrome/142 and latest iOS.
└──▷ GET THIS VERSION
$ git clone --branch v4.15 https://github.com/instaloader/instaloader.git
# already have the repo? check out this version:$ git checkout v4.15
└──▷ USE IT
Access video play counts when iterating over a profile's posts in a script.
python
from instaloader import Instaloader, Profile
L = Instaloader()
profile = Profile.from_username(L.context, "<username>")
for post in profile.get_posts():
if post.is_video:
print(post.shortcode, post.video_play_count)
Adds Post.video_play_count property to retrieve video play counts from posts.
Updates default user agent to Chrome/142 for improved compatibility.
Updates Instagram iOS version headers to match one of the latest app versions.
waymore v6.6 extends --from-date/--to-date filtering to Wayback URL collection, Common Crawl, AlienVault, and VirusTotal.
└──▷ GET THIS VERSION
$ git clone --branch v6.6 https://github.com/xnl-h4ck3r/waymore.git
# already have the repo? check out this version:$ git checkout v6.6
└──▷ TRY IT
Collect URLs from all sources (Wayback, Common Crawl, AlienVault, VirusTotal) scoped to a specific year — useful for narrowing recon to a known vulnerable window.
$ waymore -i example.com -mode U -from 20230101 -to 20231231
Download archived responses for a target within a date range without also applying the date filter to URL collection (filter-responses-only mode).
Applies -from/--from-date and -to/--to-date date bounds to Wayback Archive URL collection (mode U), not just response downloads (mode R).
Extends date-range filtering to Common Crawl, AlienVault OTXOTXAlienVault's Open Threat Exchange, a community platform where researchers share indicators of compromise; cyber tools integrate it to pull live threat intelligence feeds without building their own collection infrastructure., and VirusTotal URL sources — Common Crawl index selection now driven by these flags instead of the removed -lcy argument.
Date filters are skipped for URL collection when -f/--filter-responses-only is passed, preserving existing filter-only workflows.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The -lcy argument is removed; use -from/--from-date and -to/--to-date to control which Common Crawl indexes are queried.
Hunter adds automatic Unsubscribe and Out-of-Office detection to Campaigns
Hunter automatically detects unsubscribe requests by adding messages containing unsubscribe within the first 100 characters to the Unsubscriptions section.
Hunter recognizes common out-of-office phrases like 'out of the office,' 'away from my desk,' 'currently unavailable,' 'on vacation,' or 'I will respond upon my return.'
Detected unsubscribe and out-of-office emails are visible in the Inbox, allowing users to manually pause scheduled follow-ups.
Naabu v2.3.6 adds MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. output, file-based port lists, UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. payload support, and custom asset IDs.
└──▷ GET THIS VERSION
$ git clone --branch v2.3.6 https://github.com/projectdiscovery/naabu.git
# already have the repo? check out this version:$ git checkout v2.3.6
└──▷ TRY IT
Include MAC addressesMAC addressesA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. in JSON output to correlate open ports with hardware identifiers on a local network segment.
gowitness 3.1.0 adds single-browser multi-tab scanning, skip-network-logs flag, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. Nessus support, and gallery keyboard shortcuts.
└──▷ GET THIS VERSION
$ git clone --branch 3.1.0 https://github.com/sensepost/gowitness.git
# already have the repo? check out this version:$ git checkout 3.1.0
└──▷ TRY IT
Filter screenshots to only retain results matching a specific HTTP status or pattern, using the restored screenshot-filter option.
Rewrites the chromedp driver to spawn a single browser instance with multiple tabs instead of a full browser per target, significantly improving throughput at scale.
Adds --skip-network-logs flag to omit network log recording in writers, reducing output size for large scans.
Adds IPv6 address parsing support in the Nessus file reader.
Adds keyboard shortcuts for next/previous navigation in the gallery view.
Improves performance of perception hash calculations by reducing excessive memory allocations.
+1 moreshow less
Surfaces error logs automatically when the --debug flag is enabled.
mxcheck v1.8.0 adds active SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. Smuggling vulnerability detection via new -g flag.
└──▷ GET THIS VERSION
$ git clone --branch v1.8.0 https://github.com/steffenfritz/mxcheck.git
# already have the repo? check out this version:$ git checkout v1.8.0
└──▷ TRY IT
Test a mail server for SMTP Smuggling susceptibility as part of a mail-infrastructure audit.
Codacy Cloud November 2025 adds malicious package detection and False Positive PR comments
Adds Malicious Package Detection to automatically flag packages identified by OSSF in Pull Requests and nightly scans for clients with SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. enabled.
Adds a new workflow where False Positive detection leaves a comment directly on the Pull Request for immediate review.
Mend SCA v25.11.1 adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. import UX improvements, dependency path visibility, SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. ID display, CSV export for logs, and log download limits.
SBOM import experience now features a step-by-step process with status indicators and actionable guidance for validation or structure issues
Added a new field to the license side panel displaying the SPDX identifier for each license
Enhanced project view displays each direct library occurrence with its specific dependency path
Users receive clear notifications when actions affect all occurrences in the project view
Added export to CSV option to SBOM import logs
+2 moreshow less
Added refresh options to SBOM import logs
Added 5 MB log view limit with download options for larger logs
7 details in Everything
4 more releases in this issue
· 2025-11-02 → 2025-11-30
Mend SCA 25.11.1 adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. import log viewing limits with download, SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. ID display in license side panel, and direct dependency path visualization.
Adds a 5 MB log view limit for SBOM imports with download options for larger logs
Displays the SPDX identifier for each license in the license side panel
Enhances project view to display specific dependency paths for each direct library occurrence
Adds export to CSV and refresh options to SBOM import logs
Mend SCA adds Shai-Hulud zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. detection via dedicated workflow event condition.
└──▷ HOW TO FIND IT
Automate detection and response for libraries impacted by the Shai-Hulud zero-day via Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform workflows.
📍In Mend AppSec Platform workflows, configure an automation rule triggered by the new Shai-Hulud event condition.
Snyk adds general availability support for scanning .NET 10 Open Source projects via CLI and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations.
Adds .NET 10 support for Open Source vulnerability scanning across Snyk CLI and source code management (SCM) integrations
Enables automatic detection of .NET 10 frameworks without manual configuration when scanning projects
Snyk CLI v1.1301.0 adds Ubuntu Chisel and zstd layer support in container scanning, Maven 4 support, and --include-provenance for SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
--include-system-jars flag allows Snyk Container to scan usr/lib JAR files during container analysis
Container scanning now supports Ubuntu Chisel images and zstd-compressed layers
Adds initial Maven 4 support to Snyk Open Source test, monitor, and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. commands.
--include-provenance flag adds verification checksums to Maven project SBOMs (experimental)
Reachability analysis for Snyk CLI and CI/CD integrations enters Early Access for all Open Source customers
Snyk adds general availability support for scanning Maven 4 RC4 projects via CLI and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations
Adds Maven 4 RC4 project detection to the Snyk CLI for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scanning
Enables automated vulnerability testing of Maven 4 RC4 repositories in SCM integrations
Exploit Maturity (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v4.0) values now visible in Reporting columns/filters and Project page Issues Card
Adds Exploit Maturity (CVSS v4.0) column to the Reporting experience
Adds Exploit Maturity (CVSS v4.0) filter option in the Reporting experience
Adds Exploit Maturity (CVSS v4.0) filter option on the Project page Issues Card
Mend SAST is a static application security testing service that scans source code for vulnerabilities and helps teams prioritize remediation.
Mend SAST 25.10.3 adds IDE extension, Wiz integration, and improved Rust detection
Mend.io code extension provides security findings and remediation suggestions directly in the IDE
SAST findings can now be uploaded into Wiz to correlate static vulnerabilities with runtime context
Detection accuracy for Rust projects improved, specifically addressing CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-614, CWE-943, and CWE-1004
SAST secret scanning now includes .xcconfig files by default for hardcoded API key detection
Gradle wrapper distribution files automatically excluded from scans to reduce false positives
5 details in Everything
3 more releases in this issue
· 2025-11-03 → 2025-11-17
Mend SAST v25.10.3 adds Mend io Code IDE extension, Wiz integration, and .xcconfig secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it..
Mend io Code extension provides real-time security findings and remediation suggestions directly in the IDE before code is committed
SAST findings can now be uploaded to Wiz for correlation with runtime cloud context
Secret scanning now includes .xcconfig files by default, detecting hardcoded API keys and sensitive data
Detection accuracy improved for Rust projects covering CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-614, CWE-943, and CWE-1004
C/C++ (Gen 2) macro expansion handling updated to ensure accurate method names and data flow traces
+1 moreshow less
Gradle wrapper distribution files are now automatically excluded from scans by default
Mend SAST v25.10.2 adds PySpark support and new CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes. for Rust and C/C++ engines
Adds PySpark framework detection to the Python scan engine
Mend SAST v25.10.2 adds new CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. coverage for Rust and C/C++, and PySpark support for Python detection.
Adds CWE-79, CWE-327, CWE-328, CWE-614, CWE-798, CWE-942, CWE-943, and CWE-1004 to the Rust detection engine
Adds CWE-606 to the Gen 2 C/C++ detection engine
Adds support for the PySpark framework to the Python detection engine
Skylos v0.1.1 adds an Output panel for findings by severity and clickable status bar integration.
└──▷ GET THIS VERSION
$ git clone --branch v0.1.1-skylos-vsce https://github.com/duriantaco/skylos.git
# already have the repo? check out this version:$ git checkout v0.1.1-skylos-vsce
Adds an Output panel in the IDE that groups all scan findings by category and severity.
Adds a clickable status bar item showing immediate scan results without opening the full view.
Adds critical detection rules for SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly., Path Traversal, Cmd Injection with VSC extension UI updates
└──▷ GET THIS VERSION
$ git clone --branch v2.4.0 https://github.com/duriantaco/skylos.git
# already have the repo? check out this version:$ git checkout v2.4.0
Adds SKY-D216 rule to detect SSRF via tainted URLs into HTTP clients
Adds SKY-D215 rule to detect path traversal via tainted file paths in open or os.* calls
Adds SKY-D212 rule to detect command injectioncommand injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. via tainted commands in os.system or subprocess calls
Adds OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. logo to docs footer and token limits for new AI models; expands ASP.NET MVC analyzer for attribute routing
└──▷ GET THIS VERSION
$ git clone --branch v0.25.1 https://github.com/owasp-noir/noir.git
# already have the repo? check out this version:$ git checkout v0.25.1
Expand ASP.NET MVC analyzer to support attribute routing and parameter binding
1 detail in Everything
1 more release in this issue
· 2025-11-08 → 2025-11-16
Adds SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output, Postman Collection JSON, expanded parameter types for more frameworks, and multiple -b flags.
└──▷ GET THIS VERSION
$ git clone --branch v0.25.0 https://github.com/owasp-noir/noir.git
# already have the repo? check out this version:$ git checkout v0.25.0
└──▷ TRY IT
Export results to SARIF for integration with code scanning platforms like GitHub or GitLab.
$ noir scan --sarif ./my-app
Analyze changes relative to two different base commits in one pass.
$ noir scan -b main -b develop-branch ./my-app
--sarif flag added to export findings in SARIF format
--postman flag added to export API specs as a Postman Collection JSON file
-b / --base flag now accepts multiple values for tracking changes across several base commits
StackHawk adds automated testing for five OWASP LLM Top 10OWASP LLM Top 10A ranked list of the ten most critical security risks specific to large language model applications, maintained by OWASP, giving cyber tool developers a shared taxonomy for prioritizing LLM attack surfaces. risks (Prompt Injection, Output Handling, etc.)
Terraform 1.14 adds terraform query for live infrastructure querying, top-level Actions blocks, and a new GenerateResourceConfiguration RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. for providers.
└──▷ GET THIS VERSION
$ git clone --branch v1.14.0 https://github.com/hashicorp/terraform.git
# already have the repo? check out this version:$ git checkout v1.14.0
└──▷ TRY IT
Validate query files offline in CI before running against real infrastructure.
$ terraform validate -query
New list resource type defined in *.tfquery.hcl files enables querying and filtering existing infrastructure.
New terraform query command executes list operations against live infrastructure and can optionally generate import configuration.
New top-level action block lets providers define imperative, non-CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. operations (e.g. aws_lambda_invoke) triggered via resource lifecycle or the -invoke CLI flag.
New GenerateResourceConfiguration RPC allows providers to produce more precise configuration values during import.
Offline validation of query files now supported via -query flag in terraform validate.
+4 moreshow less
terraform test verbose mode now includes expected diagnostics in test output.
terraform test cleanup now ignores the prevent_destroy attribute, unblocking teardown.
terraform stacks command now supports the -help flag.
Adds support for the AWS European Sovereign Cloud.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!Building Terraform 1.14 requires macOS Monterey or later (Go 1.25 requirement); earlier macOS versions are no longer supported for building.
!Parallelism of Terraform operations within container runtimes may be reduced depending on the CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. bandwidth limit setting.
GitLab 18.6 adds exact code search (Zoekt), dynamic needs:matrix expressions, GitLab MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server beta, and warn mode for approval policies.
Adds exact code search capability built on the open-source Zoekt engine, supporting exact match and regular expression modes across instances, groups, or projects
Introduces the $[[matrix.VARIABLE]] expression in Beta to create dynamic dependencies within needs:[parallel:matrix] configurations
Makes the GitLab Security Analyst Agent available by default as a foundational agent in GitLab Duo Agentic Chat
Adds the ability to select AI models (Claude, GPT, etc.) from a dropdown in the GitLab Duo Chat panel for VS Code and JetBrains IDEs
Unveils spec:component keyword allowing CI/CD components to reference their own metadata like version numbers or commit SHAs
+6 moreshow less
Brings the GitLab MCP server into Beta, enabling AI assistants to interact with projects, issues, MRs, and pipelines via MCP protocol
Adds a warn enforcement option in merge request approval policies (Beta) to generate bot comments without blocking merges
Introduces system and system_action fields in webhook payloads for merge requests to distinguish system-initiated approval resets from manual actions
Adds re_requested attribute in reviewer data within MR webhook payloads to identify which specific reviewer was re-requested
Eliminates the 1,000 chart limit in the Helm chart registry by pre-computing metadata responses stored in object storage
Allows Code Owners configurations to recognize groups with inherited access from parent group membership as valid approvers
Openlayer Governance introduces policy enforcement, new data sources, and CLI/API capabilities for custom metrics.
Introduces Governance mode to define and enforce policies across projects in a workspace
Adds a new workspace overview and project inventory for tracking activity
Supports Databricks, Redshift, and Postgres as 3rd-party data backends in Monitoring mode
Enables A/B testing across two commits in Development mode or data sources in Monitoring mode
Allows configuring directory sync in workspaces with SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider./SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. enabled via the UI
+6 moreshow less
Adds DELETE capability for custom metrics via the API
Adds Python SDK support for tracing OpenAI systems using .parse() method or Responses API
Adds Python SDK support for tracing systems built with Google ADKADKGoogle's Agent Development Kit, an open-source framework for building and orchestrating AI agents; cyber tools use it to compose multi-agent workflows with built-in tool-calling and state management.
Allows configuring trace settings like timeouts and retries in Python SDK
Enables creating data sources directly from the CLI
Enables deleting custom metrics directly from the CLI
Socket API v0 gains full CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. endpoints for programmatic webhook management
Adds create, get, list, update, and delete API endpoints for managing webhooks in Socket API v0
Socket adds full SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation from vlt lockfiles (vlt-lock.json) with workspace, git, and file dependency support.
Adds vlt arborist integration for accurate dependency resolution from vlt-lock.json
Enables full SBOM output pipeline for vlt projects including workspaces, git dependencies, and file dependencies
Socket Python SDK gains allow_unverified parameter in constructor to skip SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. verification
Adds allow_unverified optional parameter to the socketdev constructor to disable SSL certificate verification
Socket CLI adds --reach-concurrency and --reach-additional-params flags and fixes SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. verification.
Added --reach-concurrency flag to control parallel execution in reachability analysis (minimum value: 1)
Added --reach-additional-params flag to pass custom parameters to the coana CLI tool
Socket CLI v1.1.27 enables selective package remediation by adding --exclude and --include arguments to the socket fix command, mirroring functionality available in v2.
Apiiro introduces granular SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. policies allowing specific per-team or per-application settings that override global defaults.
Adds the ability to create Specific SLA policies that automatically override Global SLA policies for a team or application
Enables setting specific SLA policies for each severity level via Granular Control
Allows targeting SLAs to specific assets using an explicit asset list or Application tags
Introduces an SLA Dashboard to track compliance levels by risk severity
Apiiro GA enhanced PR scan UX with collapsible risk views and standardized finding formats
Adds collapsible risk views to pull request scans for a distraction-free review experience
Standardizes risk titles and templates across SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., Secrets, and API findings in PR scans
syft v1.38.0 adds GGUFGGUFThe single-file model format used by llama.cpp and Ollama, holding the weights, usually quantized, together with the tokenizer and settings needed to run the model locally. AI model cataloging, CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. list scanning, Elixir binary detection, PyPI license enrichment, and license file search.
└──▷ GET THIS VERSION
$ git clone --branch v1.38.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.38.0
└──▷ TRY IT
Generate an SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. that includes GGUF AI model files alongside traditional packages in a directory or container.
$ syft scan ./models/llama-3.gguf -o syft-json
Catalogs GGUF model files, enabling SBOM generation for AI/ML models stored in the GGUF format.
Supports scanning a user-supplied list of CPEs, allowing targeted vulnerability surface analysis beyond auto-detected packages.
Detects Elixir binaries installed on the system, expanding language runtime coverage.
Sonatype Nexus Repository 3.86.0 adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., license expiry alerts, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. user REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., and OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Docker scanning support
Adds OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. (OIDC) authentication for Single Sign-On integration with providers like Okta, Keycloak, and Azure AD
Adds License Expiry Notification capability to send email alerts before Pro license expiration
Adds new REST API endpoints for managing SAML-backed user records in Nexus Repository Pro and Cloud
Adds Firewall for Docker Scanning support for OCI-compliant images including multi-architecture manifest lists and uncompressed layers
Adds Alpine-based container variants for Dependency Track.
└──▷ GET THIS VERSION
$ git clone --branch 4.13.6 https://github.com/DependencyTrack/dependency-track.git
# already have the repo? check out this version:$ git checkout 4.13.6
lavamoat-tofu 8.1.0 adds deep ES module dependency analysis and informative policy-merge error messages.
└──▷ GET THIS VERSION
$ git clone --branch lavamoat-tofu-v8.1.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout lavamoat-tofu-v8.1.0
Enables deep dependency analysis of ES modules, allowing tofu to traverse transitive ES module imports when generating policies.
Adds informative errors when a policy merge produces invalid entries, surfacing actionable diagnostics instead of silent failures.
$ git clone --branch lavamoat-core-v17.1.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout lavamoat-core-v17.1.0
Fastly adds DDoSDDoSDistributed Denial of Service: an attack that floods a target system with traffic from many sources simultaneously, exhausting its resources so legitimate requests cannot be served. Protection Event Detection Stats via the DDoS Protection Events API
Retrieves detected and allowed request counts for a DDoS Event from the DDoS Protection Events API
Adds Header Links API to Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. for correlating security events via header-based clickable links in the UI.
Adds Header Links API endpoint to create clickable links in the Next-Gen WAF interface based on request or response header values, enabling correlation with external logging platforms like Kibana, Splunk, or custom logging systems.
Fastly extends its analytics capabilities by exposing new DNS response metrics through both historical and real-time APIs, enabling users to track billable vs non-billable traffic volumes directly.
New metrics for DNS responses available in existing APIs.
New mode parameter for DDoSDDoSDistributed Denial of Service: an attack that floods a target system with traffic from many sources simultaneously, exhausting its resources so legitimate requests cannot be served. Protection enablement via the product enablement API
Fastly IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Roles API now includes display_name attribute in role responses.
Adds traffic_ramp parameter to Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. enablement API for gradual traffic inspection.
BunkerWeb v1.6.6 adds mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. plugin, DuckDNS/PowerDNS Let's Encrypt providers, country-based antibot controls, and a new API service template.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.6 https://github.com/bunkerity/bunkerweb.git
# already have the repo? check out this version:$ git checkout v1.6.6
└──▷ USE IT
Restrict antibot challenges to visitors from specific high-risk countries while letting known-safe countries through without a challenge.
yaml
ANTIBOT_ONLY_COUNTRY=CN RU
ANTIBOT_IGNORE_COUNTRY=US GB DE
Harden Auth Basic by increasing bcryptbcryptA deliberately slow password-hashing function, so a stolen password database takes far longer to crack by guessing. Argon2 and scrypt are newer alternatives built on the same idea. rounds beyond the default for sensitive admin endpoints.
yaml
USE_AUTH_BASIC=yes
AUTH_BASIC_ROUNDS=800000
New mtls plugin adds mutual TLS client certificate authentication with configurable verification modes, chain depth control, and optional header forwarding for downstream authorization.
Adds ANTIBOT_IGNORE_COUNTRY and ANTIBOT_ONLY_COUNTRY settings to the Antibot plugin for country-based challenge bypassing or enforcement.
Adds AUTH_BASIC_ROUNDS setting to the authbasic plugin to tune bcrypt password hashing strength (default: 656000, range: 1000–999999999).
Switches Auth Basic password hashing to bcrypt for improved security.
Adds a new API template to quickly protect an API service using BunkerWeb.
+17 moreshow less
Starts monitoring HTTP 405 and 400 status codes, surfacing them on the reports page.
IP whitelisting checks added to the badbehavior module to prevent banning whitelisted IPs; whitelisted IPs are served the default page even when the default server is deactivated.
Let's Encrypt mail handling now validates the configured email, warns if missing or invalid, and automatically adds --register-unsafely-without-email to Certbot when no valid email is present.
Adds METRICS_MEMORY_MAX_RETRIES setting to retry metric operations on memory failure.
Enables editing of API settings in the web UI and UI settings via the API.
UI gains a RAW mode for editing and creating templates, with disabled-settings highlighting and Ctrl+S / Command+S save shortcuts.
Reports page export now uses server-side chunked processing for improved performance on large datasets.
Adds DB-IP attribution to the web UI reports page footer.
DataTable state saving is now automatically enabled across the UI.
Autoconf adds event debouncing in Docker, Ingress, and Swarm controllers for improved configuration management.
Kubernetes integration gains an annotation to ignore specific services in Autoconf.
Kubernetes ConfigMaps of type settings can now be applied to services more easily.
Updates MODSECURITY_REQ_BODY_NO_FILES_LIMIT regex to support human-readable size values.
Updates the default Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. header to include private-state-token-issuance and private-state-token-redemption.
Linux Easy Install script enhanced with manager and worker mode configurations.
Adds RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9.7 and RHEL 10.1 package support.
Per-plugin commit option added to the plugin update process with improved error handling.
22 details in Everything
0 more releases in this issue1 more release in this issue · 2025-11-05 → 2025-11-24
BunkerWeb 1.6.6-rc2 adds mtls plugin, DuckDNS provider, API template, and ANTIBOT country filters
└──▷ GET THIS VERSION
$ git clone --branch 1.6.6-rc2 https://github.com/bunkerity/bunkerweb.git
# already have the repo? check out this version:$ git checkout 1.6.6-rc2
AUTH_BASIC_ROUNDS config key added to the authbasic plugin to set password hashing strength (default: 656000, range: 1000-999999999)
ANTIBOT_IGNORE_COUNTRY and ANTIBOT_ONLY_COUNTRY settings added to the Antibot plugin for country-based challenge prompting/bypassing
New mtls plugin introduced for mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. client certificate authentication with configurable verification modes and chain depth control
New letsencrypt plugin now supports DuckDNS as a DNS provider
Wallarm adds runtime-only schema tests, OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. API2 checks, UI severity thresholds, and status filtering.
Adds OWASP API2 (Broken Authentication) checks in OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth.-based scans to uncover missing auth enforcement, weak token validation, JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. tampering, and exposed credentials in query strings
Enables running tests without a predefined Test Policy by providing all parameters directly at runtime via CLI
Adds the Generate test run command wizard to prepare Docker commands for test runs
Allows defining success criteria per test run in the UI to specify which severity levels mark a test as failed
Adds status tracking and filtering options for test results
Adds DNS Made Easy as an external CA for ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction.; retries dynamic secret lease revocation on failure.
└──▷ GET THIS VERSION
$ git clone --branch v0.154.2 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.154.2
feat(dynamic-secrets): Add retry logic for lease revocation when failing
Add support for DNS Made Easy as an external CA in ACME workflows
2 details in Everything
5 more releases in this issue
· 2025-11-04 → 2025-11-27
Adds PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. sync for AWS Secrets Manager and Chef, GET auth token endpoint, self-signed certs, and --domain flag.
└──▷ GET THIS VERSION
$ git clone --branch v0.154.1 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.154.1
└──▷ TRY IT
Retrieve a specific authentication token using its ID for automated workflows.
$ curl -X GET https://<infisical-host>/api/v1/auth-tokens/<token-id> \
-H 'Authorization: Bearer <admin-token>'
Access secrets for a specific domain through the PAM module during shell execution.
$ infisical login --domain example.com
pam: server-side filter, search, pagination enables filtering and paginating PAM accounts in the UI
Add AWS secret manager PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. Sync to sync secrets from AWS Secrets Manager via PKI
Add Chef PKI sync for Chef Infra Server secret synchronization
[ENG-4142] feat: adds GET endpoint for single auth token by ID exposes a new API endpoint to retrieve an auth token by its ID
[ENG-4199] feat: adds group projects table adds a new table view for managing projects within groups in the UI
+2 moreshow less
Add self-sign certs support allows issuing certificates signed by the internal CA without external dependencies
--domain flag to access modal allows specifying the domain when accessing secrets via the PAM module
Adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. gateway support, PKCS12PKCS12A file format standard from RSA Labs, now maintained under IETF, that bundles a private key, certificate, and chain into one encrypted container, letting cyber tools ship or load credentials as a single portable file. export, project identities, systemd gateway deployment, and secret reference shortcuts.
└──▷ GET THIS VERSION
$ git clone --branch v0.154.0 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.154.0
Add feature: ldap gateway support to enable LDAP as a gateway source
Add systemd interactive deployment option for Gateway & Relay services
Introduce secret reference shortcut feature for easier secret injection
Adds ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. enrollment type for PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets., Slack secret sync error notifications, and Azure client secrets certificate auth.
└──▷ GET THIS VERSION
$ git clone --branch v0.153.4 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.153.4
Implement ACME enrollment type for PKI
Add slack secret sync error notification feature
Add certificate auth option for azure-client-secrets in app connections
Adds Terraform EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. support in interactive setup and text filters to audit log
└──▷ GET THIS VERSION
$ git clone --branch v0.153.3 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.153.3
└──▷ HOW TO FIND IT
New users can select the Terraform EC2 template when bootstrapping Infisical via the interactive installer.
📍Run the setup command and select Terraform EC2 when prompted for the infrastructure provider.
New Northflank and Chef data bag app connections with secret sync; PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. subscriber template creation in UI
└──▷ GET THIS VERSION
$ git clone --branch v0.153.2 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.153.2
SPIKE v0.8.0 adds encryption-as-a-service for Pilot, new SDK hard-delete and helper methods, and SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. ID validation on Keeper shard endpoints.
└──▷ GET THIS VERSION
$ git clone --branch v0.8.0 https://github.com/spiffe/spike.git
# already have the repo? check out this version:$ git checkout v0.8.0
└──▷ TRY IT
Enable stack traces on fatal log exits in a development or test environment to debug SPIKE internals without exposing traces in production.
Adds SPIKE_STACK_TRACES_ON_LOG_FATAL=true environment variable to enable stack traces on fatal log exits, which are now suppressed by default to avoid leaking sensitive information in production.
Adds HasValidVersions() and Empty() helper methods to kv.Value in the SDK for checking whether secrets have any non-deleted versions, useful for identifying purgeable secrets.
Adds Destroy() method to kv.KV in the SDK for hard-delete operations that permanently remove secret paths from storage and reclaim memory, unlike soft-delete (Delete()) which is reversible.
Adds 'encryption as a service' support for SPIKE Pilot (streaming mode functional; JSON modeJSON modeForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. has an outstanding issue).
Adds SPIFFE ID validation to SPIKE Keeper shard endpoints: RouteShard now restricts shard retrieval to SPIKE Nexus, and RouteContribute restricts contributions to SPIKE Bootstrap or SPIKE Nexus.
+3 moreshow less
Adds UpdatedAt field to the SDK Policy struct to track when policies were last modified.
Changes Nexus policy operations from create-only to upsert semantics: state.CreatePolicy is now state.UpsertPolicy, updating existing policies by name while preserving their ID and CreatedAt.
Adds ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text.-based tests to Nexus and Keeper enforcing that all route handlers call net.ReadParseAndGuard or a guard function, preventing routes from being added without authorization checks.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!SDK now returns typed sentinel errors instead of generic error values — callers comparing errors with == or type-asserting to error will need to update to the new typed sentinel error types.
!SDK Get methods now return ErrAPINotFound instead of (nil, nil) when resources are not found — callers checking for a nil result to detect missing resources must now check for ErrAPINotFound.
!Nexus LoadSecret now returns ErrEntityNotFound instead of (nil, nil) for missing secrets in the memory backend — callers relying on a nil result to detect absence must check for ErrEntityNotFound.
!Nexus state.CreatePolicy is renamed to state.UpsertPolicy and now updates existing policies instead of failing on duplicates — callers using state.CreatePolicy must update to state.UpsertPolicy.
Gitleaks v8.29.0 adds Amazon Bedrock API key detection, improved Sonar token regex, config min version enforcement, and trace logging for skipped archives.
└──▷ GET THIS VERSION
$ git clone --branch v8.29.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:$ git checkout v8.29.0
Adds detection rule for Amazon Bedrock API keys.
Improves Sonar token detection regex to match tokens with prefixes.
Adds min-version enforcement in config files to require a minimum Gitleaks version.
Adds trace-level logging when archive files are skipped because archive scanning is not enabled.
TruffleHog finds, verifies, and analyzes leaked credentials across Git, chat, wikis, cloud storage, and more
TruffleHog v3.91.1 adds generic JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. detection and verification plus AnalysisInfo enrichment on verified results.
└──▷ GET THIS VERSION
$ git clone --branch v3.91.1 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.91.1
Adds generic JWT detection and verification, enabling TruffleHog to find and validate JSON Web Tokens across scanned sources.
Adds AnalysisInfo metadata to verified results in detectors, surfacing richer context for new analyzers.
Redacts Twilio API Key secrets in output to reduce accidental secret exposure in scan results.
3 details in Everything
2 more releases in this issue
· 2025-11-05 → 2025-11-20
TruffleHog v3.90.13 adds GraphQL-powered GitHub PR/issue scanning and Google Drive on-prem support.
└──▷ GET THIS VERSION
$ git clone --branch v3.90.13 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.90.13
Implements GraphQL requests for scanning GitHub PRs, issues, and comments — enabling more efficient and complete coverage of GitHub source data.
Updates Google Drive integration to support on-premises scanning.
GitGuardian SaaS adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. team provisioning for Okta and Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.
Adds SCIM team provisioning capability for Okta and Microsoft Entra IdPs
Requires teams:write and members:write service account token scopes
2 details in Everything
1 more release in this issue
· 2025-11-07 → 2025-11-17
GitGuardian Self-Hosted 2025.11 updates secret detection, adds PostgreSQL 18 and Redis 8 support, and improves incident navigation.
Adds a new Coveo API Key detector to the secrets detection engine
Improves the Resend secret detector coverage
Adds one new secrets detection checker.
Upgrades an analyzer within the secrets detection engine
Includes a detection engine enhancement in version 2.150.
+6 moreshow less
Adds source links to incident list entries and exposes change_type field in API responses
Shows Dev-in-the-Loop incident IDs and adds dashboard navigation for these incidents
Adds official support for PostgreSQL 18 as a supported database version
Adds official support for Redis 8 as a supported cache version
Enforces terms and conditions acceptance requirement during self-hosted instance setup
Simplifies Helm configuration by having Replicated inherit global image pull secrets, removing the need for separate imagePullSecrets in the replicated section
Adds Fixed (Unconfirmed) vuln status, SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning, Sensorless API discovery, custom cookies via LSR API, and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. debug logs.
Added toggle in Settings to control automatic retest of vulnerabilities after selecting Fixed (Unconfirmed) status
Added SCIM user provisioning support for Invicti Ultimate users
Added ability to filter the user list by user creation method (manually created vs. auto-provisioned)
Caido v0.53.0 adds shared team instances, a Convert drawer, redirect following in Automate, SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. override, and major SDK expansions.
└──▷ GET THIS VERSION
$ git clone --branch v0.53.0 https://github.com/caido/caido.git
# already have the repo? check out this version:$ git checkout v0.53.0
New Shared Instances (Team Plan): multiple users can now connect to the same Caido instance, enabling hand-off and real-time collaboration on assessments.
New Convert Drawer: a bottom drawer provides automatic encoding detection and one-click conversions between Base64, Base64 URL, URL, and HTML encodings.
New right-click menu item to convert POST bodies between JSON and x-www-form-urlencoded formats.
New right-click menu item to save requests directly to a file.
Automate now supports automatic redirect following, enabling smooth automated testing across chained requests.
+8 moreshow less
Match & Replace gains SNI (Server Name Indication) override support.
Backend SDK: sdk.requests.inScope now accepts an option to specify which scopes to match against.
Frontend SDK: adds sdk.log.info|warn|debug|error for plugin logging.
Frontend SDK: adds sdk.commandPalette.pushView to register custom views in the command palette.
Frontend SDK: adds sdk.projects.onCurrentProjectChange to react when a user switches projects.
Frontend SDK: adds sdk.navigation.onPageChange to track in-app navigation events.
Frontend SDK: adds sdk.replay.onCurrentSessionChange to track the currently selected replay session.
Frontend SDK: <a> tags can now open URLs in the user's default browser from plugin UI.
Nuclei v3.5.0 adds VNC auth, SSH keyboard-interactive, JSON/XPath headless extractors, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. encryption checks, and Docker execution support.
└──▷ GET THIS VERSION
$ git clone --branch v3.5.0 https://github.com/projectdiscovery/nuclei.git
# already have the repo? check out this version:$ git checkout v3.5.0
└──▷ TRY IT
Set the nuclei templates directory via environment variable instead of a flag — useful in CI pipelines or containerized environments.
Cortex Analyzers 3.6.2 adds the ClusterHawk analyzer and upgrades elasticsearch-py support to v9.x.
└──▷ GET THIS VERSION
$ git clone --branch 3.6.2 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.6.2
Adds the ClusterHawk analyzer and its accompanying report template.
Supports elasticsearch-py ~= 9.x for analyzers that depend on the Elasticsearch Python client.
Elcomsoft System Recovery 8.36 adds Windows Server 2025 support and BitLockerBitLockerA full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints. key exporting
└──▷ HOW TO FIND IT
Export BitLocker keys from a recovered Windows volume for decryption elsewhere.
📍Select the target drive in the UI and choose Export BitLocker Keys.
Adds Windows Server 2025 ntds.dit database support for digital triage.
Adds BitLocker key exporting capability.
2 details in Everything
1 more release in this issue
· 2025-11-06 → 2025-11-14
osdfir-infrastructure 2.5.5 integrates OpenRelik with GCP disk processing in the OSDFIR Helm chart.
└──▷ GET THIS VERSION
$ git clone --branch osdfir-infrastructure-2.5.5 https://github.com/google/osdfir-infrastructure.git
# already have the repo? check out this version:$ git checkout osdfir-infrastructure-2.5.5
Timesketch Helm chart gains an ingress option for the OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. dashboard.
└──▷ GET THIS VERSION
$ git clone --branch osdfir-infrastructure-2.5.4 https://github.com/google/osdfir-infrastructure.git
# already have the repo? check out this version:$ git checkout osdfir-infrastructure-2.5.4
Dissect 3.21 adds dissect.database API, APFSAPFSApple's proprietary filesystem introduced in 2017, replacing HFS+, designed for SSDs with native encryption, snapshots, and space sharing — giving cyber tools reliable forensic primitives on modern Apple devices. filesystem support, new CLI flags for nested targets and syslog parsing
└──▷ GET THIS VERSION
$ git clone --branch 3.21 https://github.com/fox-it/dissect.git
# already have the repo? check out this version:$ git checkout 3.21
Adds dissect.database project to supersede dissect.esedb and dissect.sql (API only)
Adds initial macOS filesystem support via the new dissect.apfs API
Adds --list-children, --recursive, and --child flags to target-query for nested target exploration
Adds -f search flag to use the new Windows Search Index plugin
Adds -f network.interfaces --syslog to parse syslog entries in addition to network interfaces
+4 moreshow less
Adds CramFS filesystem support
Adds Apple Sparse Image Format (ASIF) support
Adds KAPE files in VHD format support
Adds > output redirection inside target-shell
9 details in Everything
└──▷ BREAKING ON UPGRADE
!The minimum Python version is now 3.10, removing support for older versions
YARA-X v1.10.0 adds yr fix warnings command and improves WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. compilation efficiency.
└──▷ GET THIS VERSION
$ git clone --branch v1.10.0 https://github.com/VirusTotal/yara-x.git
# already have the repo? check out this version:$ git checkout v1.10.0
└──▷ TRY IT
Run YARA-X on a rules file to identify warnings and automatically apply fixes.
$ yr fix warnings path/to/rules.yar
Adds the yr fix warnings subcommand to automatically correct rule warnings
Generates more efficient WASM code for certain expressions, reducing compiled rule size
Improves the ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text. traversal API to support Depth-First Search (DFS) order
3 details in Everything
1 more release in this issue
· 2025-11-03 → 2025-11-20
YARA-X v1.9.0 adds C/Go file-scan functions, Rust version API, and ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. osabi field.
└──▷ GET THIS VERSION
$ git clone --branch v1.9.0 https://github.com/VirusTotal/yara-x.git
# already have the repo? check out this version:$ git checkout v1.9.0
Add function for scanning files by path to the C and Go APIs
capa v9.3.0 adds 24 new detection rules, ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. Linux/macOS binaries, and IDA Pro plugin repository support with PyQt5/PySide6 compatibility.
└──▷ GET THIS VERSION
$ git clone --branch v9.3.0 https://github.com/mandiant/capa.git
# already have the repo? check out this version:$ git checkout v9.3.0
Adds ARM64 release binaries for Linux and macOS, enabling native capa execution on ARM64 platforms.
Publishes capa Explorer IDA Pro plugin to the IDA Pro plugin repository via ida-plugin.json.
Adds Qt compatibility layer to the IDA Pro plugin, supporting both PyQt5 and PySide6.
Adds 24 new detection rules including VM detection via mouse-activity checks, BitDefender hook-patching, DXPack packer detection, PowerShell constrained-language-mode bypass, PowerShell transcription disabling, FTP communication, io_uring I/O interface on Linux, keystroke logging via DirectInput, JScript execution via VSAEngine in .NET, routing table creation/enumeration, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connection enumeration via WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. COM API, and static-library detections for gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication., Eclipse Paho MQTT C, QMQTT, HP-Socket, funchook, and plthook.
Adds nursery rules for F# compiled binaries, AES decryption via .NET, .NET assembly entry-point retrieval, executable heap creation, and load-driver privilege acquisition.
Frida 17.5.0 adds CompilerOptions platform/externals and previews revamped async/await Swift bindings available by building from source.
Adds platform and externals options to CompilerOptions for tailored output via frida-compile or Frida.Compiler.
Revamps experimental Swift bindings around async/await and DeviceListModel for SwiftUI; users must clone and build from main because this release includes no frida-swift prebuilt binaries.
Darwin: AllImageInfos now reports the Dyld Shared Cache UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. and slide.
Adds archive banners with restore buttons and streamlines SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. download API calls.
Adds an archived status banner to project details screens
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!Invalid CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. IDs now return a 404 status code instead of a 200 response
Binary Ninja 5.2 adds WARP plugin/server, Ghidra import, DWARF import, TTD support, bitfields, and new cross-refs UI
Adds the WARP plugin for networked collaboration and automatic downloading of project file dependencies
Adds Ghidra import functionality to load existing Ghidra projects directly into Binary Ninja
Adds DWARF import support to automatically load PDBPDBA debug symbol file format used by Microsoft's toolchain that maps compiled binaries back to source code, function names, and variable types, letting cyber tools resolve symbols during reverse engineering or memory analysis./DWARF info from sibling files in projects
Adds TTD (Time Travel Debugging) support with queries, analysis views, and TTD.Events API access
Adds named Bitfields visualization and editing capability for structure fields
+5 moreshow less
Adds new Containers support for recognizing and visualizing standard library container types
Adds Custom Strings / Constants recognition and handling capabilities
Adds Hexagon architecture lifting and analysis support
Adds new Cross References UIs with enhanced filtering and display options
Adds Objective-C workflow improvements including Rust rewrite for better performance
Adds Frida 17+ support for Runtime Mobile Security
└──▷ GET THIS VERSION
$ git clone --branch 1.5.24 https://github.com/m0bilesecurity/RMS-Runtime-Mobile-Security.git
# already have the repo? check out this version:$ git checkout 1.5.24
Enables runtime analysis compatibility with Frida 17 and later versions.
objection 1.12.0 adds Android keystore inspection, implicit intent analysis, memory replace, iOS/Android pattern hooking, and new bypass support for JailMonkey and RootBeer.
└──▷ GET THIS VERSION
$ git clone --branch 1.12.0 https://github.com/sensepost/objection.git
# already have the repo? check out this version:$ git checkout 1.12.0
└──▷ TRY IT
Patch an APK without re-signing, useful when you manage signing separately in a CI pipeline.
$ objection patchapk -s target.apk --skip-signing
New android keystore listdetails command to inspect Android keystore entries.
Adds JailMonkey jailbreak detection bypass for iOS apps using the JailMonkey library.
Adds RootBeer root detection bypass for Android apps using the RootBeer library.
New iOS pattern hooking support to hook methods by pattern match.
New Android pattern hooking support to hook methods by pattern match.
+8 moreshow less
Adds --uid flag to the objection CLI for targeting processes by UID.
Adds update and remove operations for iOS keychain items.
Adds --watch flag (and related options) to the notify command for continuous monitoring.
New memory replace command to overwrite values in process memory.
Adds detection and analysis of Android implicit intents, with optional backtrace support.
Adds --only-main-classes support for apktool decompilation during APK patching.
Adds option to skip APK signing during the patch workflow.
Cortex Analytics 2025.11.12 adds detection coverage for ClickFix, Teams Graph APIGraph APIMicrosoft's unified REST API for accessing data across Microsoft 365 services — mail, calendar, users, files — letting cyber tools query or monitor cloud environments through a single authenticated endpoint. abuse, and AWS resource modifications
Adds a new Low Analytics BIOC for 'ClickFix - PowerShell executed through the run application'
Adds a new Low Analytics Alert for 'Suspicious activity indicating a potential abuse of a cloud-native email service'
Adds 22 new Informational Analytics BIOCs, including AWS Backup recovery point deletion and AWS S3 object deletion
Adds 4 new Informational Analytics Alerts detecting Microsoft Teams conversations with suspicious operations via external users
Improved logic for High Analytics BIOC 'Suspicious SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. API call from a Tor exit node'
+1 moreshow less
Improved logic for Medium Analytics BIOC Kubernetes vulnerability scanning tool usage
Prisma Cloud Compute Edition 34.03 adds Alma Linux 8/9 CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. improvements, RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 10 support, and CISA secondary score fallback.
Adds full support for RedHat Enterprise Linux 10 as a scanable platform.
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!Defenders from release v30.03 or earlier will disconnect from the Console if not upgraded to v31.xx or later.
Cortex Analytics adds 82 new BIOCs and 7 alerts covering AWS SSMAWS SSMAWS Systems Manager, an Amazon service that lets operators manage EC2 instances and on-premises servers without opening inbound ports, replacing SSH with API-driven session and command execution., Teams Graph APIGraph APIMicrosoft's unified REST API for accessing data across Microsoft 365 services — mail, calendar, users, files — letting cyber tools query or monitor cloud environments through a single authenticated endpoint. abuse, and cloud identity enumeration.
Added new detection for AWS SSM parameters discovery to flag identities enumerating Systems Manager parameters.
Added new detection for AWS SSM parameters retrieval to identify secrets access via Systems Manager.
Added new detection for User installed an application in Microsoft Teams via Graph API.
Added new detection for A cloud identity started a Cloud Shell session.
Added new Informational Analytics Alerts for Microsoft Teams activity including External user created a Microsoft Teams conversation with suspicious operations, User exported multiple messages in Microsoft Teams via Graph API, and User sent messages in Microsoft Teams to multiple conversations via Graph API.
Cortex Analytics adds detections for cloud IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles, AWS Storage Gateway enumeration, DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. hijacking and log enumeration.
Adds new low-severity BIOC: Uncommon attempt to clear shell history
Adds 20 new informational analytics BIOCs including AWS Storage Gateway enumeration and GCP sensitive role grants
Adds new informational analytics alert: Log enumeration via cloud native logging service
Adds detection for Unsigned DLL Hijack into a Microsoft process
Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 3.16 adds ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. Windows agent, Linux forensics, JScript ML protection, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. blocking, customizable analytics severity, Broker VM ENS config, XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. query limits, and
Extends XDR Agent deployment to Windows devices on ARM64 architecture, including Microsoft Surface devices
Adds ML-based detection module for the XDR Agent on Windows to analyze and block malicious JScript files before execution or when written to disk
Adds real-time prevention against malicious LDAP queries (e.g., SharpHound) targeting Windows Domain Controllers for customers with the ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. add-on
Enables complete forensic investigations across Windows, macOS, and Linux with deeper artifact collection from Linux endpoints
Aligns detection rules with organizational risk profile by allowing adjustment of alert severity for built-in analytics rules
+10 moreshow less
Updates Broker VM to comply with Spain’s ENS National Security Framework; requires enabling Only use recommended cipher suites in Advanced Settings via URL
Adds new Replace Storage Method option for Snapshot datasets in the Database Collector applet, overwriting existing data for static/reference data use cases
Introduces expanded XQL query governance: monitor all sources, cancel running queries, set user query limits, and automatic stop after 60 minutes (overridable via max_runtime_minutes command)
Adds new default query retention aligned with issue retention in Query Center
Adds EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. Windows Disguised Processes, EDR Linux Credential Grabbing, EDR macOS Generic Persistence, and Microsoft Teams analytics detection suites
Expands DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. Hijacking Analytics coverage for process hijacking and DLL sideloading
Adds File examination on-load for macOS to detect/prevent malicious Mach-O files during loading
Adds Child Process Protection for Linux (KM mode) examining parent-child process relations
Supports Goggle Kubernetes Engine (GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.) Autopilot for CaaS distribution
Groups all data collector errors into a single non-dismissible notification instead of multiple alerts
15 details in Everything
└──▷ BREAKING ON UPGRADE
!The Simulated Compute Units field has been deprecated in Query Center.
!Due to the deprecation of AutoFocus, the AutoFocus integration option is removed from the Threat Intelligence screen under Settings.
!AutoFocus data will no longer appear in incidents or alerts.
Prisma Access 6.1 introduces customizable response page upload and context passing for blocked content.
Expands response page size limits and adds an intuitive upload interface for custom HTML templates including variables, stylesheets, images, and JavaScript
Adds context passing to response pages so that user identity, URL category, and rule details are passed when users encounter blocked content or need to acknowledge policies
Cortex Cloud Runtime Security 1.3 adds Agentic Assistant, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant./ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. support, new SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. for PHP/Rust, Git hook secrets scanning, new XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. dataset fixes, and broker VM c
Cortex Agentic Assistant allows autonomous agent execution based on playbook history with governed guardrails.
Native MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. (Beta) enables trusted LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. applications to securely connect to Cortex Cloud via natural language prompts.
New support for self-hosted OpenShift clusters in cloud runtime security and Kubernetes posture management.
XQL lookup dataset queries now exclude _time by default unless explicitly added via the fields stage, improving flexibility.
Agentless Disk Scan (ADSADSAlternate Data Streams: an NTFS feature that lets a file carry hidden secondary data blobs under the same path, giving cyber tools a place to stash metadata or detect covert storage by malware.) extends to Windows (NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT.) disk images in OCI before deployment for zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. security.
+61 moreshow less
Agentless Scanning integrates directly with Docker Hub, GitLab Container Registry, Harbor Registry, and Sonatype Nexus Repository Manager.
Registry Scanning for OCI Artifact Registry allows enabling scanning during or post-onboarding of cloud accounts.
New Trusted Images policy wizard defines trust criteria (source, base image, scan status) to alert on or block untrusted images.
Code Scanners now support SCA for PHP (composer.json/composer.lock) and Rust (Cargo.toml/Cargo.lock).
Application Security scanners can be integrated as pre-commit or pre-receive Git hooks for secrets scanning.
Role chaining permissions allow creating policies permitting one role to assume another, enabling lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. analysis.
New Identity Detection rules can be created to customize identity and permissions scenarios.
Azure AI Search support provides visibility into AI datasets, sensitive data identification, and risky misconfiguration detection.
AI-SPMAI-SPMAI Security Posture Management: a discipline for continuously discovering, assessing, and remediating risks across AI pipelines, models, and data, giving cyber tools a structured way to govern AI infrastructure the way CSPM governs cloud. dashboard unifies AI posture and threat detection by integrating AI-DR capabilities.
Full visibility into AI software packages, SDKs, and development dependencies creates an AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (AI BoM).
Databricks integration delivers enhanced visibility into data, configurations, and risks in collaborative analytics environments.
DSPM Fileshare applet on Broker VM supports classification of NFS and SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. file shares for on-premise environments.
New Backup Discovery and Risk Analysis automatically discovers cloud backups, maps them to original assets, and classifies contents.
Scanning settings now allow setting classification cadence for assets according to asset type.
Expanded Asset Group scoping allows defining Asset Groups with the Business Application Names attribute for Scope-Based Access Control (SBAC).
New SBAC support manages access to Cloud Workload Policies, ensuring scoped users only view permitted policies.
Cortex Cloud supports viewing and onboarding unmanaged OCI services in Cloud ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them..
Support for existing AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. and S3 buckets allows onboarding environments without data duplication.
User and role APIs allow managing user roles, updating API keys, and adding/removing role/scope assignments programmatically.
New XQL view-only feature for CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. and CIEM rules simplifies policy management and tracking.
Unified Kubernetes onboarding wizard discovers capabilities based on license and configures the solution in one flow.
Kubernetes support for ARM nodes extends posture management coverage to ARM architecture environments.
Kubernetes proxy support allows installation behind HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. proxy gateways with no or basic authentication.
New filters (Scanners, Last Scan) on Container Images, VM Instances, and VM Images tabs identify scanning gaps.
CWP Collections Groups support streamlines policy definition, asset grouping, and multi-rule selection.
Support for scanning Azure legacy images enhances image scanning coverage compliance.
Supply Chain Catalog provides a centralized registry of recognized supply chain tools with risk factors and PAN Insights.
Automated bulk application creation uses cloud tags to automatically group assets into applications.
Application-based scope enforces granular access control (blacklisting) and policy enforcement by Application Name.
Issue severity SLAs allow defining overdue days and approaching status, with a new sortable/filterable SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. Status column in tables.
Runtime-context policies create rules based on repository context like deployment status, internet exposure, and privileged access.
New Urgency metric prioritizes issues using code-to-cloud data, with side-card sections for urgency details and Code-to-Cloud graph.
File examination on-load detects malicious Mach-O files on macOS endpoints.
ML-based JScript file examination blocks malicious JScript files on Windows via the XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. agent.
Malicious LDAP Query Protection identifies and blocks reconnaissance targeting Windows Domain Controllers (ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. add-on).
Child Process Protection for Linux examines parent-child process relations to detect suspicious activity.
Agent deployments extend to Windows devices running on ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. architecture, including Microsoft Surface devices.
Connecting API Endpoints to ASPMASPMApplication security posture management, combining findings about applications from multiple tools and relating them to business context. It helps teams decide which fixes matter most. shows which applications APIs belong to via agent-deployed mappings.
Sensitive Data Detection identifies PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations./PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. in API traffic using Cortex Cloud DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. scanning engine profiles and patterns.
Enhanced API Endpoint Relations in Search Graph visualize connections between endpoints, servers, and gateways.
Improved Issue Investigation Experience provides pre-built XQL queries and filters for rapid root cause analysis.
In-product support case creation records screen, logs, and tenant details automatically.
Expanded cloud security playbooks provide automated multi-step responses with human approval options.
New one-click automations resolve risks like publicly accessible S3 buckets across AWS, GCP, and Azure.
Recommended Quick Actions provide contextual automation recommendations in issue response workflows.
Auto-populate command and Quick Action parameters use Unified Asset Inventory (UAI) attributes dynamically.
Automation Exclusion Center enhancements allow asset group references, dynamic matching operators, and policy overrides.
Dismiss alerts for non-configured playbook components reduces visual noise in system and custom playbooks.
Streamlined playbook development uses drag-and-drop functionality to build automation flows.
Choose integration instance for Quick Actions enables selecting specific instances for on-demand or automated rules.
Enhanced automation commands/Quick Actions available for AWS, GCP, and Azure integrations.
New compliance standards: CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Amazon Linux 2 STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against., CIS Microsoft Windows 11 Enterprise, CIS Windows Server 2016.
Updated compliance standards: CIS AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. Benchmark, CIS EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. Benchmark, CIS GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. Benchmark.
Immediate initial view of compliance results displays posture via default policy without configuration.
New policy generates issues for all workload security rules with Critical & High severity automatically.
Enhanced error visibility/auditing for Broker VM applets (FTP, Netflow, Network Mapper, Kafka) in collection_auditing dataset.
Broker VM updated for Spain's Esquema Nacional de Seguridad (ENS) requiring Only use recommended cipher suites setting.
Database Collector applet introduces new Storage Method options: Append or Replace for Snapshot datasets.
Unified integration error notifications group all data collector errors into a single non-dismissible notification.
Cortex CLI CA configuration now uses global --ca-cert flag and CORTEX_CA_CERTIFICATE environment variable.
Cortex CLI supports skipping SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. validation with --no-cert-verify flag or $CORTEX_NO_CERT_VERIFY environment variable.
66 details in Everything
└──▷ BREAKING ON UPGRADE
!The AutoFocus integration option has been removed from the Threat Intelligence screen under Settings due to deprecation.
!AutoFocus data will no longer appear in cases or issues due to AutoFocus deprecation.
!Support for old Azure DevOps authorization methods is deprecated; you must re-authorize using Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. or a personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) or applications will no longer function.
!The Cortex CLI CA configuration path code.ca-cert is removed and broken; CA definitions must now be placed at the root level as ca-cert, causing Application Security scans to fail if not updated.
Cortex Cloud Posture Management November 2025 introduces AI-SPMAI-SPMAI Security Posture Management: a discipline for continuously discovering, assessing, and remediating risks across AI pipelines, models, and data, giving cyber tools a structured way to govern AI infrastructure the way CSPM governs cloud., MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. fixes, CA config migration, PHP/Rust SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., and more.
Adds Cortex Agentic Assistant with native MCP support for connecting LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. applications to Cortex Cloud in beta.
Adds Unified AI Security Posture Management (AI-SPM) including an AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (AI BoM) and a central dashboard.
Adds Backup Security Posture Management (BSPM) to discover and analyze backups for sensitive data and risks.
Adds new Databricks integration for enhanced visibility into configurations and data flows.
Adds Google Workspace IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. integration for user, group, and organizational unit visibility.
+21 moreshow less
Enables onboarding of existing AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. and S3 buckets to avoid data duplication.
Adds Cortex Vulnerability Block Grace Period with configurable per-severity grace periods for prevention policies.
Introduces Cortex Vulnerability Risk Score (CVRS) for dynamic vulnerability prioritization.
Enables one-click automations to resolve critical risks like publicly accessible S3 buckets across AWS, GCP, and Azure.
Adds User and role APIs for managing user roles, API keys, and scope assignments.
Adds support for scanning Windows VM disk images (NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT.) in OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. using agentless scanning.
Adds Agentless Scanning for Container Registries including Docker Hub, GitLab, Harbor, and Sonatype Nexus.
Enables Registry Scanning for OCI Artifact Registry during or after cloud account onboarding.
Adds Trusted Images policy wizard to define trust criteria for container images.
Adds Support of self-managed OpenShift in Kubernetes Security Posture Management.
Adds Unified Kubernetes onboarding wizard and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. node support.
Adds automated bulk application creation using cloud tags with a dedicated Criteria page.
Introduces Issue severity SLAs with an Approaching status and sortable SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. Status column.
Enables Runtime-context policies based on deployment, exposure, and privilege capabilities.
Introduces the Urgency metric for prioritizing SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., SCA, Secrets, and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. issues with a Code-to-Cloud graph.
Adds SCA support for PHP and Rust languages detecting dependencies via composer.json/Cargo.toml.
Enables integration of Secrets scans into Git Pre-Commit and Pre-Receive hooks.
Adds new compliance standards: CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Amazon Linux 2 STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against., CIS Microsoft Windows 11 Enterprise, and CIS Windows Server 2016.
Updates Cortex CLI to use a global CA configuration via --ca-cert flag or $CORTEX_CA_CERTIFICATE env var.
Adds --no-cert-verify flag and $CORTEX_NO_CERT_VERIFY environment variable to skip SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. validation in CLI.
Allows creation of custom identity detection rules for identity and permissions scenarios.
26 details in Everything
└──▷ BREAKING ON UPGRADE
!Azure DevOps authorization: Must re-authorize Cortex Cloud applications or onboard new ones using Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. or a personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.).
!Cortex CLI CA configuration: The previous configuration path code.ca-cert is removed and CA definitions must now be placed at the root level.
Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. November 2025 adds Cortex MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. Beta, Windows ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. Agent, ML JScript Detection, Linux Forensics, and more.
Adds Cortex MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server (Beta) enabling LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. integration via the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.
Adds XDR Agent support for Windows on ARM64 architecture
Introduces ML-Based JScript File Examination to detect malicious scripts before execution
Enables Malicious LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. Query Protection with ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. add-on for real-time prevention against BloodHound-style attacks
Extends Forensic investigation capabilities to Linux endpoints with deeper artifact collection
+20 moreshow less
Adds Cortex Agentic Assistant (AgentiX AI Agent Workforce) for autonomous security response
Expands Asset Group scoping in SBAC to include Business Application Names attributes
Provides new User and role APIs for managing user roles, API keys, and scope assignments
Enables installing content packs directly from Marketplace via Automation workflows
Allows dismissing alerts for non-configured playbook components (sub-playbooks, scripts, commands)
Adds drag-and-drop functionality to streamline playbook development in the UI
Introduces AI Script Generator with built-in testing panel for Python script creation
Enables choosing a specific integration instance for Quick Actions
Enhances Automation Exclusion Center with asset group reference, role-based list permissions, and condition-based policies using dynamic matching operators
Adds enhanced error visibility and auditing for Broker VM applets (FTP, Netflow, Network Mapper, Kafka collectors) logged in collection_auditing dataset
Adds Broker VM support for Spain's ENS National Security Framework via Only use recommended cipher suites setting
Introduces new Storage Method options (Append and Replace) for Database Collector applets
Enhances XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. query monitoring with real-time tracking, cancel capability, and a new default 60-minute runtime limit overridable by max_runtime_minutes command
Improves Lookup dataset handling so _time is not included by default in target stage unless explicitly added via fields stage
Adds four new Analytics tags/suites: EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. Windows Disguised Processes, EDR Linux Credential Grabbing, EDR macOS Generic Persistence, and Microsoft Teams Analytics
Improves DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. Hijacking Analytics coverage for process hijacking and sideloading
Launches New Advanced Email Security response engine for automated policy-driven remediation
Enables File examination on-load for Mach-O files on macOS endpoints
Adds Child Process Protection for Linux (KM mode) to examine parent-child process relations
Supports CaaS distribution to Google Kubernetes Engine (GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.) Autopilot
25 details in Everything
└──▷ BREAKING ON UPGRADE
!The AutoFocus integration option has been removed from the Threat Intelligence screen under Settings
!Autofocus data will no longer appear in cases or issues
!The Simulated Compute Units field has been deprecated in Query Center
Cortex Xpanse Expander 2.11 adds attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. testing intrusiveness levels, AI infrastructure detections, and bulk IP paste.
Adds configurable Attack Surface Testing Intrusiveness Levels to control the intensity of exposure checks
Introduces new detections for AI Infrastructure items including MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Servers and MCP Inspector in the Unified Inventory
Enables filtering Services by software name and version with Service Version Enumeration
Adds misconfiguration and enumeration alerts to the Threat Response Center for prioritized response
Adds bulk actions for managing alerts and assets more efficiently in the UI
+1 moreshow less
Supports pasting large IP address lists into Alerts, Unified Inventory, Services, Domains, Certificates, and Owned IPv4/Responsive IP views
Cortex XSIAM Nov 2025 adds AgentiX AI agents, Federated Search in XDL via XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform., new SBAC for dataset rows, User/Role APIs, and Linux forensics.
Adds Cortex Agentic Assistant (native MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support in Beta) allowing trusted LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. apps to connect to XSIAM using natural language prompts
Adds Federated Search in Cortex Extended Data Lake (XDL) enabling seamless querying across external datasets in AWS, GCP, or Azure via XQL without ingestion
Adds Forensics for Linux support for complete investigations with deeper artifact collection from Linux endpoints
Allows adjusting the severity of alerts generated by built-in analytics rules through Flexible Customization for Analytics Rules
Enhances SBAC to define Asset Groups using the Business Application Names attribute for scoping definitions
+36 moreshow less
Adds new SBAC support for dataset rows, granting SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. teams access only to relevant row data in XQL queries and custom widgets
Exposes User and role APIs to manage user roles, update API keys, and add or remove role/scope assignments programmatically
Adds Attack Surface Testing Intrusiveness Levels to adjust the intensity of exposure checks
Adds Alerts for Attack Surface Testing misconfiguration findings to identify risks from confirmed positive misconfigurations
Adds a new Attack Surface Management dashboard providing a visual overview of the attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources.
Improves Global Lookup by allowing queries for certificate hashes (MD5, SHA1, SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data.) in addition to IPs and domains
Enables auto-populating command and Quick Action parameters from any Unified Asset Inventory (UAI) attribute on demand
Allows dismissing alerts for non-configured playbook components (sub-playbooks, scripts, commands) without editing system playbooks
Enables drag-and-drop functionality for building and organizing automation flows in playbooks
Adds AI Script Generator with a built-in testing panel to validate Python code generated from natural language
Allows choosing an integration instance for Quick Actions when running them on demand or via automation rules
Adds Automation health issues to quickly identify and resolve potential automation configuration problems
Enhances Automation Exclusion Center with support for asset groups, dynamic matching operators, and role-based permissions for policy management
Enhances Broker VM with error visibility/logging in the collection_auditing dataset for FTP, Netflow, Network Mapper, and Kafka collectors
Adds a new Only use recommended cipher suites setting in Broker VM Advanced Settings to comply with Spain’s ENS
Adds a Replace Storage Method option for Database Collector Snapshot datasets to overwrite existing data
Sets a new default query limit of 60 minutes in XQL, overridable using the max_runtime_minutes command
Fixes lookup dataset queries so the _time field is not included by default unless explicitly added via the fields stage
Adds EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. Windows Disguised Processes analytics suite to detect process masquerading
Adds EDR Linux Credential Grabbing analytics suite to identify uncommon access to sensitive credential files
Adds EDR macOS Generic Persistence analytics suite to detect unusual persistence mechanisms on macOS
Adds Microsoft Teams Analytics suite to detect attack attempts within Microsoft Teams using dynamic baselines
Expands DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. Hijacking Analytics coverage to include Microsoft process hijacking and DLL sideloading detection logic
Adds New Advanced Email Security response engine for automated, policy-driven remediation of email threats
Adds File examination on-load for macOS to detect/prevent malicious Mach-O file execution
Adds JScript file examination for Windows to detect/prevent malicious JScript file execution/disk writes
Adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. Query Protection for Windows using XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. agent for real-time prevention against domain controller reconnaissance
Adds Child Process Protection module for Linux to examine parent/child process relations
Adds support for Cortex XDR Agent on Windows ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. devices including Microsoft Surface
Adds Cortex XDR Security Controls Detection to gain visibility into XDR agent profile configurations and exploit protection status
Enhances Cortex Network Scanner with Multi-scanner support, Target Groups management, Multiple credentials configuration, and Credential testing
Unifies integration error notifications for External Data Ingestion into a single non-dismissible alert
Adds Cortex Vulnerability Block Grace Period to temporarily override blocking actions for new vulnerabilities based on fixed dates or severity
Introduces Cortex Vulnerability Risk Score (CVRS) as a dynamic risk-scoring approach for prioritizing vulnerabilities
Enhances Vulnerability Management UI with side-panel insights, right-click quick actions, CSV export, and node-specific vulnerability tabs
41 details in Everything
└──▷ BREAKING ON UPGRADE
!The Sample Analysis page under Threat Management > Threat Intelligence has been removed.
!The Sessions & Submissions page under Threat Management > Threat Intelligence has been removed.
!The Unit 42 Intel tab within the indicator details page has been removed and legacy Unit 42 library search is deprecated.
!The AutoFocus integration option has been removed from the Threat Intelligence screen under Settings due to deprecation.
!AutoFocus data will no longer appear in cases or issues.
!The Simulated Compute Units field has been deprecated in Query Center.
Prisma Access adds ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. app definitions using FQDN wildcards/IP subnets and new diagnostics (packet capturespacket capturesA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic., dump overview)
Adds support for defining Prisma Access ZTNA applications using FQDN wildcards and IP subnets.
Adds dump overview, packet captures, and tech support diagnostic tools to the ZTNA Connector.
Enables application probes for FQDNs resolving to multiple private IPs to load balance across resolved addresses.
Prisma Access 6.1 adds CloudHSM support to store SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. decryption CA private keys externally.
Adds audio passthrough for RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. sessions in Prisma Access Privileged Remote Access profiles.
Enables audio passthrough in a Privileged Remote Access (PRA) profile to allow audio from the remote RDP server to be heard on the user's device
Prisma Access 6.1 adds SP Interconnect option for Remote Networks to enable native IP connectivity without IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. tunnels
Prisma Access 6.1 adds SASESASEA network architecture model combining wide-area networking and network security functions into a single cloud-delivered service, letting cyber tools enforce consistent policy regardless of where users or workloads sit. Private Location for deploying services within customer infrastructure
Adds SASE Private Location deployment model to run Prisma Access gateways locally behind load balancers while keeping the GlobalProtect portal in the cloud.
Enables agent-based Mobile Users deployment within a private data center environment for compliant processing of network traffic and security functions.
Prisma Cloud adds RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 10 support and improves Alma Linux CVE integration.
Adds full support for RedHat Enterprise Linux 10 in Secure the Runtime.
Uses CISA-ADP secondary scores as fallback when NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. primary scores are unavailable.
AP6 access points add per-SSID MAC filtering and WPA2/3 Enterprise support in v1.8.2731MR8
└──▷ HOW TO FIND IT
Restrict access to a specific wireless network by allowing only known device MAC addressesMAC addressesA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet..
📍Configure per-SSID MAC filtering with up to 4096 entries in Sophos Central or local AP UI.
Enable enterprise-grade authentication for a wireless network during SSID setup.
📍Select WPA2/3 Enterprise from the encryption mode dropdown when configuring an SSID.
Adds per-SSID MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. filtering with up to 4096 entries for AP6 access points.
Adds WPA2/3 Enterprise as an available encryption mode when configuring SSIDs.
Sophos DNS Protection EAP adds Sophos Endpoint integration with automatic HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. redirection and new user/device query reports
└──▷ HOW TO FIND IT
Enroll in the early access program to gain automatic DNS security via Sophos Endpoint integration.
📍Join the Workspace Protection and New Endpoint Protection Features early access programs
Adds Sophos Endpoint integration that automatically redirects DNS traffic over HTTPS to block malicious domains and enforce web access policies without manual configuration
Wireshark 0.22.2 adds OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. dissector, new RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. channels (ECAM/DR), and support for Ixia/CAM Inspector file formats.
└──▷ GET THIS VERSION
$ git clone --branch 0.22.2 https://github.com/wireshark/wireshark.git
# already have the repo? check out this version:$ git checkout 0.22.2
Adds otp dissector to parse One-Time Password protocol traffic
Adds initial implementation of the MS-RDPECAM RDP channel (rdp_ecam) with reassembly logic
Adds parsing for rdp_dr smartcard and printers commands along with capability packets
Adds support for reading Ixia VeriWave capture files in wiretap
Adds support for reading CAM Inspector capture files in wiretap
5 details in Everything
3 more releases in this issue
· 2025-11-02 → 2025-11-24
Wireshark adds ORAN FH CUS ST9 field, DNS over DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. disable for QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. conflict, and BT L2CAP FCS check.
ORAN FH CUS: SE 24 reserved bit is now posMeas
ORAN FH CUS: SINR - create subtree for each PRB
DNS: disable experimental DNS over DTLS conflicting with DNS over QUIC
USB-HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral.: Add support for GET_DESCRIPTOR in bRequest field
nfdump v1.7.7 adds YAF file reader, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. Flags aggregation, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. reassembly, SPCDNS decoder, and HexDump output improvements
└──▷ GET THIS VERSION
$ git clone --branch v1.7.7 https://github.com/phaag/nfdump.git
# already have the repo? check out this version:$ git checkout v1.7.7
Implements yaf file reader
Add TCP Flags aggregation option
Evaluate IPv6 fragmentation header and reassemble IPv6 packets
Replace dns packet decoder with more complete SPCDNS decoder
Malcolm v25.11.0 overhauls install.py with a menu-based UI, adds a Connections Tree lateral-movement visualization, and bundles the OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. repository-s3 plugin.
└──▷ GET THIS VERSION
$ git clone --branch v25.11.0 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v25.11.0
└──▷ TRY IT
Fall back to the legacy wizard-style configuration if the new menu-based interface causes issues.
$ scripts/legacy_install.py --configure
Enable OpenSearch snapshots to an S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. bucket by setting the resolver correctly after the env-var rename.
Adds NGINX_RESOLVER_IPV4 and NGINX_RESOLVER_IPV6 environment variables to nginx.env (replacing the old _OFF-suffixed names) with reversed logic, giving operators cleaner control over NGINX resolver settings.
Replaces the step-by-step install.py wizard with a menu-based interface that lets operators change individual configuration values without stepping through the full question set; the legacy wizard remains available as scripts/legacy_install.py (e.g., scripts/legacy_install.py --configure).
Adds a Connections Tree visualization that tracks potential lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. by mapping direct and indirect communications between all devices reaching a root IP, with enriched endpoint and connection data.
Bundles the repository-s3 plugin in the OpenSearch container, enabling snapshot storage to S3-compatible buckets.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!NGINX_RESOLVER_IPV4_OFF and NGINX_RESOLVER_IPV6_OFF in nginx.env are renamed to NGINX_RESOLVER_IPV4 and NGINX_RESOLVER_IPV6 with their logic reversed — a working setup that set NGINX_RESOLVER_IPV4_OFF=true must now set NGINX_RESOLVER_IPV4=false (Malcolm's control scripts handle the migration automatically via ./config/env-var-actions.yml).
Abnormal AI adds automated VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. tagging by linking Microsoft 365 groups
└──▷ HOW TO FIND IT
Link an existing M365 group to automatically manage VIP status in Abnormal AI.
📍Navigate to Settings › VIP Management, then click Manage VIPs and select your Microsoft 365 group
Adds automatic VIP status management linked to Microsoft 365 groups for dynamic user tagging
Introduces Settings > VIP Management UI section with a Manage VIPs action for configuration
Abnormal AI adds Misdirected Email Prevention (MEP) using behavioral AI to detect and block misaddressed emails.
Adds Misdirected Email Prevention (MEP), a new capability that uses behavioral AI to detect misaddressed emails and mis-attached files by analyzing recipient context without requiring rules or policies.
Automatically blocks detected misdirected messages, routes them to Microsoft quarantine, and alerts the sender with self-remediation guidance.
Rspamd 3.14.0 adds HTML fuzzy hashing, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. fuzzy protocol, CTA URL detection API, dark mode WebUI, and a Postfix wizard.
└──▷ GET THIS VERSION
$ git clone --branch 3.14.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:$ git checkout 3.14.0
└──▷ USE IT
Detect call-to-action URLs in a message from a custom Lua rule — useful for catching phishing lures that bury a single redirect link in HTML.
lua
local cta_urls = task:get_cta_urls()
for _, url in ipairs(cta_urls) do
rspamd_logger.infox(task, 'CTA URL found: %s', tostring(url))
end
Enable dark mode in the Rspamd WebUI — useful for SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. analysts working in low-light environments; auto-detection follows the OS preference.
📍In the WebUI, open Settings and enable Dark Mode (auto-detection follows the OS theme preference).
Adds structural similarity detection for HTML content via HTML fuzzy hashing, with per-rule text_hashes toggle for HTML-only matching.
Adds full TCP support for the fuzzy protocol with auto-switch from UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. and production-ready connection management.
New task:get_cta_urls() Lua API for call-to-action URL detection, plus hash-based URL deduplication with a 50k URL limit for DoS protection.
Adds HTML URL rewriting infrastructure.
Adds web search context for the LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. plugin with Redis caching.
+5 moreshow less
Adds dark mode to the WebUI with auto-detection.
Adds advanced alias support with loop detection.
Adds Milter ESMTP argument parsing with a new Lua API.
Adds a Postfix wizard for automated Rspamd integration.
Adds configurable Bayes guards for tunable spam-learning behavior.
Snort3 3.10.0.0 adds OPC UA inspection, QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. extraction, DNS flavor counters, and new main-queue and data-bus APIs.
└──▷ GET THIS VERSION
$ git clone --branch 3.10.0.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.10.0.0
└──▷ USE IT
Tune how long Snort retries queued packets before dropping them under load.
lua
main = { retry_queue_timeout = 500 }
Adds OPC UA protocol inspector for industrial control system traffic analysis.
New QUIC extractor captures metadata from QUIC protocol flows.
Adds counters for different DNS flavors (e.g., DNS-over-TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it., DNS-over-UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery.) for visibility into resolver traffic.
New retry queue timeout option for the main packet processing queue.
New unsubscribe API on the multi-process data bus (mp_data_bus).
+2 moreshow less
SSH inspector now exposes fields to the extractor framework for session metadata logging.
HTTP inspect request and response buffers renamed.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The HTTP inspect request and response buffers are renamed — rules or configurations referencing the old buffer names will break.
1 more release in this issue
· 2025-11-07 → 2025-11-25
Snort3 3.9.7.0 adds DNS-over-HTTPSDNS-over-HTTPSA protocol that tunnels DNS queries inside encrypted HTTPS requests, hiding lookups from network observers. Cyber tools use it to evade DNS-based monitoring or filtering./QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. detection, WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. buffers in HTTP inspect, and new flow pruning telemetry.
└──▷ GET THIS VERSION
$ git clone --branch 3.9.7.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.9.7.0
Adds AppID support for DNS over HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. (DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring.) and DNS over QUIC (DoQ), enabling detection of encrypted DNS traffic.
Adds multi-stream support for DNS in AppID, improving classification across concurrent DNS flows.
Adds WAF buffers to http_inspect, providing new inspection surfaces for web application firewall rules.
Adds new pegs and packet tracer logging for flow prune events, improving visibility into session eviction.
Adds FNV-1a hash algorithm to the hash module.
+5 moreshow less
Adds an SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. extractor event in the ssl preprocessor.
Adds MPSE and LRU cache to snort_ml, expanding the machine-learning detection engine's performance capabilities.
Enhances TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. RST validation to follow RFC 5961 recommendations in stream_tcp.
Adds partial inspection on the HTTP start line in http_inspect.
Increases the maximum length of LogMessage output in the log module.
Inspektor Gadget v0.46.0 adds gadget instance status support and MicroK8s runc path detection.
└──▷ GET THIS VERSION
$ git clone --branch v0.46.0 https://github.com/inspektor-gadget/inspektor-gadget.git
# already have the repo? check out this version:$ git checkout v0.46.0
Adds instance status support to gadget-service, enabling visibility into the state of running gadget instances.
Adds runc path detection for MicroK8s environments, enabling Inspektor Gadget to work on MicroK8s clusters.
Adds gadget_socket_lookup_with_direction helper to the eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. include headers for gadget authors.
Supports OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. 1.1 method for retrieving cosign signatures alongside the legacy .sig tag approach.
Adds Puller and Exporter interfaces for both cosign legacy .sig tag and OCI 1.1 signature retrieval.
+2 moreshow less
Enables notation signature verification using a local store.
Renames snapshotters to iters and makes them repeatable, enabling periodic re-execution of snapshot-style gadgets.
Grype v0.104.0 adds a --from flag and expiring vulnerability suppressions.
└──▷ GET THIS VERSION
$ git clone --branch v0.104.0 https://github.com/anchore/grype.git
# already have the repo? check out this version:$ git checkout v0.104.0
└──▷ TRY IT
Scan a container image using a specific source with the new --from flag to control where Grype pulls the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. or image from.
$ grype --from <source> <target>
Adds --from flag to specify the source for vulnerability scanning input.
Supports expiring suppressions so ignored vulnerabilities are automatically re-surfaced after a set date, preventing stale waivers.
2 details in Everything
1 more release in this issue
· 2025-11-03 → 2025-11-17
Grype v0.103.0 adds hyphen support in version strings and respects rpmmod PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. qualifiers for more accurate matching.
└──▷ GET THIS VERSION
$ git clone --branch v0.103.0 https://github.com/anchore/grype.git
# already have the repo? check out this version:$ git checkout v0.103.0
Supports hyphens in package version strings, enabling accurate matching for versions that include hyphens.
Respects the rpmmod PURL qualifier, improving vulnerability matching precision for modular RPM packages.
kube-bench v0.14.0 adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmark support for rke2-cis-1.8
└──▷ USE IT
Scan an RKE2 cluster against the latest CIS benchmark profile.
kube-bench v0.14.0 adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmark support for RKE2-CIS-1.8.
└──▷ GET THIS VERSION
$ git clone --branch v0.14.0 https://github.com/aquasecurity/kube-bench.git
# already have the repo? check out this version:$ git checkout v0.14.0
└──▷ TRY IT
Run RKE2-CIS-1.8 benchmark checks against an RKE2 cluster to assess compliance with the new profile.
Adds --platform flag to docker image load and docker image save for multi-platform selection
Adds --bridge-accept-fwmark daemon option to allow bridge networks to accept packets with specific firewall marks
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Go module github.com/docker/docker is deprecated; use github.com/moby/moby/client and github.com/moby/moby/api instead
!Docker Content Trust CLI commands are removed from the Docker CLI binary (built as separate plugin)
!Debian armhf packages now target ARMv7 CPUsCPUsThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and no longer support ARMv6 devices; official Raspbian 32-bit packages are dropped
!Daemon API version requirement raised to v1.44 or later (requires Docker engine v25.0+)
Kata Containers 3.23.0 adds kata-ctl factory subcommands for VM templates, structured shim configs, and TEE NodeFeatureRules deployment.
└──▷ GET THIS VERSION
$ git clone --branch 3.23.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:$ git checkout 3.23.0
Adds kata-ctl vm-template factory subcommands for VM template management
Introduces a new structured configuration format for shims in the kata-deploy helm chart to replace the legacy env.* fields
Kata-deploy now automatically deploys NodeFeatureRules for Trusted Execution Environments (TEEs)
Enables CLH VMMVMMA Virtual Machine Monitor is software that creates and manages virtual machines, abstracting physical hardware so multiple OS instances run in isolation; cyber tools use it to sandbox execution or emulate target environments safely. process to run in non-root mode within the runtime-rs subsystem
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The env.shims, env.defaultShim, env.allowedHypervisorAnnotations, env.snapshotterHandlerMapping, env.pullTypeMapping, env.agentHttpsProxy, env.agentNoProxy, env._experimentalSetupSnapshotter, env._experimentalForceGuestPull (and their per-arch variants like *_x86_64), and env.debug fields are deprecated in the legacy format and will be removed in 2 releases.
Gatekeeper v3.21.0 adds VAP enforcement scope unification, per-operation ConstraintTemplate controls, dual-stack webhook support, and richer external data metrics.
└──▷ GET THIS VERSION
$ git clone --branch v3.21.0 https://github.com/open-policy-agent/gatekeeper.git
# already have the repo? check out this version:$ git checkout v3.21.0
└──▷ TRY IT
Enable unified VAP enforcement scope so that Gatekeeper-managed VAP resources respect the same namespace exemptions and config exclusions as the admission webhook.
$ --sync-vap-enforcement-scope=true
New sync-vap-enforcement-scope flag unifies ValidatingAdmissionPolicy enforcement surface with Gatekeeper's webhook config, Config resource exclusions, and exempt-namespace exemptions for consistent policy coverage.
ConstraintTemplates now support granular operation-level controls, allowing templates to be enforced on specific operations (CREATE, UPDATE, DELETE) including DELETE in VAP generation.
Adds new metrics and status reporting for the External Data / Provider API, improving observability when integrating external data sources into policy evaluation.
Supports dual-stack networking for the webhook service.
gator verify supports multiple expansions per test case.
+2 moreshow less
Adds extraEnvs support to the Helm chart.
Makes automount service account token, deployment annotations, extra volumes, and volumeMounts configurable via Helm.
Anchore Enterprise v5.22.0 adds VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. annotations, direct object store access, and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. list integration
Adds object_store.direct_access config key to Helm values for direct object store access from all services
Adds new vuln-annotator-editorRBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. role for creating and modifying vulnerability annotations
Adds VEX document generation via the GET /v2/images/{image_digest}/vex/openvex API endpoint
Adds KEV List flag to Policy vulnerability Gate package Trigger with a new option for known exploited vulnerabilities
Adds PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. field to vulnerability response objects in GET /v2/images/{image_digest}/vuln/{vuln_type}, GET /v2/sources/{source_id}/vuln/{vuln_type}, POST /v2/vulnerability-scan, and POST /v2/scan
+1 moreshow less
Adds PURL support in Artifact Analysis UI with a dedicated column in the Contents table
eksctl v0.219.0 adds AL2023 support on Outposts and makes AL2023 the default AMI for all Kubernetes versions.
└──▷ GET THIS VERSION
$ git clone --branch v0.219.0 https://github.com/weaveworks/eksctl.git
# already have the repo? check out this version:$ git checkout v0.219.0
Supports AL2023 as a node AMI choice on AWS Outposts clusters.
Makes AL2023 the default AMI family for all Kubernetes versions, replacing AL2.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!AL2023 is now the default AMI family for all Kubernetes versions; existing automation that relied on AL2 being the default will now provision AL2023 nodes unless the AMI family is explicitly set to AL2.
2 more releases in this issue
· 2025-11-11 → 2025-11-27
eksctl v0.218.0 adds ControlPlaneScalingConfig support and enables CFN stack termination protection by default.
└──▷ GET THIS VERSION
$ git clone --branch v0.218.0 https://github.com/weaveworks/eksctl.git
# already have the repo? check out this version:$ git checkout v0.218.0
Adds support for ControlPlaneScalingConfig, enabling control plane scaling configuration for EKS clusters.
Enables termination protection by default for eksctl-managed CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. stacks, reducing accidental stack deletion risk.
Prowler 5.14 adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. providers, multi-LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Lighthouse AI, MongoDB Atlas, 8 new checks, and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. Docker images.
└──▷ GET THIS VERSION
$ git clone --branch 5.14.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 5.14.0
Adds Oracle Cloud Infrastructure (OCI) as a cloud provider with 51 checks and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. OCI Foundations Benchmark v3.0.0 support.
Adds a new Infrastructure-as-Code (IaC) provider powered by Trivy for scanning Terraform, CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call., Kubernetes manifests, Dockerfiles, Helm charts, Azure ARM templates, and secrets before deployment.
Adds MongoDB Atlas as a new provider (API only) with 10 available checks.
Expands Lighthouse AI with multi-LLM support: OpenAI, Amazon Bedrock (Claude, Llama, Titan), and OpenAI-compatible APIs such as OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code..
Adds new compliance frameworks: C5 for Azure and GCP, HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. for GCP, NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0 for AWS, CIS 3.0 for OCI, and FedRAMP 20xFedRAMP 20xA GSA-led overhaul of the FedRAMP cloud-authorization program aimed at cutting compliance burden through continuous, automated evidence collection rather than point-in-time audits, letting vendors reach federal markets faster. KSI Low for AWS, Azure, and GCP.
+18 moreshow less
Adds PDF reporting for ENS, NIS2NIS2EU directive that expands mandatory cybersecurity requirements to more sectors and member states than its predecessor, giving cyber tools a compliance framework to map controls and reporting obligations against., and Prowler ThreatScore compliance frameworks.
Adds ThreatScore for the Kubernetes provider.
Adds metadata, details, and partition attributes to the /resources endpoint, and details and partition to the /findings endpoint for raw cloud provider API transparency.
Adds new endpoint GET /api/v1/overview/regions to retrieve aggregated findings data by region.
Adds muting of findings based on simple rules with a custom reason via the API.
Adds new AWS check codepipeline_project_repo_private.
Adds five new GCP Cloud Storage checks: cloudstorage_bucket_versioning_enabled, cloudstorage_bucket_soft_delete_enabled, cloudstorage_bucket_logging_enabled, cloudstorage_audit_logs_enabled, and cloudstorage_bucket_sufficient_retention_period.
Adds new Azure PostgreSQL Flexible Server check postgresql_flexible_server_entra_id_authentication_enabled.
Adds new GitHub check organization_default_repository_permission_strict.
Publishes multi-architecture Docker images (linux/amd64 and linux/arm64) to Docker Hub.
Adds RSS feed for real-time release announcements and incident notifications in the Latest Updates panel.
Adds redesigned Overview dashboard featuring Prowler ThreatScore, severity distribution visualization, and faster access to latest failed findings.
Adds provider-type filters and optional pagination disable to GET /api/v1/providers.
Adds new endpoint to retrieve the number of providers grouped by provider type.
Extends GET /api/v1/overviews/services to make date filters optional, returning latest scan data by default.
Delivers major scan performance improvements: batch inserts replacing per-finding transactions, aggregated compliance lookup table reducing average response times from ~0.9s to ~20ms.
Adds external resource links to IaC findings for direct navigation to source code in Git repositories.
Uses branch name as the region identifier for IaC findings.
Tracee v0.24.0 introduces evt triggers, new syscalls (security_sb_umount, open_file_ns/mount), and the traceectl CLI tool.
Adds evt trigger support for event-driven logic
Adds open_file_ns and open_file_mount events for filesystem tracking
Adds security_sb_umounteBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. event detection
Adds heartbeat event type
Introduces traceectl CLI tool alongside the main Tracee service
+2 moreshow less
Separates data field decoding types in the API payload
Reintroduces the --containers flag to filter output by container context
Tracee v0.24.0 adds traceectl CLI, new file/heartbeat events, event triggers, and richer data-field decoding types.
└──▷ GET THIS VERSION
$ git clone --branch v0.24.0 https://github.com/aquasecurity/tracee.git
# already have the repo? check out this version:$ git checkout v0.24.0
Adds traceectl, a new dedicated CLI tool bundled with Tracee for interacting with the Tracee service.
Adds open_file_ns and open_file_mount events for tracking file-open activity with namespace and mount context.
Adds a heartbeat event to signal that Tracee is alive and processing.
Introduces event triggers (evt trigger) enabling events to fire based on other event conditions.
Adds richer data field decoding types, separating decode type definitions for more precise event field interpretation.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Data field decoding types are separated into distinct types (feat!: separate data field decoding types), which may break consumers relying on the previous unified decoding type structure.
aya-ebpf-bindings v0.1.2 adds MIPSMIPSA RISC processor architecture originally developed at Stanford and commercialized by MIPS Technologies, widely used in embedded and network devices; cyber tools target it to analyze or exploit routers, cameras, and similar hardware. bindings, hardware breakpoint support, and powerpc64/s390x/loongarch64 architecture coverage.
└──▷ GET THIS VERSION
$ git clone --branch aya-ebpf-bindings-v0.1.2 https://github.com/aya-rs/aya.git
# already have the repo? check out this version:$ git checkout aya-ebpf-bindings-v0.1.2
Implements PerfEventConfig::Breakpoint to allow attaching hardware breakpoints (R, W, RW, X), generating HW_BREAKPOINT_* constants and struct bpf_perf_event_data in support.
Adds MIPS architecture bindings, updating aya-obj/src/generated/mod.rs and bpf/aya-bpf-bindings/src/lib.rs to include MIPS support.
Microsoft Sentinel November 2025 updates: UEBA in Defender portal, SAP agentless connector GA, standardized account entity naming
└──▷ HOW TO FIND IT
Explore the new UEBA anomaly context directly from the incident graph interface.
📍In the incident graph, select Go Hunt › All user anomalies to view all anomalies for a specific user.
Adds UEBA Anomalies automatic tagging and a Top UEBA anomalies section (top 3 past 30 days) to user side panels and entity pages for prioritized behavioral investigations.
Exposes an agentless SAP data connector that is now generally available, replacing the deprecated containerized SAP data connector.
Changes account entity naming logic in alerts and incidents to prioritize Account.UPNprefix, then Account.Name, then Account.DisplayName.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The containerized SAP data connector agent will be permanently disabled on September 14, 2026 and stop delivering SAP logs; existing analytics rules, workbooks, hunting queries, and playbooks depending on those logs will stop returning results for affected systems.
!Standardized account entity naming logic now prioritizes Account.UPNprefix over Account.Name and Account.DisplayName, potentially changing behavior for analytic rules, automation rules, playbooks, and hunting queries.
Exabeam Nov 2025 adds new cloud collectors, correlation rule schedules, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for local accounts, and AI dashboard creation
Adds the Broadcom Carbon Black Cloud Collector, Cylance Protect (now Arctic Wolf) Cloud Collector, and GitHub Cloud Collector to ingest alerts, events, and audit logs from their respective sources.
Adds the Early Access Azure Blob Storage Cloud Collector, Azure Virtual Network Flow Cloud Collector, and Palo Alto Networks XDR Cloud Collector for ingesting Azure threat detections, virtual network flow logs, and Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. security alerts.
Enables scheduling of correlation rules to trigger daily, weekly, monthly, or during custom start/end time periods via the create or edit action in the correlation rule interface.
Adds four new pre-built correlation rule templates for adversary reconnaissance: Fsutil Peripheral Device Discovery Command, Password Policy Discovery Commands, System Language Discovery Commands, and Log Enumeration Commands.
Extends Exabeam Nova AI to auto-create dashboard visualizations for the Anomaly Fields data model using natural language prompts.
+8 moreshow less
Allows deletion of custom services and actions in the Automation Management section, provided they are removed from all existing playbooks first.
Adds Multi-factor Authentication (MFA) support for local accounts, requiring TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. registration on next login when enabled in Single Sign-On/MFA settings.
Enhances Live Tail filtering to allow filtering the log stream by source collector in addition to parser.
Adds alert_created_time, case_created_time, and case_closed_time timestamps to case webhook payloads, and alert_created_time to alert webhook payloads.
Increases playbook name character limit to 205 characters and allows creation of up to 20 advanced playbooks without a trigger.
Adds filtering of automation services by creator in the Automation Management section.
Organizes Attack Surface Insights entity details by source, separating Context Data and Event Data attributes.
Displays pre-built service origin with Exabeam name and logo under the CREATED BY column for pre-built services.
13 details in Everything
└──▷ BREAKING ON UPGRADE
!The Custom Default category of parsers in Log Stream is discontinued; custom default parsers are removed one region at time starting January 2026, and corresponding standard default parsers will be enabled.
New detectors for SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments.lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. and Impacket execution; new EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. and AWS drilldowns; new integrations for Wiz, Zero Networks, Jamf Protect, and others.
Adds SMB Connection From an Abnormal Process detector that flags non-system processes initiating SMB connections via Windows event log 5156.
Adds Possible Execution of Impacket detector to identify potential lateral movement and credential theft via Impacket scripts.
Adds New-Browser User Agents Authenticating to OfficeHome detector for monitoring non-browser authentication to Microsoft 365.
Adds Microsoft 365 Abnormal Mail Access by Unusual ClientAppId detector for detecting mailbox access via atypical client applications.
Adds Suspicious Teams communication from foreign user detector filtering chats from commonly used domains.
+12 moreshow less
Adds EDR Process ID to Registry Operations drilldown querying registry activity half an hour before and after lead inception.
Adds Process Connections from IP over Kerberos drilldown for identifying outbound KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. connections (port 88) by process.
Adds Destination IP to Process Connections drilldown mapping destination IPs to endpoint processes.
Adds AWS User Role Attachment Activities drilldown monitoring AttachRolePolicy, AttachGroupPolicy, and AttachUserPolicy events.
Adds Associated Microsoft Teams Activities and Complementary M365 audit logs drilldown for investigating Teams phishing success.
Adds SentinelOne Threat Raw Correlation drilldown providing context on alerts, processes, files, and network activity.
Adds new integration for Wiz Threats via Webhook/S3.
Adds new integration for Zero Networks Audit Activity Logs via API/S3.
Adds new integration for Jamf Protect Events via API/S3.
Adds new integration for Tanium audit logs (33 endpoints) via API/S3.
Adds new integration for Fastly WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. via S3.
Adds new integration for Check Point Email Events via S3.
17 details in Everything
└──▷ BREAKING ON UPGRADE
!The SOCKS proxy usage detector is deprecated and will stop triggering leads.
!The Process execution from remote network share detector is replaced by a scoring model in EDR-based detectors.
!The Suspicious execution from %ProgramData% detector is replaced by a scoring model in EDR-based detectors.
!The Possible use of a stolen or forged user ticket (TGT) detector is deprecated and will stop triggering leads.
Hunters Pathfinder AI adds AWS SESAWS SESAmazon's cloud email-sending service, used by tools that need to deliver alerts, reports, or notifications without running their own mail infrastructure. Enumeration detector, MOTW drilldown, and new webhook/API integrations for DataDog, Delinea, Beyondtrust, FortiDLP, and Genesys.
Adds Possible AWS SES Enumeration detector to identify attackers checking compromised account status via ListServiceQuotas, GetSendQuota, GetAccount, ListIdentities, GetIdentityVerificationAttributes, GetAccountSendingEnabled, and UpdateAccountSendingEnabled
Adds Potential download origin URL found drilldown enrichment for Crowdstrike MotwWritten events showing Referrer and Host URLs
Adds Microsoft 365 users who accessed mailbox owned by this user drilldown to identify shared mailboxes via non-owner access
Adds DataDog webhook integration for alerting
Adds Delinea-audit-logs S3 integration for Suite Cloud logs
+3 moreshow less
Adds Beyondtrust-remote-support-session API integration
Adds FortiDLP-logs API integration
Adds Genesys-audit-logs API integration
8 details in Everything
└──▷ BREAKING ON UPGRADE
!The Execution of WHOAMI as local system detector is deprecated and planned for removal on Nov 27, 2025
Databricks adds automated classic workspace creation via AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. temporary delegation
Automatic email notifications for expiring personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. (Public Preview)
Public Preview of applying ABACABACAttribute-based access control, where rules evaluate facts about the user, resource and request. Access can depend on conditions such as department, data sensitivity or device status. policies to tables and schemas in Delta Sharing.
└──▷ HOW TO FIND IT
Apply an ABAC policy to a specific schema before sharing it via Delta Sharing.
📍Add tables and schemas secured by ABAC policies to a share
Consume the shared data and apply your own ABAC constraints.
Connect Databricks Genie Agents to Microsoft Copilot Studio via Managed MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Servers
Lakeflow Connect now supports SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. as an ingest source in Public Preview
Adds Beta JDBCJDBCA Java standard API for connecting applications to relational databases, maintained as part of the Java SE platform, letting tools query any compliant database through a single consistent interface. Unity Catalog connections for governed external database access.
Enables JDBC Unity Catalog connection to read/write to external databases via Spark Data Source API or Databricks Remote Query SQL API
Makes JDBC connection reusable across any Unity Catalog compute type: serverless, standard clusters, dedicated clusters, and Databricks SQL
New MCP Servers tab in the workspace to manage installed servers and browse Databricks Marketplace.
MCP Servers tab provides a curated list of MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers available to install from Databricks Marketplace
MCP Servers tab displays your managed and external MCP servers
Databricks Marketplace adds support for listing and installing Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) servers in public preview
Mosaic AI Model Serving adds support for function callingfunction callingA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions. and structured outputstructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. with Alibaba Cloud Qwen3-Next Instruct (Beta)
Adds function calling capability to Mosaic AI Model Serving when using the Qwen3-Next Instruct model
Adds structured output capability to Mosaic AI Model Serving when using the Qwen3-Next Instruct model
Databricks ABACABACAttribute-based access control, where rules evaluate facts about the user, resource and request. Access can depend on conditions such as department, data sensitivity or device status. moves to account-level enforcement with automatic column mask type casting
Adds account-level enforcement for Attribute-based access controlAttribute-based access controlAttribute-based access control, where rules evaluate facts about the user, resource and request. Access can depend on conditions such as department, data sensitivity or device status. (ABAC) policies across all workspaces attached to an account's metastore
Enables automatic type casting for column mask functions defined in ABAC policies to match target column data types
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Existing column mask functions might fail if their return types are incompatible with the target column's type due to new automatic type casting behavior
Google SecOps adds filtered raw log download to CSV, column management, and legacySearchRawLogsV2 API
└──▷ HOW TO FIND IT
Download raw logs for offline analysis with custom columns.
📍In Google SecOps UI, run a raw log search, apply filters, click Download, then use Column Manager to select Timestamp, Event Type, Raw log and any additional fields before saving as CSV.
Programmatically query raw logs using the new API endpoint.
Google SecOps adds a new MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. coverage dashboard for measuring posture and identifying gaps.
└──▷ HOW TO FIND IT
Use the new dashboard to quickly visualize which MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. techniques are covered by your detections and where critical gaps exist.
📍In the console, go to Analytics › MITRE ATT&CK coverage dashboard
The MITRE ATT&CK coverage dashboard is now available to measure security posture against the MITRE ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. framework, helping assess threat coverage and identify gaps.
Wazuh v4.14.1 adds IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role support for AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. flow logs and static/temporary credentials for the Amazon Security Lake subscriber.
└──▷ GET THIS VERSION
$ git clone --branch v4.14.1 https://github.com/wazuh/wazuh.git
# already have the repo? check out this version:$ git checkout v4.14.1
<aws:iam_role> configuration option in the AWS wodle to assume IAM roles for VPC flow log collection.
aws_credentials support in the Amazon Security Lake subscriber enables static (aws_access_key_id, aws_secret_access_key) and temporary (aws_session_token) credentials.
Cloudmersive released v1-5-3 of its Cloud Document AI API service, introducing a new Advanced Document Classification and Categorization API for automated document analysis.
IntelMQ 3.5.0 adds product/vulnerability fields, Shodan Alert collector, MySQL output, GPG decryption and new bot params
└──▷ GET THIS VERSION
$ git clone --branch 3.5.0 https://github.com/certtools/intelmq.git
# already have the repo? check out this version:$ git checkout 3.5.0
Adds intelmq.bots.outputs.sql.output support for MySQL databases in addition to PostgreSQL.
Introduces intelmq.bots.collectors.shodan.collector_alert to query the Shodan Alert API directly.
Extends intelmq.bots.collectors.mail.collector_mail_attach with GPG attachment decryption capability.
Adds new message fields product.full_name, product.name, product.vendor, product.version, and product.vulnerabilities to identify products and vulnerabilities in data events.
Introduces the constituency field in the IntelMQ Data Format for easier identification in multi-constituency setups.
+5 moreshow less
Adds severity field to help with triaging received events, supporting enum values: critical, high, medium, low, info, undefined.
New parameter stop_retry_limit added to gracefully handle stopping bots which take longer to shutdown.
Adds additional_grouping_keys, templating, allowed_fieldnames, and fieldnames_translation parameters to intelmq.bots.outputs.smtp_batch.output for enhanced email batching.
intelmq.lib.mixins.cache.CacheMixin extended to support temporary storing messages in a cache queue.
Introduces new mode random_single_value to intelmq.bots.experts.fake.expert.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!Drops support for Python 3.8; Python >=3.9 is now required.
!Removes intelmq.bots.collectors.blueliv collector as it uses an unmaintained library.
!Removes intelmq.bots.parsers.blueliv parser as it is obsolete with the removed collector.
!The intelmq.bin.rewrite_config_files tool has been removed; obsolete JSON configuration file rewriting is no longer supported.
Watcher v3.0 introduces Legitimate Domains module, AI threat summaries, RDAPRDAPA JSON-based protocol for querying domain and IP registration data, standardized by the IETF as a modern replacement for WHOIS, giving cyber tools structured, machine-readable ownership and contact lookups. discovery, and configurable weekly/breaking news settings
└──▷ GET THIS VERSION
$ git clone --branch v3.0 https://github.com/thalesgroup-cert/Watcher.git
# already have the repo? check out this version:$ git checkout v3.0
└──▷ TRY IT
Run the new Legitimate Domains module migration to initialize the database schema.
$ docker compose run watcher bash
python manage.py migrate
Adds LegitimateDomain module with dedicated API for CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. operations on company-approved domains
Adds WEEKLY_SUMMARY_DAY, WEEKLY_SUMMARY_HOUR, and BREAKING_NEWS_THRESHOLD to .env for controlling report schedules and alert thresholds
Adds RDAP alert support for tracking registration changes via the new RDAPDiscovery class
Adds Hugging Face transformers integration for AI-driven NER and text summarization in threat reports
Adds ResizableContainer and TableManager components for customizable dashboard panel widths, filtering, sorting, and pagination
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Major database schema changes require running python manage.py migrate after pulling the new Docker image to prevent data loss
MISP v2.5.27 adds a flowintel case-creation workflow module and zstd-compressed request support with SimdJSON encoding.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.27 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.27
└──▷ HOW TO FIND IT
Automatically open a flowintel case when a MISP event meets a trigger condition — wire the new module into an existing workflow.
📍In the MISP console, go to Event Actions › Workflows, open or create a workflow, search for the module flowintel-create-case in the module palette, drag it onto the canvas, configure the flowintel connection parameters, and save.
New flowintel-create-case workflow module enables automated case creation in flowintel directly from MISP workflows.
Supports zstd-compressed requests, expanding compression options for high-volume data ingestion.
Adds SimdJSON-accelerated encoding (simdjson_encode, simdjson_encode_to_stream, SimdJsonBase64Encode) for events and large arrays when simdjson_php is available, unlocking faster throughput at scale.
New attribute fetcher pipeline with early query optimisation for more efficient attribute retrieval.
JSON schema updated to reflect latest MISP 2.5 features, enabling validation of new event structures.
5 details in Everything
3 more releases in this issue
· 2025-11-04 → 2025-11-27
MISP v2.5.26 adds a UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. attribute type, JSON syslog output, UUID-based event linking, and new DB indices for performance.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.26 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.26
Adds a dedicated UUID attribute type to satisfy FlowIntel and object template requirements, replacing ad-hoc text fields for unique identifiers.
New option to prioritize UUID-based event linking over traditional IDs, improving consistency across distributed MISP instances.
New option to emit syslog messages in JSON format for structured logging and easier downstream processing.
Introduces new database indices to significantly improve overall MISP performance.
Updates misp-stix with better STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2 input handling to tolerate invalid STIX 2 output from non-compliant TIP platforms.
Adds integration with DFIRDFIRDigital forensics and incident response, investigating what happened during a security incident and containing it. The work includes preserving evidence, reconstructing activity and restoring systems. Iris platform
└──▷ GET THIS VERSION
$ git clone --branch v0.9.5 https://github.com/stanfrbd/cyberbro.git
# already have the repo? check out this version:$ git checkout v0.9.5
Feedly Threat Intelligence adds CVE vector filtering, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v18 support, and IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. subtype exposure in article JSON.
Display and filter by specific CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v3.1 vector components for granular vulnerability assessment
Track MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. v18 with 12 new Feedly AI Models for enterprise tactics
IoC subtypes are now displayed in the article JSON
3 details in Everything
1 more release in this issue
· 2025-11-12 → 2025-11-26
Feedly Threat Intelligence adds Custom Lists support in TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. Dashboard, new Middle East AI model, and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only.IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. detection.
Adds Threat Intelligence Reports section to the Cyber Attacks insights card
Adds New AI Model for 'threat actors from Middle East'
Improves IP IoC model to include IPv6 IoC detection
OpenCTI 6.8.14 adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. V3.0 support and upsert on the modified field
└──▷ GET THIS VERSION
$ git clone --branch 6.8.14 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.8.14
└──▷ TRY IT
Ingest a vulnerability with its specific CVSS v3.0 score vector.
OpenCTI 6.8.13 introduces managed connectors proxy support and STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.0 toStix API updates.
└──▷ GET THIS VERSION
$ git clone --branch 6.8.13 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.8.13
Adds managed_connectors_proxy_support configuration for backend-managed connectors
Updates the toStix API endpoint in the STIX 2.0 converter
Lookyloo v1.35.0 adds iFrame capture with timestamping, Google Docs/Dropbox download guessing, and free-form subsequent capture URLs.
└──▷ GET THIS VERSION
$ git clone --branch v1.35.0 https://github.com/Lookyloo/lookyloo.git
# already have the repo? check out this version:$ git checkout v1.35.0
└──▷ HOW TO FIND IT
When analyzing a phishing page that loads content via iFrames, download the rendered iframe content directly from its node in the capture tree to examine what was presented to the victim.
📍In the capture tree, locate the iframe node, then click Download rendered content on that node to save the iframe's rendered output.
When a suspicious Google Docs or Dropbox link is captured, trigger an automatic download capture and send the file to Pandora for malware analysis.
📍On the capture result page, click Guess download link on the Google Docs or Dropbox node, then choose Capture and submit to Pandora from the subsequent capture modal.
Supports iFrames captured via Lacus v1.20.0: URLs on iframes now correctly anchor nodes in the capture tree, rendered iframe content is downloadable from its tree node, and all frame contents are submitted for a Trusted Timestamp.
Guesses download/export links for Google Docs and Dropbox landing pages, enabling a one-click subsequent capture of the file and direct submission to Pandora.
Allows any arbitrary URL to be entered in the subsequent-capture modal so it is captured in the current browser context, including the session's local storage.
Tenzir v1.23.0 adds Editor Shortcuts Help and Type Icons in Explorer, updates seaweed container defaults
Editor Shortcuts Help: Clicking the info button next to the copy pipeline link shows keyboard shortcuts.
Type Icons in Explorer: Replaced text labels with icons for types in the table header; hover for full name.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The tenzir-seaweed image defaults to non-root user; existing stacks must set services:seaweed:user:root or run chown -R seaweed:seaweed /var/lib/seaweedfs.
Tenzir v5.21.0 adds OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. 1.7.0 support, Base58 functions, and multi-key deduplication.
Supports OCSF version 1.7.0 for built-in operators and functions
Adds encode_base58 function to encode string or blob values in Base58
Enables all encoding and decoding functions on secret values
Allows multiple keys in deduplicate operator (e.g. deduplicate a, b.c, d)
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The parse_time() function now defaults to 1970 instead of 1900 when the year is unspecified
Tenzir v1.22.0 adds optional jwks_uri for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. and a compact Explorer table.
Adds jwks_uri configuration field to the TENZIR_PLATFORM_OIDC_TRUSTED_AUDIENCES JSON for external identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. without discovery documents
Implements a more compact Explorer table layout to display more rows in the same space
Renames top-level total_bytes, free_bytes, used_bytes in tenzir.metrics.memory to nested system.* fields
Moves process-specific memory metrics from metrics.process into tenzir.metrics.memory
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The metric layout changed: top-level keys total_bytes, free_bytes, and used_bytes in tenzir.metrics.memory are now nested under the system key (e.g., tenzir.metrics.memory.system.total_bytes). Existing dashboards or queries targeting the old flat structure will fail.
Tenzir Platform v1.21.0 adds CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. template for AWS deployment, pipeline link copy button in editor, and faster library loading
Splunk Security Content v5.18.0 adds Castle RAT analytic story and 3 new endpoint detections for UAC bypass and browser abuse.
└──▷ GET THIS VERSION
$ git clone --branch v5.18.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v5.18.0
New analytic story: Castle RAT — covers command execution, file exfiltration, keylogging, and screen capture TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. used in targeted intrusion campaigns.
New detection: Windows Browser Process Launched with Unusual Flags — improves visibility into browser abuse within Castle RAT infection chains.
New detection: Windows ComputerDefaults Spawning a Process — detects ComputerDefaults-based UAC bypass technique.
New detection: Windows Handle Duplication in Known UAC-Bypass Binaries — identifies handle duplication abuse in known bypass binaries for privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. detection.
Enhanced research.splunk.com detection entries now include attack data, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. techniques, simulation environment details, attack timestamps, tools used, and step-by-step replay instructions.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Several detections previously deprecated in ESCU v5.16.0 have been removed in v5.18.0: Windows Change Default File Association For No File Ext, Detect Rundll32 Application Control Bypass - setupapi, Detect Rundll32 Application Control Bypass - syssetup, and Detect Rundll32 Application Control Bypass - advpack. Users must transition to their listed replacement detections.
!A new set of detections has been deprecated and is scheduled for removal in ESCU v5.20.0; see the official List of Detections Scheduled for Removal for details.
Beelzebub v3.6.0 improves the cloud plugin and HTTP LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. honeypot capabilities.
└──▷ GET THIS VERSION
$ git clone --branch v3.6.0 https://github.com/mariocandela/beelzebub.git
# already have the repo? check out this version:$ git checkout v3.6.0
Improves the cloud plugin for enhanced honeypot deployment.
Improves the HTTP LLM honeypot for more realistic attacker emulation.
pySigma v1.0.0 adds Not Equals expressions, EQL correlation support, timestamp modifiers, new transformations, and Sigma Spec 2.1.0 correlation types.
└──▷ GET THIS VERSION
$ git clone --branch v1.0.0 https://github.com/sigmahq/pysigma.git
# already have the repo? check out this version:$ git checkout v1.0.0
Adds MatchValueCondition for exact value matching in detection conditions.
Adds CaseTransformation to transform field values to a specific case.
Adds StrictFieldMappingFailure transformation to enforce strict field mapping.
Adds snake_case transformation support on a field via SnakeCaseTransformation.
Adds neq (not-equals / !=) operator support for Sigma condition expressions.
+16 moreshow less
Adds timestamp part modifiers (e.g. |gt, |gte, |lt, |lte) for use in backends.
Adds support for importing Python helper functions into Jinja2 templates used by backends.
Adds Windash validator to the available rule validators.
Adds support for Sigma Spec 2.1.0 correlation types: value_sum, value_avg, value_percentile, and value_median.
Adds backend name and output format to processing pipeline variables.
Adds support for custom expressions in empty AND/OR conditions.
Adds fieldref wildcard support and integrates field references into the base backend.
Adds regex value-list transformation support for placeholders.
Supports multiple condition fields in correlation rules mapping.
Adds RuleAttributeCondition support for list-type attributes.
Replaces static MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. data with on-demand API loading, with support for custom URLs and local file paths.
Splits query finalization in the conversion process for finer backend control.
Includes rule scope in SigmaRule.to_dict() output.
Supports Python 3.14.
Checks for invalid pipeline keys during pipeline processing.
Adds condition existence check in post-init method for detection objects.
21 details in Everything
└──▷ BREAKING ON UPGRADE
!Multiple breaking changes are present — see the breaking changes documentation at docs/Breaking_Changes.rst for the full list of changes that may break existing code.
sigma-cli v2.0.0 adds rule field analysis and MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. cache management commands.
└──▷ GET THIS VERSION
$ git clone --branch v2.0.0 https://github.com/SigmaHQ/sigma-cli.git
# already have the repo? check out this version:$ git checkout v2.0.0
└──▷ TRY IT
Identify all field names referenced across your Sigma rules to audit coverage or plan backend mappings.
$ sigma analyze <path>
New analyze command extracts field names from Sigma rules.
35 new Sigma rules added covering macOS stealers, FortiGate admin activity, ClickFix/FileFix, WSUSWSUSWindows Server Update Services, a Microsoft service that lets administrators centrally manage and distribute Windows and software updates to machines on a network instead of each host pulling from the internet.deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution., and more.
└──▷ GET THIS VERSION
$ git clone --branch r2025-12-01 https://github.com/SigmaHQ/sigma.git
# already have the repo? check out this version:$ git checkout r2025-12-01
Adds detection for AWS GuardDuty detector deletion or modification.
Adds two rules for Atomic macOS Stealer: FileGrabber activity and persistence indicators.
Adds detection for Cisco ASA/FP SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination.VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. exploitation (CVE-2025-20333 / CVE-2025-20362) via proxy logs.
Adds DNS query detection for the Finger utility.
Adds two rules covering WSUS deserialization exploitation (CVE-2025-59287): log-based and suspicious child process.
+16 moreshow less
Adds six FortiGate-specific rules detecting admin account creation, local user creation, VPN SSL portal/settings changes, firewall policy/address-object additions, and user group modification.
Adds detection for Grixba malware reconnaissance activity.
Adds detection for HackTool WSASS execution.
Adds detection for network connections initiated via Finger.EXE.
Adds Linux detection for potentially suspicious long filename patterns.
Adds detection for enabling or disabling RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. via the Win32_TerminalServiceSetting WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. class.
Adds two rules for registry modification attempts via VBScript (process-based and PowerShell).
Adds detection for registry tampering by potentially suspicious processes.
Adds detection for renamed Schtasks execution.
Adds four ClickFix/FileFix detection rules: suspicious execution patterns, Explorer process with whitespace padding, space characters in RunMRU, and space characters in TypedPaths.
Adds detection for filenames with embedded Base64 commands.
Adds detection for suspicious KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ticket requests via CLI.
Adds detection for suspicious use of For loop with recursive directory search in CMD.
Adds detection for uncommon Svchost command-line parameters.
Adds detection for unsigned .node files being loaded.
Adds two rules for Windows Default Domain GPO modification (generic and via GPME).
Tines 37.1.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server tools to AI Agent actions, Slack integration for those actions, and Story record limit increases.
Increases Story record limits to 50 fields and 100 validation options.
Enables testing story runs with a dynamic Use tunnel field.
Adds support for using tools from MCP servers in AI Agent actions.
Enables use of AI Agent actions within Slack workflows.
4 details in Everything
3 more releases in this issue
· 2025-11-04 → 2025-11-25
Tines 37.0.0 introduces build image digests, Postgres bigint support via built-in btree_gin, and filter/toggle UI controls
Adds tines/tines-app, tines/tines-command-runner, and tines/tines-nginx images tagged with specific sha256 digests (e.g. sha256:bb370f47de906ba027fbb7994d9fe7c13ff3945c52732cc13b9726052c22a0c4) for reproducible builds
Tines 36.2 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server support for AI Agent actions.
Huntress' SAT custom content creator now supports an Image slide type for full-bleed visuals. This GA feature allows users to add screenshots or exported images that maintain aspect ratio during resizing, enhancing report customization without cropping.
Huntress Managed EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. detects and remediates attacker abuse of Windows Firewall to block agent/Defender comms
Adds detection and automated remediation for attackers abusing Windows Firewall rules to impair Huntress EDR and Windows Defender
General Manager View is now generally available for Huntress Managed SAT, enabling read-only access to assignment and phishing reports for designated learners via a new UI toggle.
Trend Vision One adds support for latest CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline.EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves., K8s, OpenShift, and GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. benchmarks.
Adds support for CIS Amazon EKS Benchmark v1.7.0
Adds support for CIS KubernetesCIS KubernetesHardening benchmarks published by the Center for Internet Security for Kubernetes clusters, giving cyber tools a concrete, versioned checklist of configuration checks to run and report against. Benchmark v1.11.1
Adds support for CIS Red Hat OpenShift Container Platform Benchmark v1.8.0
Adds support for CIS Google GKE Benchmark v1.8.0
4 details in Everything
└──▷ BREAKING ON UPGRADE
!EKS benchmark version 1.4.0 is deprecated starting November 24 2025, with support ending January 23 2026.
Trend Vision One Helm Chart 3.3.0 adds file integrity monitoring for container critical areas
Adds file integrity monitoring which detects unexpected file changes in containers by comparing current state to a pre-established baseline and logging deviation events.
Trend Vision One ZTSAZTSAZero Trust Security Architecture: a network access model where no user or device is trusted by default, requiring continuous verification before granting access, letting cyber tools enforce least-privilege policies across any environment. 2.29.1043 adds proxy fallback and feedback status UI
Implemented automatic proxy fallback mechanism that switches to a reachable proxy
Added feedback status button in the Debug Settings page for troubleshooting
Agentless Vulnerability & Threat Detection adds conformity:suppress tag to exclude resources from CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. rule failures.
Trend Vision One ZTSAZTSAZero Trust Security Architecture: a network access model where no user or device is trusted by default, requiring continuous verification before granting access, letting cyber tools enforce least-privilege policies across any environment. Private Access connector v2.38.0.1176 adds automatic backend service disruption detection with cached configuration fallback.
Automatically detects backend service disruptions and preserves network connectivity by using cached configurations, while monitoring for service recovery.
Cloud Email Gateway Protection adds flexible DMARC enforcement by allowing separate actions for domains with valid vs. missing/misconfigured DMARC records.
Adds the ability to configure separate actions for inbound email authentication results based on DMARC policy status (well-defined vs. misconfigured/missing) in Cloud Email Gateway Protection.
Strengthens DMARC authentication behavior in Cloud Email Gateway Protection to align with RFC standards for better spoofing protection.
Adds support for selecting GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. Autopilot mode when configuring Container Security agents in Trend Vision One.
Enables selection of GKE Autopilot option to adjust agent deployment for Google Kubernetes Engine clusters running Autopilot.
Trend AI Vision One Endpoint Security agent adds support for Windows 11 ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. endpoints.
Supports enabling Endpoint Sensor (XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. for Endpoints) on Windows 11 ARM64 endpoints.
TrendVision One Endpoint Security agent adds UK region, SPC deployment scripts, early check installer, Windows 11 25H2 support, and User-based firewall for Server & Workload
Agent now supports the UK region
Agent supports deployment scripts for Sovereign and Private Cloud (SPC) deployments
Cribl Stream 4.15 adds Fabric Real-Time Intelligence and Databricks Destinations, Cloudflare Source, and temporary log level TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. on Cribl.Cloud
Adds Fabric Real-Time Intelligence Destination for sending telemetry to Microsoft Fabric Eventstreams.
Adds Databricks Destination for sending data to Databricks Unity Catalog volumes.
Adds Cloudflare Source via HECHECAn HTTP API endpoint provided by Splunk that lets applications stream JSON-formatted events directly into a Splunk index without a forwarder agent, reducing pipeline complexity for log-shipping tools. endpoints to receive Cloudflare Logpush data.
Adds Cloudflare R2 Destination for S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. object storage delivery.
Adds configurable TTL setting on Cribl.Cloud to temporarily change log levels for up to 24 hours.
+8 moreshow less
Extends Cribl Outpost to route control plane communication from Stream Workers.
Adds Enable Source IP Spoofing setting to Syslog Destination (UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. only) to preserve original Source IP.
Adds Force close on shutdown setting to Filesystem, S3, Azure Blob, GCS, and Minio Destinations.
Adds Minimum age duration and Apply filename allowlist internal to archive files settings to File Monitor Source.
Adds ZSTD compression support for Kafka, Confluent Cloud, and Amazon MSK Sources and Destinations.
Adds RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. labeling support to Google Cloud Chronicle API Destination.
Adds Directory batch size setting to S3, Azure Blob, GCS, and Minio Destinations on Cribl.Cloud.
Adds Zscaler Cloud NSS Source integration with expanded metrics.
13 details in Everything
└──▷ BREAKING ON UPGRADE
!The Azure Monitor Log Destination is deprecated; use Microsoft Sentinel Destination instead.
!The previous Age duration limit setting in File Monitor Source is renamed to Maximum age duration.
!Schema type selection in the UI for Confluent Cloud and Kafka Sources/Destinations is removed as schema detection is now automatic.
New on-demand NGAV scanning, Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. event source in SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. exceptions management in Cloud Security
Adds On-Demand Scanning capability to Next-Generation Antivirus for proactive malware detection across Windows, Linux, and macOS assets
Adds Microsoft Entra ID as a configurable event source in Data Connectors for SIEM (InsightIDR) to enrich alerts with identity context
Adds ability to manage exceptions for Infrastructure as Code (IaC) findings via the Controls & Compliance > Infrastructure as Code console view in Cloud Security (InsightCloudSec)
Adds PA_DBINSTANCE_EXTERNAL_SCANNER feature flag to enable External Scanning support for Database Instances in Cloud Security (InsightCloudSec)
Adds source document storage integration for Tenable, Qualys, CrowdStrike, and SentinelOne agents via feature flags in Cloud Security (InsightCloudSec)
+1 moreshow less
Adds AWS DevOps Guru Integration with DevOpsGuruInsightHarvester support in Cloud Security (InsightCloudSec)
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Rapid7 Agent (Insight Agent) v4.0.20.15 no longer supports Ubuntu 24.10, Open Suse LEAP 15.4, or Fedora 40
Tenable One Identity Exposure 3.77.15 adds granular time filtering for Indicators of Attack.
Introduces granular time filtering to Indicators of Attack, allowing specification of hour, minute, and second via the attacksFilters[0].dateStart and attacksFilters[0].dateEnd parameters in the URL.
1 detail in Everything
4 more releases in this issue
· 2025-11-03 → 2025-11-26
Tenable One Identity Exposure 3.108 adds IoE-specific explanation paragraphs and time-based Syslog alert URLs
Adds dedicated paragraphs for each Indicator of Exposure (IoE) reason in Dangerous KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. Delegation findings to explain reported issues and fixes more clearly.
Enables IOA_url key in Syslog alerts with a time-based URL linking directly to incident details in Tenable One Identity Exposure.
Tenable One ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. adds Top-Level Domain (TLDTLDThe rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type.) as a configurable source via the new UI.
Tenable One Identity Exposure 3.107 introduces renamed Dangerous KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. Delegation indicators and improved shadow credential descriptions for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. users.
Enhances accuracy and clarity of Dangerous Kerberos Delegation Indicators of Exposure by updating names such as Unsafe Permissions on Resource-Based Constrained Delegation (RBCD) Attributes and Dangerous Kerberos Unconstrained Delegation.
Updates descriptions for Shadow Credential indicators including Permitted Trustees List and Permitted Trustees List (by Group Membership) to provide clearer explanations.
DefectDojo 2.52.2 adds new ThreatMapper format support, expands fix_available fields across parsers, and improves Qualys CVE mapping.
└──▷ GET THIS VERSION
$ git clone --branch 2.52.2 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.52.2
Implements new ThreatMapper file format parser.
Adds fix_available field support to the pwn SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. parser.
Adds fix_available field support to the Kubeaudit parser.
Adds fix_available field support to the Dawnscanner parser.
Advances IBM App parser with fix_available field.
+3 moreshow less
Qualys XML parser now maps CVEs to Vulnerability IDs.
Adds VA vulnerability ID support via settings (VA vulnid).
Reimport now supports the Pro compute hash code method.
DefectDojo 2.52.1 makes social auth exceptions configurable and improves tag handling in importers.
└──▷ GET THIS VERSION
$ git clone --branch 2.52.1 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.52.1
Adds configurable social auth exceptions via settings.dist.py / local_settings.py, allowing operators to control how authentication errors are surfaced.
Improves tag handling in importers for more reliable tag imports.
Adds single-user session enforcement via the new feat(session): Single user session setting, preventing concurrent logins for the same account.
Switches the Docker Compose message broker from Redis to Valkey.
Merges the MobSF scanner into the core platform for mobile application security testing.
Adds a new MSRC (Microsoft Security Response Center) vulnerability ID parser.
Adds a new MAL vulnerability ID parser.
+10 moreshow less
Splits the GitHub Vulnerability Scan parser into separate SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. parsers for finer-grained findings categorization.
Adds the SOCIAL_AUTH_LOGIN_REDIRECT_URL variable to control post-login redirect destination for social auth providers.
Enables editing the found_by value on findings via the API.
Shows unique tool ID alongside hash_code in finding title elements in the UI.
Allows unlinking of a JIRA epic from an engagement in the UI.
Upgrades Docker images to use Python 3.13.
Adds automountServiceAccountToken support to the Helm chart.
Adds digest pinning support for image tags in the Helm chart.
Splits Helm image locations and tags for finer control in the Helm chart.
Adds cloudsql-proxy DRY configuration support to the Helm chart.
15 details in Everything
└──▷ BREAKING ON UPGRADE
!UNIQUE_ID_OR_HASH_CODE deduplication no longer stops after one candidate — instances relying on previous single-candidate behavior may see changed deduplication results on upgrade.
Edgescan adds audit trail for retest triggers, bulk asset selection for reports, and role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists..
Adds audit trail entry showing who triggered a retest or vulnerability test
Adds ability to bulk select assets when generating report
Enables authorization refactor with created and assigned roles to control resource access
3 details in Everything
1 more release in this issue
· 2025-11-06 → 2025-11-24
Intruder adds Google Cloud CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. checks, GregAI copilot, and Jira sync
Adds Google Cloud security posture managementCloud security posture managementCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. checks
Adds GregAI, an AI security analyst copilot to workflows
Adds bidirectional Jira synchronization with status viewing and linking
runZero 4.0.251118.0 adds optional Tenable Agent exclusion, certificate risk tracking, and new OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists./name constraint search keywords.
Tenable integration can now optionally exclude Tenable Agent data via the integration configuration.
Certificates now track a risk field that you can override and search.
Certificate search now supports new keywords for OCSP stapling and name constraints.
runZero 4.0.251114.0 adds NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. custom field overrides and TS date variants to the integration.
NetBox integration can now override asset information from custom fields.
NetBox integration now includes searchable TS variants of the Date and Date & Time fields.
runZero now merges third-party integration data into the most recently seen scanned asset.
Adds an associated vulnerabilities field to the certificates inventory that shows the count of certificate vulnerabilities related to the associated services
Adds a validity_period attribute to certificates in the Certificates Inventory that displays the certificate’s lifetime
New Use the assigned user's email address setting for Android EnterpriseAndroid EnterpriseA Google program that gives organizations APIs and management modes to enroll, configure, and enforce policy on Android devices through an EMM platform. managed configurations replaces $EMAILADDRESS dynamically.
└──▷ HOW TO FIND IT
Configure a managed configuration so the $EMAILADDRESS placeholder in Android app settings dynamically resolves to the currently assigned user's email address.
📍In Sophos Mobile Central, go to Android Enterprise › Setup page and enable Use the assigned user's email address.
1 more release in this issue
· 2025-11-03 → 2025-11-24
Fleet 4.76.0 adds Android software inventory, npm/JetBrains/VSCode-fork vulnerability detection, iOS lost mode, and more.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.76.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.76.0
└──▷ HOW TO FIND IT
Lock a lost iOS or iPadOS device into lost mode directly from the Fleet UI.
📍In the Fleet console, navigate to a host's details page for an iOS or iPadOS device, then select Actions › Lock device to enable lost mode.
Adds software inventory support for Android hosts.
Adds npm package discovery and vulnerability matching for macOS and Linux hosts.
Adds JetBrains IDE inventory and vulnerability detection for JetBrains plugins on hosts.
Adds software inventory support for VSCode fork extensions: Cursor, Windsurf, VSCodium, VSCodium Insiders, and Trae.
Adds Santa tables to fleetd.
+9 moreshow less
Enables software installation for iOS and iPadOS hosts during the setup experience.
Enables specifying VPP apps for automatic installation during ADE iOS and iPadOS enrollment.
Adds the ability to lock iOS and iPadOS devices via lost mode, including UI support for locking and unlocking.
Adds a configuration option to halt macOS setup experience if any software install fails.
Adds gigs_all_disk_space vital collection, storage, and UI rendering for Linux hosts.
Adds a new server config flag to specify the cleanup age for completed distributed targets, improving live query response times.
Adds idp source support to the device mapping API for manually setting IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. user mappings.
Enables testing new or edited policy queries via live query while in GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. Mode.
Improves performance of /api/latest/fleet/os_versions, /api/latest/fleet/vulnerabilities, and /api/latest/fleet/software/versions endpoints.
14 details in Everything
└──▷ BREAKING ON UPGRADE
!browser is deprecated in favor of extension_for in API responses and JSON/YAML outputs.
!The default name of Host Identity CA is changed to Fleet Host Identity CA, which may conflict with existing configurations referencing the previous default name.
!The platform field is cleared on all built-in labels via a migration, which may affect queries or workflows that relied on that field being set.
Munki 7.0.3 adds version_script pkginfo key for version detection and sidebar customization in Managed Software Center
└──▷ GET THIS VERSION
$ git clone --branch v7.0.3 https://github.com/munki/munki.git
# already have the repo? check out this version:$ git checkout v7.0.3
Adds the version_script pkginfo key to allow scripts that output software version numbers for install/upgrade decisions
Lets admins customize the Managed Software Center sidebar layout
Drops support for macOS 10.13 and 10.14
Removes support for the startosinstall installer_type, apple_update_metadata, profile, and appdmg installer_types, plus Adobe-specific installer_types and uninstall_methods
The repocheck tool scans Munki repos to identify pkginfo items using removed features
5 details in Everything
└──▷ BREAKING ON UPGRADE
!startosinstall installer_type is no longer supported; use stage_os_installer instead.
!Apple software updates are no longer installed by Munki; use System Settings or softwareupdate.
!apple_update_metadata installer_type is removed.
!The profile installer_type and configuration profile emulation are removed; use an MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. solution.
!The following Adobe installer_types are removed: AdobeSetup, AdobeUberInstaller, AdobeAcrobatUpdater, AdobeCS5AAMEEPackage, AdobeCS5PatchInstaller, AdobeCCPInstaller.
!The following uninstall_methods are removed: AdobeSetup, AdobeUberUninstaller, AdobeCS5AAMEEPackage, AdobeCCPUninstaller.
!appdmg installer_type is removed.
!suppress_bundle_relocation pkginfo key is no longer supported.
!Python middleware and repo plugins compatible with Munki 6 will not work with Munki 7; port to Swift or use the new protocols.
Adds Exclusion Windows feature to block automated policy activity during scheduled periods.
Adds Scheduled Windows menu item to display a table for managing exclusion windows
Enables creation of one-time or recurring exclusion windows in UTC time to associate with server groups
New API endpoints: API: Get Scheduled Window, API: Update Scheduled Window, API: Delete Scheduled Window, API: Get All Scheduled Windows, API: Create Scheduled Window, API: Is Window Active, API: Check Groups Window Status, API: Get Next Scheduled Window Dates by Group, API: Get Next Scheduled Window Dates by Device
1Password for iOS 8.11.20 adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login as fallback when biometric unlock fails
1Password for Windows 8.11.18 adds Unlock with device preset, third-party passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. support, and ADMX group policy configuration.
Adds Settings > Security UI to manage new unlock presets including Unlock with device
Enables using, saving, and syncing passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. across devices by installing the MSIX version as a third-party provider
Introduces group policy support via newly provided ADMX templates
1Password SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Manager Nov 2025 adds workflow archiving, Expensify provisioning/deprovisioning, and custom field insights
Adds Workflow archiving to declutter the workflow list while preserving historical data
Adds Expensify Provisioning and Deprovisioning support in Integrations
Enables Custom person date fields as inputs in Delay, SetVariable, and integration actions
Adds Workflow step descriptions visible in the editor and via the API
Adds flow run status indicators for terminated and completed-with-errors counts
+1 moreshow less
Allows selecting Custom person fields in the Breakdown by dropdown on the People insight report
New auto-unlock setting for 1Password.com and paste warnings for unlinked sites in browser extension 8.11.22-25.
Adds Settings > Security option 'Sign in to 1Password in the browser automatically' to control whether 1Password.com unlocks when the extension is unlocked.
Adds paste warnings in the browser extension when pasting into a website not linked to a 1Password item.
Adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login fallback when biometric unlock fails on iOS
Nudge Security is a SaaS security platform that discovers shadow IT assets, manages identity governance, and hardens security posture.
Nudge Security extends browser extension support to Firefox for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. & AI visibility.
Enables real-time monitoring of daily AI usage and access patterns in Firefox
1 detail in Everything
3 more releases in this issue
· 2025-11-04 → 2025-11-25
Nudge Security adds deployment coverage matrix and improved MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. docs for its browser extension.
Adds a deployment coverage matrix that displays total unique users detected by the extension, broken down by operating system and browser type.
Updates detection event descriptions with direct links to areas of the product where extension-related data can be found.
Improves MDM deployment instructions with troubleshooting documentation linking to the help center.
Stytch introduces SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Migration Gateway (beta) to route SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. callbacks between legacy auth and Stytch with no downtime.
└──▷ HOW TO FIND IT
Migrate SSO connections to Stytch without downtime by routing traffic through the new gateway.
📍Update your login domain DNS records to point to the provisioned SSO Migration Gateway endpoint, then enable Allow gateway processing for specific connections in the Stytch dashboard.
Ory Network v25.4.0 adds optional recovery ID, session in webhook hooks, Google SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider./SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. onboarding, and perf boosts.
The session object is now included in the webhook body context when using the After Hook feature
Added support for connecting Google Workspace to automatically provision users via SCIM through the onboarding portal
Feature toggling for onboarding portal links allows enabling or disabling specific onboarding features such as SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. and Directory Sync (SCIM)
Ory v25.4 adds Hydra device flow/OAuth 2.1OAuth 2.1A consolidated draft of the OAuth authorization framework that merges OAuth 2.0 with its most important security BCP updates, dropping unsafe flows so tools can delegate user access without handling credentials directly. discovery, Kratos SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. passwordless/SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. import/Keto encrypted pagination and new migration CLI
Hydra: Adds Device Authorization GrantDevice Authorization GrantAn OAuth 2.0 flow for devices that lack a browser or keyboard: the device gets a short code, displays it to the user, and polls the authorization server while the user approves on a separate device. (RFC 8628RFC 8628An IETF standard defining the OAuth 2.0 Device Authorization Grant, letting input-constrained devices obtain tokens by having the user authenticate on a separate device with a browser.) support for headless clients
Hydra: Serves OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..1 discovery at /.well-known/oauth-authorization-server
Hydra: Adds consent-chain revocation by consent challenge ID to revoke entire token chains
Kratos: Adds passwordless login and registration via SMS
Kratos: Allows delivery of recovery codes by SMS
+8 moreshow less
Kratos: Adds support for importing SAML credentials (Enterprise/Network only)
Kratos: Adds Line v2.1 OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. provider support
Kratos: Emits LoginStarted and RegistrationStarted events
Kratos: Introduces new courier events CourierMessageAbandoned and CourierMessageDispatched
Kratos: Replaces old migration CLI with new kratos migrate sql up|down|status commands
Kratos: Adds support for Android WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. origins for passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices.
Keto: Adds encrypted page tokens for pagination to prevent plaintext state exposure
Oathkeeper: Consolidates Oathkeeper into the Ory monorepo and adopts vendored ory/x
13 details in Everything
└──▷ BREAKING ON UPGRADE
!Sessions API: The x-total-count header has been removed from GET /admin/sessions
!Account linking: Failed OIDC account linking flows now return HTTP 400 instead of 200 OK
!Verification flow: The show_verification_ui element is only included if the hook is explicitly configured
!OIDC registration: Failing fields are now placed in the default node group instead of oidc; legacy behavior can be restored with feature_flags.legacy_oidc_registration_node_group=true
Passbolt 5.7.0 adds secret history with admin config flags, new CLI commands for users/mfa, and browser extension UI improvements.
passbolt user_index command to list all users
passbolt user_promote_to_administrator command to promote users to administrators
passbolt mfa_user_settings_disable command to disable MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for a given user
secret_history_enabled admin toggle in the administration workspace to enable secret history visibility
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The passbolt truncate_account_recovery_tables command now requires --username and --fingerprint arguments (validation can be skipped with --no-verify)
SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provider now supports custom schema data
└──▷ GET THIS VERSION
$ git clone --branch version/2025.10.2 https://github.com/goauthentik/authentik.git
# already have the repo? check out this version:$ git checkout version/2025.10.2
Keycloak 26.6.0 adds Workflows (YAML automation), JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. Auth Grant, Federated Client Auth, Org Groups, Vault SPISPISerial Peripheral Interface, a synchronous communication bus standard used to connect microcontrollers to sensors, flash memory, and other peripherals at short range; cyber tools use it to read or write firmware on embedded devices. secrets lookup, and zero-downtime defaults.
Adds workflows subsystem allowing administrators to automate realm tasks using YAML-defined logic triggered by events, conditions, or schedules
Promotes JWT Authorization Grant (RFC 7523RFC 7523An IETF standard that defines how a JSON Web Token (JWT) can be used as a credential to request an OAuth 2.0 access token, letting a cyber tool authenticate to an API without exchanging a username and password at runtime.) to supported status, enabling external-to-internal token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. via externally signed JWT assertions
Promotes Federated client authentication to supported status for clients leveraging existing credentials from trusted issuers, including Kubernetes Service Accounts and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. providers
Adds Organization groups feature supporting isolated group hierarchies per organization with Identity Provider mappers for automated assignment based on external claims
Adds new FGAP scope manage-membership-of-members to enable user-side bridge evaluation for group membership permissions based on current user memberships
+5 moreshow less
Enables secrets lookup for clients via the Vault SPI, allowing management and retrieval of client secrets through the standard SPI interface
Adds optional Enable LDAP password policy setting in LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. advanced settings to prompt LDAP users to update passwords when the backend indicates a mandatory change
Promotes Zero-downtime patch releases to supported status and enables them by default for rolling updates within the same major.minor release stream
Adds new CLI options for database configuration including TLS setup, connection timeouts, transaction timeouts with production defaults, and UTF-8 encoding verification at startup
Enables graceful shutdown of the HTTP stack to prevent error responses during rolling updates or configuration changes
Acronis Cyber Protect combines backup, disaster recovery, and endpoint protection in one platform for businesses and managed service providers.
Acronis Cyber Protect 2025-11 adds Seagate archival storage, M365/Workspace deduplication, EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. threat hunting, Proxmox/EL9 DR, and RMM roles
└──▷ HOW TO FIND IT
Run custom threat-hunting queries on EDR telemetry using XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. and save them for reuse by partners.
📍In the Protection console, navigate to Acronis EDR › Threat Hunting, enter your XQL query in the Event Search box, select the time frame, and click Save.
Deploy tailored security posture for Microsoft 365 customers using customizable baseline templates from Intune and other providers.
📍In the Protection console, go to Acronis RMM › Security Posture Management, select Customizable Baseline Templates, and deploy one of the 40+ available templates or create a new one.
Enable agentless disaster recovery protection for Proxmox virtual machines with site-to-site VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. connectivity.
📍In the Protection console, create a new Disaster Recovery plan, select Proxmox VMs as the source, configure the failover settings, and establish the OpenVPN appliance connection.
Adds Archival Storage via Seagate for long-term retention of infrequently accessed files with immutable storage capabilities.
Adds In-Archive Deduplication for Microsoft 365 (Teams, SharePoint) and Google Workspace to reduce backup storage costs.
Adds Acronis EDR: Threat Hunting with Event Search – General Availability for running custom XQL queries on EDR telemetry.
Adds Acronis EDR: URL Filtering – Blocking Page, HTTP/2 and QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. Support via a new extension for Google Chrome.
Adds Acronis RMM: Customizable Baseline Templates in Microsoft 365 Security Posture Management with 40+ ready-to-use baselines.
+4 moreshow less
Adds Acronis RMM: Built-in RMM operator role for remote monitoring and management tasks.
Disables Immutable storage only through support contact to prevent tampering.
Adds Disaster Recovery Support for Proxmox VMs with agentless backup and failover capabilities.
Adds Disaster Recovery Support for Red Hat Enterprise Linux 9.x workloads.
Commvault Cloud is a backup, recovery, and cyber-resilience platform for hybrid, multi-cloud, and SaaS workloads.
Commvault Cloud November 2025 adds Air Gap Protect for GCP, Monday.com vault support, and new login alerts
Adds Air Gap Protect support for Google Cloud regions with immutable, isolated data copies for Frequent Access and Infrequent Access tiers
Validates Monday.com protection with Unified Data Vault via a backup tool in the Commvault software store
Alerts users and administrators on Command Center or API login from a new device, including user name, device details, IP address, login time, and location
Enables backup and restore of free-form tags for OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. instances and volumes
Adds support for VMware vSphere 9 in Commvault Virtual Server Agent (VSA)
+4 moreshow less
Adds Proxmox VE 9 compatibility to Commvault VSA
Allows choosing a Backup Gateway Group directly in Azure DB PaaS configuration wizards
Adds Managed Identity support for Azure SQL Managed Instance storage connections
Adds GCP Service Account support for MySQL and PostgreSQL backups on Google Cloud
Druva is a SaaS data protection platform that backs up enterprise workloads, endpoints, and SaaS applications and restores them after ransomware.
Druva releases eDiscoveryeDiscoveryA legal process for identifying, collecting, and producing electronically stored information in response to litigation or investigation; cyber tools integrate with it to extract and preserve forensic evidence in legally defensible formats. Download client v2.3.0 with strengthened cryptographic foundations
14 more releases in this issue
· 2025-11-03 → 2025-11-29
Druva adds Azure SQL job management APIs and system database backup support for on-prem SQL on Azure VMs
Adds Azure SQL job management APIs (On-demand backup, On-demand restore, Cancel backup job, Cancel restore job) for programmatic control of backup and restore operations
Enables System Database Backups (master, msdb, model) for SQL Server on Azure VMs with automatic encryption and full instance recovery including logins and jobs
Supports backup and restore of Nutanix Cloud Clusters (NC2) on AWS Public Cloud via new proxy version 6.3.9-794364
Adds Oracle RMAN multi-section backup and restore support in agent 7.0.6-800277 for parallel large datafile protection
Extends cloud storage region support to AWS GovCloud (US) East (us-gov-east-1)
+1 moreshow less
Introduces End of Support (EOS) field on Agents and Proxies page showing counts of agents/proxies near EOS and unsupported OS devices
Veeam Kasten is a Kubernetes-native platform for backing up, restoring, and migrating containerized applications and their persistent data.
Kasten K10 8.0.14 adds vault.mountPath Helm value for custom HashiCorp Vault auth mount paths and a location profile deletion warning.
└──▷ USE IT
Override the default Vault Kubernetes auth mount path when K10 is configured to use a non-standard Vault auth mount — for example, a mount at kubernetes-prod instead of the default kubernetes.
yaml
vault:
mountPath: "kubernetes-prod"
1 more release in this issue
· 2025-11-18 → 2025-11-26
Kasten K10 8.0.13 adds a PasskeyPasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. Management dashboard page, OpenShift 4.19 support, and vSphere CSICSIAn ambiguous acronym spanning Container Storage Interface, Crime Scene Investigation, and other expansions — without more context about which domain this tool operates in, a reliable definition cannot be given. export without an Infrastructure Profile.
└──▷ HOW TO FIND IT
Create or rotate a HashiCorp Vault-backed passkey for backup encryption via the new centralized Passkey Management interface.
📍In the Kasten Dashboard, go to Settings › Passkey Management, click Create Passkey, select HashiCorp Vault integration as the passkey type, and complete the vault configuration to activate the new passkey.
Adds a Passkey Management page in the Settings section of the Kasten Dashboard for centralized management of passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. used to encrypt backup data, supporting Passphrase-based passkeys, AWS Key Management ServiceKey Management ServiceA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves., and HashiCorp Vault integration.
Adds support for snapshot and filesystem mode export of persistent volumes provisioned by the vSphere CSI driver without requiring a vSphere Infrastructure Profile.
Extends backup policy VirtualMachine name filters to discover and protect hot plugged volumes.
Introduces support for ED25519 certificates.
Integrates Go Cryptographic Modules to maintain compliance with FIPS 140-3FIPS 140-3A US federal standard, maintained by NIST, that defines requirements for cryptographic modules used in government systems. Cyber tools target it to satisfy procurement mandates requiring validated crypto. standards.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Support for OpenShift 4.15 has been removed; clusters running OpenShift 4.15 will no longer be supported.
Kopia is an open-source backup tool for Windows, macOS, and Linux with incremental snapshots, client-side end-to-end encryption, compression, and deduplication, with both a CLI and a GUI.
Client Connector 4.7/4.8 adds OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. auth support and PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. download over tunnel; 4.7+ accepts # in usernames.
Install Zscaler SSL Certificate config now supports installing the latest Root CA and removing existing certs for SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection
Supports using one-time passwords (OTPs) for customers with Authentication Service tenants
Download forwarding PAC file through the tunnel when in Tunnel mode instead of directly
Accepts the hash (#) character in the partner tenant username
VPN Gateway Bypass updates to optionally not bypass subdomains for FQDNs
5 details in Everything
33 more releases in this issue
· 2025-11-03 → 2025-11-26
Updated RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 GCP image available for ZPA Private Service Edge.
ZPA adds systemd journal log retrieval from the Admin Portal, usage metric notifications for PCCs/Nets, and limited SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider./SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. microtenant creation.
Enables retrieval of systemd journal logs for App Connectors, ZPA Private Service Edges, Private Cloud Controllers, and Network Connectors directly from the ZPA Admin Portal
Adds usage metric notifications (Bandwidth, CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware., Disk, File Descriptors, Source Port, System Memory limits) for Private Cloud Controllers and Network Connectors via Notifications and events diagnostics services
Supports creation of Microtenants using SAML attributes, SCIM attributes, or SCIM group criteria in Limited Availability
Workflow Automation adds custom workflow builder and DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. incident column expansions for Email and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. sources.
Adds drag-and-drop custom workflow creation via the Add Custom Workflow button on the Workflows page
Adds Triggered Recipients column to Incidents table for Source DLP type Email
Adds External Recipients and Internal Recipients columns to Incidents table for Source DLP type SaaS Security
Adds External, Internal, and Triggered Recipients attributes as filter options in the Filters window
Expands Incident export CSV file with External, Internal, and Triggered Recipients columns
+1 moreshow less
Redesigns Violation Details and Files Policy windows to show Triggered and Non-Triggered Engines and Dictionaries sections
AWS account/group management APIs and limited-availability JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. auth added to ZBC
Adds GET /publicCloudInfo, POST /publicCloudInfo, GET /publicCloudInfo/cloudFormationTemplate, GET /publicCloudInfo/count, POST /publicCloudInfo/generateExternalId, GET /publicCloudInfo/lite, GET /publicCloudInfo/supportedRegions, GET /publicCloudInfo/{id}, PUT /publicCloudInfo/{id}, DELETE /publicCloudInfo/{id}, and PUT /publicCloudInfo/{id}/changeState endpoints for AWS account CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. and metadata
Adds GET /discoveryService/workloadDiscoverySettings and PUT /discoveryService/{id}/permissions endpoints for workload discovery settings management
Adds GET /accountGroups, POST /accountGroups, GET /accountGroups/count, GET /accountGroups/lite, GET /accountGroups/{id}, PUT /accountGroups/{id}, and DELETE /accountGroups/{id} endpoints for AWS account group CRUD
Enables JSON Web Token (JWT) authentication for Zscaler Cloud & Branch Connector workloads, with sessions logged in Web Insights using the JWT user ID
ZIA adds Endpoint DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. channels (Clipboard/File Access), IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. PSE/JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. auth, Enhanced US Driver's License dict, and GitHub SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. controls.
Adds Application File Access and Clipboard as channels in Endpoint DLP policy rules to detect and block sensitive data at rest and paste operations on Windows endpoints
Adds the ability to define multiple removable storage devices mapped to specific users within a single Device Control Removable Storage rule, with CSV bulk import support
Introduces configurable Endpoint Data Scan - End User Report for local sensitive data visibility on Windows endpoints
Adds granular Endpoint DLP Configurations options: exclude file systems/folders, skip high-volume application files in continuous classification, disable OCROCROptical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels., and per-channel application exclusions
Adds Analytics > Endpoint Data Scan > Inventory > Applications page to view installed software, running processes, and libraries on endpoints
+13 moreshow less
Adds Analytics > Endpoint Data Scan > Device Investigation page for real-time endpoint health and detected file details
Enables Sensitive Information Index Document Match (IDM) via Endpoint DLP context menu for parallel detection against indexed documents (Limited Availability)
Adds new predefined DLP dictionaries for Endpoint DLP: CNPJ Number (Brazil), IBAN, National Economic Registry Number (Poland), and Passport Number (Asia)
Adds 15-byte prefix/suffix context to Endpoint DLP triggers visible in Incident Receiver, Zscaler Workflow Automation, and Email Notifications
Supports Proximity Length field on predefined DLP dictionaries for Endpoint DLP engines when Confidence Score Threshold is High
Adds Last Modified User, Last Shared User, and Last Shared On filters/columns in SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Insights Logs for file applications
Adds %s{last_edit_user}, %s{last_share_user}, and %s{last_shared_on} fields to NSS Feeds Output Format for SaaS Security logs
Enhances IPv6 infrastructure to receive traffic directly from remote users via Zscaler Client Connector when Enable IPv6 Resolution for Zscaler Domains is enabled in the Portal
Supports IPv6 traffic in Private Service Edge via Zscaler Client Connector or PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. files when Enable IPv6 Resolution for Zscaler Domains is enabled
Enables JWT authentication for Cloud & Branch Connector workloads, configured on the Advanced Settings page and managed via Authentication Service Admin Portal
Adds JWT Auth for Workload field on the Tenant Details page (Tenant > Tenant Details page > Special Settings) in Management Portal for Partners to enable JWT auth for tenants
Replaces legacy Driver's License (United States) dictionary with Enhanced US Driver's License dict, exposing individual state sub-dictionaries configurable via Confidence Score Threshold and Proximity Length
Increases SSPM controls for GitHub in Advanced SSPM by adding eleven new controls
ZIA adds Gen AI prompt configs for Claude/Mistral, DNS Control EUNs, and MIP labels in SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. remediation.
Adds enableClaudePrompt and enableMistralAIPrompt Boolean fields to the AdvancedUrlFilteringCloudAppOptions model in the /advancedUrlFilterAndCloudAppSettings API to enable Gen AI prompts for Claude and Mistral
Adds a new End User Notification (EUN) page option within DNS Control Policy to display blocking notifications hosted by Zscaler
Allows applying MIP labels as manual remediation actions for OneDrive and SharePoint incidents in SaaS Security Assets
Cloud & Branch Connector introduces Sublocation Scopes to group AWS workloads and apply granular ZIA policies.
Adds Sublocation Scopes to Cloud & Branch Connector Admin Portal, allowing grouping of workload traffic into sublocations at VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Endpoint, VPC, Account, or Namespace levels in AWS
Enables policy lookup distinction for multiple workloads sharing the same source IP address space using Sublocation Scopes
ZIA adds GitHub SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. controls, DNS EUN customization, sublocation scopes, and Traffic Capture for NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. APIs
GET /trafficCaptureRules, POST /trafficCaptureRules, PUT /trafficCaptureRules/{ruleId}, DELETE /trafficCaptureRules/{ruleId}, GET /trafficCaptureRules/count, GET /trafficCaptureRules/order, and GET /trafficCaptureRules/ruleLabels endpoints added to the Cloud Service API for Traffic Capture policy management.
Adds the subLocScopeEnabled, subLocScope, subLocScopeValues, and subLocAccIds attributes to the Location and LocationLite models in the /locations API endpoints to support sublocation scopes.
Standalone Traffic Capture policy page added at Policy > Traffic Capture for granular control of triggers, sampling, and connection collection limits.
Traffic Capture settings page at Administration > Traffic Capture now allows obfuscation of captured data information and S3 bucket configuration.
DNS Control policy now supports a hosted End User Notification (EUN) page with customizable organization name, logo, and message.
+1 moreshow less
Administration > Location Management > Locations > Add Sublocation window adds the Scope, Account, Namespace, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware., and VPC Endpoint fields for defining sublocation scope types.
Client Connector 4.7 adds Business Continuity, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. forwarding, step-up auth, and FIDO2FIDO2The open standard behind passkeys and hardware security keys, where a website checks a signature from the user's device instead of a password. Because the key is bound to the site, phishing pages cannot use it. hardware key support.
reconnectT2OnWake config parameter added to Application & Custom settings for quicker reconnect after sleep
Adds Business Continuity support in Zscaler Private Access (ZPA) to maintain app access during cloud availability events
Adds IPv6 traffic forwarding from IPv6-only macOS devices to ZIA and ZPA
Adds step-up authentication for conditional access to ZIA and ZPA based on dynamic requests
Adds authentication with FIDO2-compliant hardware keys via a pop-up browser in Authentication Service
AWS Account and Group API endpoints added; JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. authentication enabled for connector workloads.
Adds GET /publicCloudInfo, POST /publicCloudInfo, and related /discoveryService APIs to manage AWS accounts and groups programmatically
Enables JSON Web Token (JWT) authentication for Zscaler Cloud & Branch Connector workloads via the ZIA Admin Portal
ZIA adds CC search support, JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. auth for Connectors, enhanced US DL DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dicts, and new CASBCASBA Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. REST endpoints
Adds Enable Creative Commons Search Results option to Policy > URL & Cloud App Control > Advanced Policy Settings to filter search results by license
Exposes two new API endpoints for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security: GET /casbTenant/scanInfo and GET /casbTenant/validate/status/{tenantId} to retrieve scan configuration and validation status
Adds JWT Auth for Workload field in Management Portal for Partners > Tenant > Tenant Details page > Special Settings to enable JWT auth for tenant connectors
Introduces Enhanced Driver's License (United States) predefined DLP dictionary with individually configurable state sub-dictionaries accessible via Administration > DLP Dictionaries & Engines
Agent Manager Status and Version now viewable in the Agent table for Microsegmentation.
Agent Manager Status and Agent Manager Version fields added to the Agent table
App Connector updated Red Hat Enterprise Linux 9 images deployed for GCP and Azure
OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. enrollment support enabled for App Connectors on RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9
Zscaler Client Connector 4.2 adds Z-Tunnel 2.0 bypass options, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. exclusions, and health metrics collection.
Adds two new Z-Tunnel 2.0 protocol bypass options: Redirect Web Traffic to Zscaler Client Connector Listening Proxy and Use Z-Tunnel 2.0 for Proxied Web Traffic.
Adds ZIA posture profile device trust levels configuration capability that displays in the Zscaler Client Connector Registered Device Details page.
Enables configuration of early reauthentication notification for end users before ZPA applications expire.
Adds IPv6 inclusions and exclusions support for Z-Tunnel 2.0.
Supports using a preferred port to enable Zscaler Client Connector to ZIA communication.
+6 moreshow less
Increases supported ZPA Application Segments to up to 50K.
Adds ability to exclude traffic from being sent to specific DNS servers.
Enables configuration of fallback options on Z-Tunnel 2.0 establishment failure.
Enhances strict enforcement feature to block all ports and protocols.
Supports DNS SRVSRVA DNS record type that advertises the hostname and port for a specific service, letting clients discover endpoints without hardcoded addresses. (DNS service record) app scaling for up to 50,000 ZPA apps.
Adds support for the collection of Health Metrics on devices to allow for diagnostics and to proactively identify issues.
ZIA adds DNS End User Notifications and MIP label remediation for OneDrive/SharePoint
Adds DNS End User Notification capability in DNS Control Policy to show a hosted notification page with custom logo and message when access is blocked.
Adds option to apply a MIP Label as a manual remediation action for file sharing applications OneDrive and SharePoint from the SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Assets with Incidents page.
ZIA adds MIP label remediation for SharePoint and sublocation scopes for AWS workloads
Apply MIP labels as manual remediation actions for OneDrive and SharePoint in SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Assets
Define sublocation scopes (Scope, Account, Namespace, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware., VPC Endpoint) to map AWS Cloud Connector workload traffic
ZIA adds Last Modified/Shared user tracking in Insights Logs and NSS Feeds for DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. incidents.
Adds Last Modified User and Last Shared User filters to the SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Insights page
Adds Last Modified User, Last Shared User, and Last Shared On columns to the Assets With Incidents table
Adds %s{last_edit_user}, %s{last_share_user}, and %s{last_shared_on} fields to NSS Feeds SaaS Security log output
DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds data posture policies for multiple cloud/data platforms, new scan support for Azure File Shares and Hyper-V, and AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. condition operator updates
Adds Azure File Shares scanning support over SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. and NFS to discover and classify sensitive data
Adds AWS Databricks data collection and posture scanning capability
Adds NotPrincipal, ArnNotLike, and IfExists AWS IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. condition operators for managing access to scan data
Adds Hyper-V deployment mode for the on-premises scanner
Adds NFS protocol support for adding on-premises file servers in addition to SMB
+1 moreshow less
Renames Over-Privileged Access posture label to Privileged Access and adds new posture labels for AWS Databricks, Azure OpenAI, and Azure AI Foundry Hub resource types
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The posture label Over-Privileged Access is renamed to Privileged Access
New AWS account APIs and JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. authentication for Cloud & Branch Connector.
Adds API endpoints GET /publicCloudInfo, POST /publicCloudInfo, GET /publicCloudInfo/cloudFormationTemplate, GET /publicCloudInfo/count, POST /publicCloudInfo/generateExternalId, GET /publicCloudInfo/lite, GET /publicCloudInfo/supportedRegions, GET /publicCloudInfo/{id}, PUT /publicCloudInfo/{id}, DELETE /publicCloudInfo/{id}, PUT /publicCloudInfo/{id}/changeState for AWS account management.
Adds API endpoints GET /discoveryService/workloadDiscoverySettings and PUT /discoveryService/{id}/permissions for workload discovery settings.
Adds API endpoints GET /accountGroups, POST /accountGroups, GET /accountGroups/count, GET /accountGroups/lite, GET /accountGroups/{id}, PUT /accountGroups/{id}, DELETE /accountGroups/{id} for AWS account group management.
Enables JSON Web Token (JWT) authentication for Zscaler Cloud & Branch Connector workloads, logged in Web Insights with the user ID from the JWT.
Adds JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. auth for ZIA connectors and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Scan API endpoints.
└──▷ USE IT
Query the scan status of a SaaS tenant programmatically.
api
GET /casbTenant/validate/status/{tenantId}
Enables JWT Authentication for Zscaler Cloud & Branch Connector workloads to replace legacy methods
Adds JWT Auth for Workload field on the Tenant Details page in Management Portal for Partners to enable JWT per tenant
Exposes GET /casbTenant/scanInfo endpoint to retrieve SaaS Security Scan Configuration and validation status
DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds posture policies for AWS/Azure/GCP/Snowflake/Oracle/Databricks, scan support for Azure File Shares/Hyper-V/NFS and new IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. condition operators.
Adds data posture policies for AWS, Azure, GCP, Snowflake, On-Premises Oracle, and Databricks to detect sensitive data exposure vulnerabilities
Adds scanning support for Azure File Shares over SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. and NFS protocols
Adds discovery and classification capabilities for AWS Databricks workspaces and accounts
Supports NotPrincipal, ArnNotLike, and IfExistsAWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. condition operators in scan configurations
Adds Hyper-V deployment mode for the on-premises scanner
+1 moreshow less
Adds NFS protocol support for on-premises file servers alongside existing SMB
ZIA adds Enhanced US Driver's License DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionary with per-state sub-dictionary support
ZPA Notifications service adds event triggers for Network Connectors, enabling alerts on connector lifecycle and health states.
Adds support for configuring notifications on specific events for Private Access Network Connectors, including Last Component Disconnected, Upgrade Complete, Upgrade Failed, Outdated Component Manager Version, Provisioning Key Usage Exceeded, Enrollment Completed, Enrollment Failed, Enrollment Certificate Expired, Control Connection Disconnected, and CPU Starvation.
Expands the Notifications service capability to include Network Connector event monitoring for both the private.zscaler.com and zpatwo.net cloud platforms.
Zscaler Client Connector 4.4 for iOS adds Device Groups, iCloud Private Relay controls, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. integration, and higher ZPA segment limits
Supports Device Groups and the assignment of service entitlements based on device posture.
Includes support to show the Serial Number under Enrolled Device details.
Includes support for Disabling iCloud Private Relay in App Profiles.
Includes support for up to 50k ZPA Application Segments.
Supports Authentication Service integration for Single-Sign On (SSO), Device Posture, Authentication Service as IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., Strict Enforcement, and Multi-cloud selection.
The release introduces a new dashboard feature within the Zscaler SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. platform.
Adds the Violation Tickets Dashboard in the Zscaler Security Operations (SecOps) platform for visibility into violation ticket identification, management, and resolution
Headscale v0.27.1 adds custom-timestamp node expiry and improves exit node ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. enforcement.
└──▷ GET THIS VERSION
$ git clone --branch v0.27.1 https://github.com/juanfont/headscale.git
# already have the repo? check out this version:$ git checkout v0.27.1
Supports expiring nodes with a custom timestamp, enabling precise lifecycle control over node access.
Distinguishes subnet routes from exit node routes internally, improving ACL granularity for exit node visibility.
VNS3 6.7.8 adds optional plugin recovery control via new recover_plugins API argument and UI toggle
└──▷ USE IT
Restore a config snapshot without rebuilding plugin instances to speed up the operation when plugins are managed externally or do not need state preservation.
shell
curl -X PUT https://<controller-ip>/api/v1/snapshots/<snapshot_id>/restore -H 'Content-Type: application/json' -d '{"recover_plugins": false}'
Restore a config snapshot without rebuilding plugin instances to speed up the operation when plugins are managed externally or do not need state preservation.
📍In the VNS3 UI, navigate to Snapshots › Restore [Snapshot Name] and uncheck the recover_plugins checkbox before clicking Restore.
Netskope R132 adds URP for unmanaged devices, EB license sync via IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., transaction event streaming client, and NG API DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. for Slack Canvas.
Universal Reverse Proxy (URP) extends reverse proxy to Microsoft and Google Suite applications, enforcing inline constraints on unmanaged devices with granular access control.
Enterprise Browser now synchronizes license status automatically with IdP group membership via SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave., enabling instant security offboarding and automated onboarding.
New Event Streaming Client (a Docker component) allows streaming Transaction Events to SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. via syslog configuration.
Next Generation API Data Protection for Slack Enterprise now supports DLP and threat protection scanning for attachments within Slack Canvas.
New Browser Configuration Policies allow defining a tenant-wide baseline security posture for Enterprise Browser users, covering Developer Tools, Incognito Mode, Local Password Manager, Notifications, Pop-ups, and Audio/Video Input.
+11 moreshow less
Enterprise Browser for Private Apps (EB + NPA Integration) allows accessing private apps via internal hostnames/IPs without DNS complexity and applies browser-level DLP controls to those sessions.
Custom Categories REST API V2 endpoint api/v2/profiles/customcategories is now available for new tenants, supporting the migration from legacy MariaDB profiles.
User notification templates now support additional variables including source IP, destination IP, groups, OU, POP locations, Malware Name, Transaction ID, HTTP Referer, URI Path, and URI Port.
Real-time Protection policies for Any Web Traffic can now be created without source criteria or profiles, with support for Upload/Download activities when threat protection is enabled.
Seven new granular URL categorization subcategories are available for Generative AI: Tools and Stores, Platform, Content and Multimedia, Conversation, Meeting, Code, and Writing.
Primary Category variable {{x-category}} is now available in user notification templates, replacing or augmenting the existing {{NS_CATEGORY}}.
Netskope Private Access (NPA) supports source IP (Egress IP) as a criterion in policies for applications steered via the Client access method.
Enhanced SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications.Findings UI provides better user experience and accessibility, including visibility into rules created/modified/deleted in the last 30 days and rule change history for up to 2 years.
Ten new predefined SSPM rules are added covering GitHub, Slack Enterprise, Workday, Salesforce, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. categories, and various security domains.
Traffic Steering pages for IPSec and GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. Sites now display release deployment day for Primary and Failover POPs to aid in resilience planning.
Netskope Client supports Red Hat Enterprise Linux 9.4, Omnissa Horizon (Beta), ChromeOS 141, and Embedded Mini-browser Support for Captive Portal Authentication on Windows.
Bytebase 3.12.1 adds stdout audit logging, AWS cross-account IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. auth, GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. Service Agent role, and BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. dry-run SQL validation.
└──▷ GET THIS VERSION
$ git clone --branch 3.12.1 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 3.12.1
└──▷ HOW TO FIND IT
Use the dry-run feature in the Bytebase SQL Editor UI for BigQuery to check syntax without executing changes.
📍In the Bytebase console, open the SQL Editor for a BigQuery database, paste your query, and click Dry Run.
Worksheets gain folder-based organization with nested folders, drag-and-drop reordering, and inline actions (rename, star/unstar, sharing)
Project-level data query policies are now available (previously restricted to workspace level only)
Cross-account AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. authentication is supported for database connections
GitOps Service Agent role added to Bytebase RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for automated CI/CD workflows
BigQuery SQL Editor now supports dry-run execution to validate queries before running them
5 details in Everything
1 more release in this issue
· 2025-11-06 → 2025-11-20
Bytebase 3.12.0 adds PostgreSQL State-based GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. workflow, IdP-initiated SSOIdP-initiated SSOA single sign-on flow where the identity provider redirects an already-authenticated user directly to a service provider without the service provider first requesting authentication, removing the need for a separate login prompt., and direct SQL Editor export.
└──▷ GET THIS VERSION
$ git clone --branch 3.12.0 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 3.12.0
Add support for IdP-initiatedIdP-initiatedA SAML or OIDC login flow where the identity provider starts the session and pushes an assertion to the service provider without the user first requesting access, removing the SP-side redirect step.SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. flow.
Allow direct data export in SQL Editor for users who can run the query — no approval issue is created. The approval flow still applies to export requests submitted through Data Export Center. You can also disable data export at the workspace level, so that SQL Editor queries cannot be exported directly by default.
Support data export for multi-statement queries in SQL Editor.
Update APP_IM configuration format in API and UI.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Remove identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. permissions from the Workspace DBA role.
!Remove support for URL-based secret retrieval via URL template format.
!Deprecate changelist feature.
!Update APP_IM configuration format in API and UI.
Cyera introduces Access Trail for comprehensive visibility into human and AI data interactions.
Delivers new Access Trail capability providing auditable, context-rich activity trails correlating user/agent identities with data sensitivity, location, and regulatory context.
1 detail in Everything
2 more releases in this issue
· 2025-11-13 → 2025-11-19
Cyera introduces the Omni DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Policy Tree for graphical policy visualization.
Adds a new graphical view in Omni DLP to visualize policy rules and conditions.
Teleport v18.4.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Zero-Trust HTTP transport, tsh scp cross-host support, env0 join method, and bot instance management improvements
└──▷ GET THIS VERSION
$ git clone --branch v18.4.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v18.4.0
role.spec.allow.request.reason.prompt allows configuring custom reason prompts for Access Requests per role/resource
New env0 join method supports joining teleport instances within Env0 workflows
Supports MCP Zero-Trust Access over HTTP transport protocols in addition to stdio
Added a new OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. join method that does not require IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies
tbot now supports teleport-update for automated updates
Adds tsh mcp config/connect custom headers, Windows Desktop KDC DNS discovery, and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. creds in tctl AWS Identity Center plugin
└──▷ GET THIS VERSION
$ git clone --branch v18.3.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v18.3.1
Adds support for custom HTTP headers in tsh mcp config/connect commands when connecting to streamable-HTTP MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers
Enables the Windows Desktop service to automatically discover the KDC server address via DNS lookup
Allows setting OIDC Integration credentials directly within the tctl aws identity-center plugin installer flow
Supports specifying topologySpreadConstraints in the teleport-kube-agent Helm chart for pod placement control
Enables summarization and metadata generation for encrypted session recordings, storing these assets in encrypted form
Risk Ledger adds contact email field for unclaimed supplier connections to boost invite acceptance
Adds the ability for Clients to specify a contact email when initiating a connection to an unclaimed supplier profile, enabling immediate invite delivery.
Upgrades the underlying email delivery system across the platform to improve deliverability of invites and reminders.
Adds admin control for user self-validation flows and CHF currency support
└──▷ GET THIS VERSION
$ git clone --branch v3.7.2 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.7.2
└──▷ HOW TO FIND IT
Enable self-validation workflows for team members in the admin panel.
📍Navigate to Admin › Settings › Workflow permissions and enable Allow user self-validations.
Admins can allow users to create self-validation workflows via the settings UI
1 detail in Everything
7 more releases in this issue
· 2025-11-01 → 2025-11-29
Adds outgoing webhooks for event notification, allows filtering past task occurrences, and makes ref_id editable for attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately.
└──▷ GET THIS VERSION
$ git clone --branch v3.7.1 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.7.1
feat(epic): outgoing webhooks adds the ability to send events via outbound webhooks
feat: be able to filter past task occurences and have it as default behaviour adds a filter for past occurrences with it enabled by default
feat(ref_id editable) ref_id is now editable for attack paths, allowing direct modification of the reference ID in the UI
Shows creation date in the exceptions list to help identify when an exception was granted
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Task occurrences are now linked to evidence revisions instead of the evidence itself, requiring a migration of previous work via the UI.
CISO Assistant v3.7.0 adds ANSSI AD checklist framework, bidirectional asset-exception linking, XLSX exports, and batch create scratchpad
└──▷ GET THIS VERSION
$ git clone --branch v3.7.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.7.0
└──▷ USE IT
Prevent infinite loops in mapping graphs by setting the traversal limit
yaml
mapping.max_depth: 10
mapping.max_depth config key to control mapping relationship depth.
Bidirectional linking between assets and security exceptions.
Adds expiry date column to users list and removes header on questionnaire views from entity assessments.
└──▷ GET THIS VERSION
$ git clone --branch v3.6.3 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.6.3
Adds expiry_date field display to the user management list view
Removes the header overlay when viewing a questionnaire directly from an entity assessment page
Sync EBIOS RMEBIOS RMA French risk-management method published by ANSSI for analysing cyber threats and selecting countermeasures; tools use it to structure risk assessments that satisfy French and EU regulatory expectations. studies to ISO 27005 and auto-generate workshop 5 risk descriptions.
└──▷ GET THIS VERSION
$ git clone --branch v3.6.2 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.6.2
Adds capability to sync EBIOS RM studies with the resulting ISO 27005 framework
Adds auto-generation of risk scenario descriptions during workshop 5 analysis creation
Adds PDIS framework support and audit log object coverage.
└──▷ GET THIS VERSION
$ git clone --branch v3.5.3 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.5.3
tools wrapper for token optimization added to the API
v3.5.2 adds priority to findings, quantitative risk assessment conversion, and framework mapping visualization
└──▷ GET THIS VERSION
$ git clone --branch v3.5.2 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.5.2
findings objects now include a priority field, enabling prioritized remediation workflows.
Added a UI view for Framework mappings viz to visualize relationships between frameworks.
CISO Assistant v3.5.1 adds CRQ module via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. protocol, reference controls/threats in data wizard, and markdown justification for risk scenarios.
└──▷ GET THIS VERSION
$ git clone --branch v3.5.1 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.5.1
└──▷ HOW TO FIND IT
Interact with CISO Assistant's CRQ module programmatically via MCP.
📍# MCP protocol interaction details would be defined by the MCP specification and server configuration.
Use the data wizard to import or define reference controls and associated threats.
📍Navigate to Data Wizard in the UI and select options to add reference controls and threats.
Write rich text justifications for risk scenarios using markdown syntax.
📍In the risk scenario editor, enter justification text with markdown formatting (e.g., bold, *italic*, lists).
Adds support for the CRQ module through the MCP protocol
Allows adding reference controls and threats through the data wizard
Increases the justification length limit for risk scenarios and enables markdown formatting
Vanta adds custom notes to personnel records, datetime support for custom tests, and GA data inventory/ROPA management in Privacy Frameworks
Adds a new Custom Note field to personnel records for storing internal context like employment status or test user details.
Enables datetime data type values when writing custom tests, allowing verification of time-sensitive controls and SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. timelines.
Promotes Data Inventory and ROPA Management within Privacy Frameworks to General Availability (GA), enabling import/export capabilities directly in the tool.
3 details in Everything
3 more releases in this issue
· 2025-11-02 → 2025-12-06
Vanta introduces Agent-generated policies, TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. unified view, Slack Trust Center approvals, QAuto digests, and custom test author visibility.
TPRM Navigation merges Discovery, Procurement, and Managed Vendors into a unified view with Continuous Monitoring
Approve or deny Trust Center access requests directly in Slack via one-click actions
Vanta Agent generates editable custom policies from natural language prompts
QAuto sends daily reminder digests to questionnaire owners and approvers when due dates approach or pass
Custom test details view shows the author name for newly created tests
New GCP connector with automated setup, Slack CTM bot, Modular Enterprise package, and HRISHRISHuman Resources Information System — software that centralises employee records, payroll, and org data. Cyber tools integrate with it to tie identities and access rights to authoritative HR records. leave/email sync.
Adds a new Google Cloud Platform (GCP) connector with a streamlined flow and smart defaults for faster onboarding
Introduces a Cloud Shell script to automate policy and role setup for the GCP integration
Enables asking security and compliance questions directly in Slack via the CTM knowledge base
Launches the new Modular Enterprise package replacing Scale and previous Enterprise GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. packages
Adds automatic pull of leave data and personal email addresses from HRIS integrations (Bob, Personio, PayFit, Employment Hero, Rippling, Trinet)
Drata extends its GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. platform with NYDFS Part 500 coverage, enabling continuous monitoring for financial services compliance.
Supports NYDFS Part 500 requirements including risk assessments, access controls, encryption, and third-party oversight.
1 detail in Everything
8 more releases in this issue
· 2025-11-07 → 2025-11-22
Drata introduces granular RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. with new Role Detail pages and multi-role group assignments.
Adds Role Detail pages to view permissions for each role.
Enables multi-role assignments via group roles across all plans.
Drata adds multi-HRISHRISHuman Resources Information System — software that centralises employee records, payroll, and org data. Cyber tools integrate with it to tie identities and access rights to authoritative HR records. support for connecting and syncing personnel data from multiple HR systems simultaneously.
Enables synchronous personnel data sync from multiple connected HRIS platforms simultaneously
Adds a unified Personnel page to view all employees from every connected HRIS in one location
Introduces flexible data prioritization rules to resolve duplicate employee records across systems
Drata introduces the SafeBase Chrome Extension for in-browser Trust Library search and questionnaire assistance.
Adds the SafeBase Chrome Extension to enable in-browser access to the Trust Library and AI-powered questionnaire assistance without leaving your current tab.
Enables one-click copy and insertion of Trust Library answers directly into questionnaires or portals via the extension.
Provides cross-artifact search capabilities within the browser, respecting existing permission controls.
Adds Teammates chat on Trust Portal with configurable access control via UI settings
When enabled in Trust Portal settings, Teammates answers visitor questions using portal content and documents while respecting existing RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. permissions.
Adds Trust Portal settings configuration to control Teammates access (signed-in only or anonymous+signed-in)
Auto-filtering of training modules in campaign setup to show only framework-specific content.
When creating or editing employee training campaigns, the UI now automatically filters out irrelevant training options and displays only modules linked to purchased frameworks.
Scrut SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. framework updated to 2022 Revised Points of Focus with refined control mappings
Updated SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2 framework requirements to align with the 2022 Revised Points of Focus and 2017 Trust Services Criteria terminology.
Refined control mappings in the SOC 2 framework for enhanced clarity between control descriptions and required outcomes.
Optimized evidence suggestions in the SOC 2 framework by removing irrelevant or poorly described items to reduce compliance overhead.
Access Review now supports 94 applications including AWS, Azure, Salesforce, and GitHub for centralized access management
Expands Access Review to support 94 popular applications across Design, Productivity, HR, Sales, Finance, Engineering, Security, and Support categories
Runlayer is an MCP gateway that enforces identity-mapped permissions and detects threats across the agents and MCP servers employees use.
Runlayer v1.10 introduces Human-in-the-Loop security review via audit logs, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. catalog extensions, and duplicate server detection.
Adds ability for admins to review, approve, or reject security violations from the audit logs
Adds Snowflake, ClickUp, and HubSpot to the MCP catalog
Adds duplicate server detection to warn when creating a server with a configuration that already exists
3 details in Everything
4 more releases in this issue
· 2025-11-01 → 2025-11-25
Runlayer 1.9.0 adds Runlayer Deploy for deploying MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers via managed infrastructure.
Runlayer v1.8.0 adds CLI deploy command, token masking scanner, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server submission settings.
Adds deploy subcommand to Runlayer CLI for deploying Docker-based services
Introduces Token Masking Scanner that redacts sensitive tokens instead of blocking them
Runlayer 1.7.0 introduces policy-based access controls with advanced condition operators, OAuth refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. rotation, and redesigned UI pages.
Adds contains, matches, in operators for policy conditions to enforce fine-grained access control over MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. client/server attributes
Enables automatic OAuth refresh token rotation for improved security posture
Runlayer 1.6.0 adds OAuth auth from MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. clients, server config drawer, and audit logs redesign.
Enables authenticating to upstream OAuth servers directly from MCP clients like ChatGPT, Claude, Cursor
New streamlined interface for viewing and editing MCP servers in the Server Configuration Drawer
Portkey Enterprise Gateway 1.17.4 adds Anthropic Claude models and native messages endpoint via Azure AI Foundry
Adds Azure AI Foundry support for Anthropic Claude models (claude-opus-4-5-20251101, claude-sonnet-4-5-20250929, claude-haiku-4-5-20251001)
Enables native /messages endpoint support for Azure AI Foundry Anthropic providers, including extended thinkingextended thinkingIntermediate reasoning a model writes out before its final answer. Reasoning models generate it automatically and it is often billed as extra output tokens., prompt caching, and native streaming
2 details in Everything
15 more releases in this issue
· 2025-11-03 → 2025-11-27
Frontend 1.5.4 adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. group workspace mapping, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. confirmation modal, and AWS region config for service role auth.
SCIM group workspace mapping management available in UI to configure which SCIM groups map to which workspaces
Confirmation modal added before enabling the SSO Only Login flow to prevent accidental lockout
Support for specifying an AWS region when using service role-based authentication for Bedrock and Sagemaker
Portkey Backend 1.6.0 adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. group-to-workspace mapping and AWS Bedrock region parameter support
Introduced flexible group-to-workspace mapping for SCIM integrations from Okta or Azure Entra
Added support for the aws_region parameter in the Bedrock integration for serviceRole auth type
Adds hook results in streaming responses for /chat/completions, /completions, /embeddings, and /messages endpoints to enable real-time content policy enforcement.
Introduces new F5 Guardrails partner plugin integration for content moderation and PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. detection/rediation.
Expands cost calculation support for image generation (TogetherAI), video generation (VertexAI Veo models, OpenAI/Azure Sora models).
Portkey Backend 1.5.0 introduces usage limits and rate limit policy APIs with dynamic condition support.
Adds usage limits and rate limit policy APIs to allow organizations to apply flexible budget and rate limit controls based on dynamic conditions such as API keys, metadata, or workspace
Adds a new column in ClickHouse to store the log object path format identifier
Portkey Gateway 1.17.0 adds usage limits, OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. tracing, fine-tuning cost tracking, and hourly S3 logs
Adds LOG_STORE_FILE_PATH_FORMAT environment variable to toggle log storage between flat (v1) and time-hierarchical (v2) paths.
Introduces usage limits and rate limit policies based on API keys, metadata, workspace, or other dynamic conditions.
Adds support for OpenTelemetry W3C trace context headers (traceparent and baggage) to automatically map to internal tracing.
Adds cost calculation logic for fine-tuning operations across OpenAI, Azure OpenAI, and Vertex AI.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Removed root user from container image. The container image no longer runs as root; it now runs processes with a non-root UID and enforces a non-root container securityContext.
v1.3.3: List traces API returns more details; JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. guardrail schema updated for new Gateway parameters
Updates JWT Guardrail schema to support new parameters from the latest Gateway build
Enterprise Gateway 1.16.6 adds llm_token_sum metric, Modal provider, JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. plugin claims injection, and skip.auth env var
Adds llm_token_sum Prometheus metric to track total LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. tokens consumed
Adds support for Modal as a new LLM provider
Adds claim extraction and injection into request context as headers in JWT Plugin
Adds flexible claim validation with multiple match types (exact, contains, containsAll, regex) in JWT Plugin
Adds token introspection endpoint validation as an alternative to JWKSJWKSA JSON Web Key Set, a published collection of cryptographic keys. Applications use it to find the public key needed to verify a token's signature. in JWT Plugin
+1 moreshow less
Adds SKIP_DATAPLANE_CONFIG_CHECK environment variable to allow configs with multiple targets for unified batches file upload endpoints
Portkey Frontend v1.4.9 adds JSON modeJSON modeForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. for prompts, workspace search on MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Consent, and Azure/OpenAI transcribe model support.
Adds JSON mode for prompt parameters to enable real-time updates and easier editing
Improves MCP Consent page to allow searching by workspaces
Supports transcribe models under Azure and OpenAI providers
Adds search functionality to the Analytics Filter API key field
Portkey Enterprise Gateway 1.16.5 adds VertexAI Computer Use support, WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. proxy, and new CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. env vars
Adds anthropic-beta header support (also mapped to x-portkey-anthropic-beta) for VertexAI provider
Adds support for conversation and modalities parameters for OpenAI provider
Adds HTTP proxy support for WebSockets via the HTTPS_PROXY environment variable
Adds four CORS configuration environment variables: CORS_ALLOWED_ORIGINS, CORS_ALLOWED_METHODS, CORS_ALLOWED_HEADERS, and CORS_ALLOWED_EXPOSE_HEADERS
Promptfoo tests, evaluates, and red-teams LLM applications to detect vulnerabilities and compare model outputs.
Promptfoo November release adds Hydra multi-turn strategy, code scanning, XLSX config, and SharePoint integration.
Adds the hydra multi-turn red teaming strategy that adapts dynamically to target responses
Adds code scanning to analyze codebases for potential AI security issues
Introduces Microsoft SharePoint integration to load datasets directly from SharePoint
Enables loading test cases from Excel files using XLSX/XLS support in configuration
Adds the OpenAI ChatKit provider for conversational AI interactions
+5 moreshow less
Supports Claude Opus 4.5, GPT-5.1, Gemini 3 Pro, and Groq reasoning models
Adds a web search assertion to assert on web search results
Introduces dot product and euclidean distance as new similarity metrics for embeddingsembeddingsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG.
Adds FERPA and Ecommerce plugins for education privacy and e-commerce vulnerability testing
Enables loading tool definitions from Python or JavaScript files via configuration
ToolHive v0.6.9 adds RetryDelay to WorkflowStep CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. and podTemplateSpec to MCPRegistry CRDs
└──▷ GET THIS VERSION
$ git clone --branch v0.6.9 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.6.9
MergePodTemplateSpecs utility added for cleaner pod template composition
Standard JSON Schema format now used for composite tool parameters
Added RetryDelay to error handling in WorkflowStep CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. for more resilient workflows
3 details in Everything
24 more releases in this issue
· 2025-11-03 → 2025-11-28
ToolHive Operator CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. add database configuration for the registry server.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.71 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.71
└──▷ USE IT
Configure the ToolHive operator to connect to an external PostgreSQL instance for its registry.
Adds podTemplateSpec field to MCPRegistryCRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. for customizing registry API deployment
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.69 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.69
ToolHive Operator CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. v0.0.68 adds smart transport auto-detection for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. and RetryDelay to WorkflowStep CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.68 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.68
Adds th mcp commands with smart transport auto-detection
Adds RetryDelay field to WorkflowStep CRD for error handling configuration
Adds MergePodTemplateSpecs function and standard JSON Schema format for VMCP composite tool parameters
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.67 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.67
Introduces the MergePodTemplateSpecs function to merge podTemplateSpecs within the Helm chart logic
ToolHive v0.6.8 adds OAuth server fallback, header injection auth, and multi-configmap registry support
└──▷ GET THIS VERSION
$ git clone --branch v0.6.8 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.6.8
Adds OAuth authorization server fallback for registration endpoint discovery to improve resilience when the issuer does not provide a well-known URI.
Adds header injection authentication support as a new strategy for authenticating upstream requests via custom HTTP headers.
Adds multi-configmap data source support for the registry, allowing tool definitions to be sourced from multiple ConfigMaps.
Implements discovered mode for vMCP authentication to automatically locate and validate credentials.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Removes the local incoming auth type from operator CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it., requiring migration if currently in use.
!Removes the unimplemented pass_through auth strategy from the configuration.
ToolHive operator now supports multi-configmap registry data sources and discovered-mode vMCP authentication
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.65 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.65
Adds multi-configmap data source for registry to allow the operator to aggregate registry configuration across multiple ConfigMaps.
Implements discovered mode for vMCP (Vertex Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) authentication, enabling automatic endpoint discovery during the authentication flow.
ToolHive operator v0.0.61 adds native OrbStack Docker socket support on macOS and output configuration for composite tools
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.61 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.61
Adds --foreground flag compatibility with --from-config to allow foreground mode in configuration-driven deployments
Adds output configuration support for composite tools to control how multiple tool outputs are handled
ToolHive v0.6.6 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Tasks support, Google Antigravity IDE client integration, and environment variable injection for header_injection auth.
└──▷ GET THIS VERSION
$ git clone --branch v0.6.6 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.6.6
Add support for MCP Tasks (November 2025 spec)
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!The service_account authentication strategy is removed.
Adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Tasks support (November 2025 spec) and per-user caching for vMCP discovery
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.59 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.59
New Helm chart for deploying the ToolHive Operator into Kubernetes.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.5.2 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.5.2
└──▷ TRY IT
Deploy the ToolHive Operator to a Kubernetes cluster using the newly provided chart.
ToolHive Operator CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. v0.0.57 adds composite tool workflows and UpstreamRegistry support
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.57 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.57
UpstreamRegistry replaces the legacy ServerRegistry type in CRDs to define registry sources.
The toolhive-operator-crds Helm chart now creates a ConfigMap for registry server configuration via the new CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. definitions.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The ServerRegistry type in your CRDs must be renamed to UpstreamRegistry.
ToolHive CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. add environment variable support to header_injection auth strategy.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.56 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.56
ToolHive v0.6.4 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. elicitation support for vMCP composite workflows.
└──▷ GET THIS VERSION
$ git clone --branch v0.6.4 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.6.4
ToolHive v0.6.3 adds Kiro and OpenCode clients, token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. auth, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. registry format converters, and well-known URI discovery
└──▷ GET THIS VERSION
$ git clone --branch v0.6.3 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.6.3
Adds Kiro to the list of supported MCP clients for proxying connections.
Adds OpenCode as a new supported MCP client.
Implements token-exchange authentication strategy for managing service identities.
Adds registry format converters to support importing from the Official MCP Registry.
Implements MCP well-known URI (/.well-known/mcp.json) authentication discovery per the MCP Spec.
Adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. registry support, OpenCode/Kiro clients, lazy capability discovery, and token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. auth
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.55 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.55
Support for the Official MCP Registry via new registry format converters
Addition of OpenCode as a supported client
Addition of Kiro as a supported client
Implementation of lazy per-session capability discovery
New token exchange authentication strategy for OAuth/OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. flows
Adds Helm chart for deploying the ToolHive Operator into Kubernetes
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.5.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.5.0
└──▷ TRY IT
Deploy the operator using the standard Helm workflow after adding the repository.
ToolHive v0.6.0 adds vmcp serve --host/--port, Kubernetes storage and controller, streamable-http proxy default, and automatic auth monitoring
└──▷ GET THIS VERSION
$ git clone --branch v0.6.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.6.0
Add --host and --port flags to the vmcp serve command
Implement CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.-based group storage for Kubernetes in ToolHive
Implement VirtualMCPServer Kubernetes controller
Add automatic authentication monitoring with unauthenticated state detection for remote workloads
Change default proxy mode from SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. to streamable-http for thv CLI and operator
+1 moreshow less
Send resource indicator when authorizing to remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The GetClaimsFromContext backward compatibility helper is removed
toolhive-operator-0.4.0 introduces a Helm chart for Kubernetes deployment and changes the default proxy mode
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.4.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.4.0
└──▷ BREAKING ON UPGRADE
!The default proxy mode is now streamable-http; existing deployments relying on SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. as the default will need explicit configuration.
ToolHive operator adds VMCP status collector, automatic authentication monitoring for remote workloads, and defaults to streamable-http proxy mode.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.3.7 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.3.7
statusCollector now tracks vmcp resources
New autoAuthMonitor feature detects unauthenticated states in remote workloads
Default proxy mode changed from sse to streamable-http
Adds host/port flags to vmcp serve, e2e test for remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, and CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.-based group storage
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.51 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.51
└──▷ USE IT
Run the local vMCP server on a custom interface and port instead of the defaults.
ToolHive operator 0.3.6 adds Helm chart, vMCP serve flags, VirtualMCP CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it., and composite tool engine
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.3.6 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.3.6
└──▷ USE IT
Run the vMCP server on a specific interface and port for remote access.
shell
vmcp serve --host 0.0.0.0 --port 8080
Add helm/chart-testing-action update to CI pipeline (v2.8.0)
Implement composite tools workflow engine for vMCP
Implement outgoing authentication strategies for vMCP
Process EnvFileDir in file-based config mode
Support MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers with partial capabilities in vmcp
9 details in Everything
└──▷ BREAKING ON UPGRADE
!The GetClaimsFromContext backward compatibility helper is removed
ToolHive v0.5.2 adds serve subcommand for Virtual MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Servers, new tools_override API field, and VirtualMCPCompositeToolDefinition CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.
└──▷ GET THIS VERSION
$ git clone --branch v0.5.2 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.5.2
vMCP: Implement CLI serve command and session management
Adds vMCP CLI serve command and session management for new Kubernetes CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.50 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.50
Implements serve subcommand on the vMCP CLI to start sessions.
Uses proxy-mode transport instead of the legacy transport field in VirtualMCP configurations.
Introduces VirtualMCPCompositeToolDefinitionCustom Resource DefinitionCustom Resource DefinitionA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. for Kubernetes.
v0.9.0 adds enforce/complain modes, behavior modeling, and policy-advisor template generation for BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. enforcer.
└──▷ GET THIS VERSION
$ git clone --branch v0.9.0 https://github.com/bytedance/varmor.git
# already have the repo? check out this version:$ git checkout v0.9.0
enforce/complain modes available in BPF enforcer profiles to control enforcement strictness
BehaviorModeling mode supported by the BPF enforcer for learning-based policy generation
operation field added to BPF enforcer violation logs for context on triggered violations
qualifiers field added to BPF enforcer custom rule interfaces for granular rule matching
policy-advisor can now generate policy templates using behavior data from the BPF enforcer
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The eventType field in violation logs is renamed to enforcer
Zenity adds runtime protection for OpenAI AgentKit with deterministic enforcement of data leakage, secrets, and unsafe actions.
Introduces runtime protection capability that inspects every interaction between users and AgentKit-based agents to enforce policy before risk turns into exposure
Adds intent-focused inspection engine that analyzes underlying action intent rather than simple prompt-and-response to detect manipulative behavior hiding behind safe language
Deploys rule-based, deterministic enforcement for three specific categories: Data Leakage Detection (blocking exfiltration in responses or tool outputs), Secrets Exposure Prevention (stopping embedded API keys/credentials/tokens), and Unsafe Response Blocking (preventing policy-violating actions)
New BotThinking events, embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. providers (Azure, Cohere, Google), Cisco AI Defense integration, and in-memory caching for content models.
└──▷ GET THIS VERSION
$ git clone --branch v0.18.0 https://github.com/NVIDIA-NeMo/Guardrails.git
# already have the repo? check out this version:$ git checkout v0.18.0
Introduces BotThinking events to apply guardrails on an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.'s reasoning traces
Adds Azure OpenAI as a supported embedding provider
Adds Cohere embedding integration
Adds Google embedding integration
Adds Cisco AI Defense integration
+3 moreshow less
Adds in-memory LFU caching for content-safety, topic-control, and jailbreak detection models to reduce latency
Adds automatic provider inference for LangChain LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.
Adds custom HTTP header support for the ChatNVIDIA provider
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Reasoning traces are extracted to a separate reasoning field instead of being prepended; use LangChain's additional_kwargs structure.
!stream_async now raises an error if output rail streaming is disabled.
curl 8.17 adds QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. v2 support and new --no-alpn flag
└──▷ GET THIS VERSION
$ git clone --branch curl-8_17_0 https://github.com/curl/curl.git
# already have the repo? check out this version:$ git checkout curl-8_17_0
└──▷ TRY IT
Force HTTP/1.1 or HTTP/2 by disabling ALPN to avoid automatic protocol selection.
$ curl --no-alpn https://example.com
Test a server that supports the newer QUIC v2 specification.
$ curl --quic2 https://example.com
Adds --no-alpn flag to disable ALPN negotiation for HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. connections
Adds --knownhosts to tool_getparam for outputting the current known_hosts file contents.
Adds a notifications API in the multi interface to signal internal events.
Expands progress display size formatting to use 6 characters per size unit.
Makes %header{} able to output all occurrences of a header via write-out formats.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Drops Heimdal KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. support, requiring users who relied on it to switch to MIT Kerberos or other implementations.
!Drops the winbuild build system for Windows builds.
!Raises the minimum libssh2 requirement to version 1.9.0.
CTFd 3.8.1 integrates dynamic scoring into standard challenges and adds solution-access controls with new API endpoints.
└──▷ GET THIS VERSION
$ git clone --branch 3.8.1 https://github.com/isislab/CTFd.git
# already have the repo? check out this version:$ git checkout 3.8.1
└──▷ HOW TO FIND IT
Bulk-set solution visibility to solved for multiple challenges so participants can only read solutions they've already completed.
📍In the Admin Panel, go to Challenges, select the target challenges using the checkboxes, open the Bulk Edit menu, and set Solution Visibility to solved.
Integrates dynamic scoring into the standard challenge type — all challenges now support initial, decay, minimum, and function fields for configurable scoring logic, removing the need for a separate plugin.
Adds solved solution visibility mode, letting users view a challenge's solution only after they have solved it.
Adds bulk editing for solution visibility on the Admin Panel Challenges page.
New /api/v1/challenges/[challenge_id]/solution endpoint to check whether a challenge solution is accessible to the requesting user.
Changes GET /api/v1/solutions/[solution_id] to return 404 instead of 403 for hidden solutions.
+4 moreshow less
New RUN_ID config option specifies a token used as a cache-buster URL parameter.
New EXTRA_CONFIGS_FORCE_TYPES config allows server admins to enforce types for values in the [extra] config section.
Adds Uzbek and Hebrew language translations.
CTFd.js bumped to 0.0.19, adding getSolutionState and setSolutionId functions for theme developers to determine solution accessibility.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!GET /api/v1/solutions/[solution_id] now returns 404 (not 403) when a solution is hidden — clients that branch on 403 to detect hidden solutions will need to be updated.
kustomize v5.8.0 adds structured-data replacements, regex replacement selectors, and a new PatchArgs API type.
└──▷ GET THIS VERSION
$ git clone --branch kustomize/v5.8.0 https://github.com/kubernetes-sigs/kustomize.git
# already have the repo? check out this version:$ git checkout kustomize/v5.8.0
└──▷ USE IT
Replace a value inside an embedded JSON blob in a ConfigMap using the replacements transformer's structured-data path traversal.
Supports editing embedded YAML/JSON values inside manifests via the replacements transformer using dot-path traversal into structured fields (e.g. data.config\.json.config.hostname).
Adds regex support for Replacement selectors, enabling pattern-based source/target matching in replacements.
Introduces PatchArgs API type to programmatically populate patch options.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!A regression in namespace propagation to child kustomizations was introduced in this release; the maintainers advise against upgrading until a patch release is available.
kustomize api v0.21.0 adds regex replacement selectors, structured-data replacement values, and a new PatchArgs API type.
└──▷ GET THIS VERSION
$ git clone --branch api/v0.21.0 https://github.com/kubernetes-sigs/kustomize.git
# already have the repo? check out this version:$ git checkout api/v0.21.0
Supports regex patterns in Replacement selectors for flexible field targeting.
Implements replacement values in structured data for richer substitution workflows.
Adds PatchArgs API type to programmatically populate patch options.
Helm 4.0.0 ships WebAssemblyWebAssemblyA binary instruction format that runs in browsers and server runtimes at near-native speed, letting developers compile C, Rust, or other languages into a portable, sandboxed module any compliant host can execute. plugins, server-side apply, kstatus-based resource watching, and reproducible chart builds.
└──▷ GET THIS VERSION
$ git clone --branch v4.0.0 https://github.com/helm/helm.git
# already have the repo? check out this version:$ git checkout v4.0.0
Adds a redesigned plugin system with support for WebAssembly-based plugins.
Promotes post-renderers to first-class plugins.
Supports server-side apply for Kubernetes resource management.
Improves resource watching for wait operations using kstatus.
Adds local content-based caching for charts and other artifacts.
+3 moreshow less
Enables structured logging via slog, allowing SDK logging to integrate with modern loggers.
Supports reproducible builds of chart archives.
Updates the SDK API with support for multiple chart API versions, including a new experimental v3 chart API version.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Helm v4 introduces backward-incompatible changes to CLI flags and output compared to Helm v3.
!The SDK API has breaking changes incompatible with Helm v3.
1 more release in this issue
· 2025-11-11 → 2025-11-12
ZoomIt v9.20 adds MP4/GIF recording; PE v17.07 adds Arm64 strings; RDCMan v3.11 enables Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. logins
ZoomIt v9.20 now saves screen recordings as MP4 or GIF.
Process Explorer v17.07 adds string extraction for Arm64 binaries.
SysReptor 2025.96 adds QR code generation in PDF reports and header logo customization via plugin.
└──▷ GET THIS VERSION
$ git clone --branch 2025.96 https://github.com/Syslifters/sysreptor.git
# already have the repo? check out this version:$ git checkout 2025.96
Supports QR code generation during PDF rendering for embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. links or metadata directly in report output.
Plugin customizetheme: Enables customization of the header logo.
2 details in Everything
1 more release in this issue
· 2025-11-12 → 2025-11-19
The code-oss project is an open-source code editor combining editing, debugging, and extensibility for developers across Windows, macOS, and Linux.
VS Code 1.106 adds plan agent for complex tasks, custom MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. registry for orgs, and Linux JSON policy management.
└──▷ GET THIS VERSION
$ git clone --branch 1.106.0 https://github.com/microsoft/vscode.git
# already have the repo? check out this version:$ git checkout 1.106.0
New plan agent enables planning and coordinating complex multi-step coding tasks, with a session monitor for background agents.
Inline suggestions engine is now open source.
Adds custom MCP registry support so organizations can manage and restrict MCP server access.
Adds Linux policy support — manage VS Code device policies via JSON policy files.
Text selection now works on deleted code lines in the diff editor.
+1 moreshow less
Refreshed, modernized product icon set across the UI.
Cloudflare is a connectivity cloud platform delivering internet security, performance, and developer infrastructure services.
Agents SDK v0.2.24 adds resumable streaming to AIChatAgent and redesigned MCPClientManager API.
AIChatAgent supports resumable streaming for reconnecting clients
MCPClientManager.registerServer() allows registering MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers without connecting
MCPClientManager.connectToServer(id) establishes connection to a registered server
MCPConnectionState enum added with idle, connecting, authenticating, connected, discovering, and ready states
MCPClientConnection.discover() method with AbortController support and configurable timeout
5 details in Everything
32 more releases in this issue
· 2025-11-03 → 2025-11-26
Workers AI launches FLUX.2 [dev] with multi-reference image inputs and JSON prompting capabilities
Adds @cf/black-forest-labs/flux-2-dev model to Workers AI for high-fidelity image generation with physical world grounding
Supports up to four input_image_0, input_image_1, input_image_2, and input_image_3 parameters for multi-reference style transfer via multipart form data
Enables granular control over generated images by passing a structured JSON object as the value for the prompt field in the API request
Cloudflare Radar introduces HTTP Origins API endpoints and UI visibility for cloud origin infrastructure monitoring.
Adds GET /origins endpoint to list all origins (cloud providers and associated regions)
Adds GET /origins/{origin} endpoint to retrieve information about a specific origin
Adds GET /origins/timeseries endpoint to retrieve normalized time series data including REQUESTS, CONNECTION_FAILURES, RESPONSE_HEADER_RECEIVE_DURATION, TCP_HANDSHAKE_DURATION, and TCP_RTT metrics
Adds GET /origins/summary endpoint to retrieve HTTP requests summarized by dimension (region, success_rate, percentile)
Adds GET /origins/timeseries_groups endpoint to retrieve timeseries data grouped by dimension
+2 moreshow less
Extends Annotations API to support origin outages for automated detection and alerting
Extends Traffic Anomalies API to support origin anomalies for automated detection and alerting
Cloudflare Containers now support mounting R2 buckets as FUSEFUSEA Linux kernel interface that lets userspace programs implement a filesystem without kernel code, maintained as part of the kernel project; tools use it to mount virtual or synthetic filesystems without requiring root or kernel modules. volumes via third-party adapters.
Containers can now mount R2 buckets as FUSE (Filesystem in Userspace) volumes, allowing applications to interact with R2 using standard filesystem operations.
Cloudflare Terraform v5.13 adds cloudflare_connectivity_directory resource and new ZT features
Adds cloudflare_sso_connector as a new Terraform resource for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. integration
Adds cloudflare_universal_ssl_setting as a new Terraform resource for universal SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. configuration
Adds proxy_endpoint attribute to the zero_trust_access_application resource for ZT Access Applications
Adds support for self-serve license keys in the magic_transit_connector resource
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The cloudflare_api_token and cloudflare_account_token resources have breaking changes to eliminate configuration drift caused by policy ordering differences; see the detailed Repository changelog for migration steps
New opt-in CASBCASBA Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. Weekly Digest email for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. security posture visibility
Adds the CASB Weekly Digest notification type to deliver a Monday morning email summary of API CASB findings, high/critical risks, and integration health status.
DEX Logpush jobs now export WARP/DEX device data sets to R2, cloud buckets, or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. via dashboard UI
Adds four new WARP and DEX device data sets (DEX Application Tests, DEX Device State Events, WARP Config Changes, WARP Toggle Changes) exportable via Cloudflare Logpush
API Shield adds automatic BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. enumeration and pollution detection across Enterprise managed endpoints
WARP client for Linux GA release adds PMTUD support and improved tunnel health status
Path Maximum Transmission Unit Discovery (PMTUD) is now supported to dynamically adjust packet sizing, disabled by default
GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. displays a connection status message when the local network connection may be unstable
Cloudflare introduces Logpush Health Dashboards for real-time job visibility
Adds Upload Health and Upload Reliability sections to the new Health tab in the Cloudflare dashboard, providing data completeness, success rate, retry counts, and latency metrics for Logpush jobs.
Enables access to these health dashboards at the account or zone level via the existing Cloudflare dashboard interface.
Windows WARP client GA release adds PMTUD support, Windows 11 ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. compatibility, and UBR checks.
Adds PMTUD (Path Maximum Transmission Unit Discovery) to dynamically adjust packet sizing for connection optimization
Adds steps in the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. to display tunnel and DNS health via a new connection status message when the network may be unstable
Adds per-crawler drilldowns with extended actions menu and status code analytics in AI Crawl Control
└──▷ HOW TO FIND IT
Access status code distribution for all crawlers to identify traffic patterns.
📍Go to AI Crawl Control › Metrics
Status code distribution chart on the Metrics tab to analyze HTTP response codes (2xx, 3xx, 4xx, 5xx) over time
Per-crawler extended actions menu with View Metrics, View on Cloudflare Radar, Copy User Agent, View in Security Analytics, and Copy Detection ID options
Cloudflare WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. adds new Prototype Pollution detections for URI, Body, and Header vectors.
Adds detection rules for Prototype Pollution via URI (...606285e6)
Adds detection rules for Prototype Pollution via Body (...4f59ff26)
Adds detection rules for Prototype Pollution via Header - Form (...7efbeb39)
Cloudflare Workers open beta for automatic tracing with configurable observability and OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. export.
Enables observability.traces.enabled config to activate automatic tracing on Cloudflare Workers
Exports traces and correlated logs to OTLP-compatible destinations via the Cloudflare dashboard
Displays traces alongside logs in the Workers Observability dashboard
Allows querying span attributes including operation type, status, duration, and errors
Magic WAN adds Automatic Return Routing beta for route-less symmetric return traffic
Adds Automatic Return Routing (ARR) support in Magic WAN, enabling customers to configure Magic on-ramps (IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications./GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation./CNI) to learn the return path for traffic flows without static routes.
Introduces Route-less mode where static or dynamic routes are optional when using ARR.
Enables Overlapping IP space support allowing traffic from customer sites to use overlapping private IP ranges.
Guarantees Symmetric routing by ensuring return traffic uses the same connection as the original on-ramp.
Requisite feature requires enabling the new Unified Routing mode (beta).
Cloudflare Gateway remaps application categories for refined HTTP traffic policies.
Applications are remapped to new category values (e.g., File Sharing becomes Photography & Graphic Design), allowing policies to target more precise app types.
A transition period is provided until January 30, 2026, for administrators to update existing Gateway rules to use the new categories before old mappings change.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Existing Gateway policies targeting old application categories (e.g., File Sharing, Human Resources) will stop matching traffic as of January 30, 2026.
Introduces Workers VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Services (Beta) for secure internal resource access via service bindings.
Announces Workers VPC Services (Beta), enabling Workers to securely access resources in private networks without exposing them on the public Internet
Adds support for connecting to resources in any external cloud (AWS, Azure, GCP) or on-premise using Cloudflare Tunnels via Multi-cloud Support
Adds WRANGLER_OUTPUT_FILE_PATH and WRANGLER_OUTPUT_FILE_DIRECTORY env vars to capture Wrangler output in structured ND-JSON format for automation.
Enables programmatic access to deployment information by setting WRANGLER_OUTPUT_FILE_PATH or WRANGLER_OUTPUT_FILE_DIRECTORY environment variables.
Captures Wrangler command output in structured ND-JSON format for supported commands including wrangler deploy, wrangler versions upload, wrangler versions deploy, and wrangler pages deploy.
Arcade adds GitHub MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support for repos/PRs and email-based user invitations.
MCP Servers updated to support GitHub projects, issues, and pull requests
Platform and Engine enables inviting users to projects by email
2 details in Everything
2 more releases in this issue
· 2025-11-07 → 2025-11-21
Adds Customer.io and Intercom MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers; updates arcade deploy to support them
Adds Customer.io Starter MCP Server to Arcade
Adds Intercom Starter MCP Server to Arcade
Updates arcade deploy command to support MCP Servers built with arcade-mcp
Adds Mailchimp market toolkit, Hubspot Marketing & CRM toolkit enhancements, and optional OAuth header customization for upstream MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Servers
Added Mailchimp market toolkit as a new integration.
THE CYBER TOOLCHAIN