The Cyber Toolchain — issue -009, October 31, 2025
THE CYBER TOOLCHAIN
NO. -009
Tail
THE DAILY RELEASE FIREHOSE
PUBLISHED OCTOBER 31, 2025 · EVERY DAY
EDITIONStail|grep|head|ls|diff|uniq
The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
Impacket 0.13.0 adds six new example tools, WinRMWinRMA Windows-native remote management protocol from Microsoft, implementing the WS-Management standard, that lets tools execute commands and access data on remote Windows hosts over HTTP or HTTPS./RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. relay, SCCM relay attacks, and major SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments./LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory./DCE-RPCDCE-RPCA remote procedure call protocol standardized by the Open Group that lets a program call functions on a remote system over a network, giving cyber tools a structured way to parse or emulate Windows service communication. capability expansions.
└──▷ GET THIS VERSION
$ git clone --branch impacket_0_13_0 https://github.com/SecureAuthCorp/impacket.git
# already have the repo? check out this version:$ git checkout impacket_0_13_0
└──▷ TRY IT
Extract LSALSALocal Security Authority — a Windows subsystem that handles authentication, enforces local security policy, and stores credential material, making it a frequent target for credential-harvesting cyber tools. secrets from a remote host's registry hives without touching disk — useful during post-exploitation when secretsdump's VSS path is blocked.
Check whether a target DC enforces LDAP signing and LDAPSLDAPSLDAP over TLS — the encrypted variant of the Lightweight Directory Access Protocol, standardized in RFC 2830, used to query directory services like Active Directory without exposing credentials in plaintext. channel binding before attempting an LDAP relay or anonymous bind.
New attrib.py example manipulates file attributes over SMB using the new setInfo workflow.
New filetime.py example inspects and updates SMB file timestamps via refreshed SMBConnection APIs.
New badsuccessor.py example demonstrates the AD CS bad successorattack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..
New regsecrets.py example extracts LSA secrets from remote registry hives via MS-RRP.
New samedit.py example edits local SAM password hashes offline.
+15 moreshow less
New CheckLDAPStatus.py example checks LDAP signing status and LDAPS channel binding status.
Adds WinRM relay client/server support to the relay toolchain.
Introduces an RPC relay server with Endpoint Mapper discovery.
Delivers SCCM Management Point and Distribution Point relay attacks.
Adds SMB setInfo support, CIFS datetime helpers, and safer default share access for remote attribute and timestamp management.
Strengthens LDAP/KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. handling with channel binding plus signing and LDAPS-based LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet. retrieval against Windows Server 2025 DCs.
Adds a new ICPR DCE/RPC interface to support relay-aware RPC workflows.
Adds options to strip SSPSSPA System Security Plan — a formal document required by NIST SP 800-18 that describes how a federal system meets its security controls, giving cyber tools a structured artifact to parse or generate for compliance workflows. from Net-NTLMv1NTLMv1A Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. captures and write relay-captured hashes for cracking workflows.
secretsdump.py gains a WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. shadow snapshot path, export hive boot key recovery, and user-status reporting.
Adds identity log to ntlmrelayx to track compromised principals.
smbclient gains reconnect and autocomplete options.
rdp_check and wmiexec now support IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. targets and display created Process IDs.
Adds impacket.mssql namespace for MSSQL-related imports.
Declares Python 3.13 support.
20 details in Everything
└──▷ BREAKING ON UPGRADE
!Python 3.8 is no longer supported; upgrading requires Python 3.9 or later.
1 more release in this issue
· 2025-10-01 → 2025-10-22
$ git clone --branch 0.13.0 https://github.com/fortra/impacket.git
# already have the repo? check out this version:$ git checkout 0.13.0
Added attrib.py example to manipulate file attributes over SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. via the new setInfo workflow
Added filetime.py example to inspect and update SMB file timestamps using refreshed SMBConnection APIs
Added badsuccessor.py example to demonstrate the AD CS bad successorattack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately.
Added regsecrets.py example to extract LSALSALocal Security Authority — a Windows subsystem that handles authentication, enforces local security policy, and stores credential material, making it a frequent target for credential-harvesting cyber tools. secrets from remote registry hives through MS-RRP
Added samedit.py example to edit local SAM password hashes offline
+1 moreshow less
Added CheckLDAPStatus.py example to check LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. signing and LDAPSLDAPSLDAP over TLS — the encrypted variant of the Lightweight Directory Access Protocol, standardized in RFC 2830, used to query directory services like Active Directory without exposing credentials in plaintext. channel binding status
BloodHound v8.3.0 adds Privilege Zone history, ingest file retention controls, ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. ESC6 improvements, and new AD/Azure graph properties.
└──▷ GET THIS VERSION
$ git clone --branch v8.3.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v8.3.0
Adds a History View for Privilege Zones, letting analysts track how zone membership has changed over time.
Adds a rolling asset group history window for tracking asset group changes over a configurable time range.
Adds API controls for retaining ingest files after processing, with a configurable default retention setting.
Adds a zone glyph selector for visually distinguishing Privilege Zones in the UI.
Adds a certification zone filter to GET certified members, scoping results to only certification-required zones.
+10 moreshow less
Adds a File Ingest details panel and filter modal for inspecting and filtering ingested data files.
Adds the netlogon DC property to Domain Controller nodes for richer AD enumeration data.
Adds the GPO Status property with human-readable resolution to Group Policy Object nodes.
Adds service principals as supported principals in the AZAddMembers edge, expanding Azure attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. coverage.
Improves ADCSESC6 post-processing for more accurate ESC6 attack path detection.
Expands the AdminSDHolderProtected property into ProtectAdminGroups graph relationships for richer AdminSDHolder visibility.
Replaces ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. display text with ACEs terminology in the Data Quality view for accuracy.
Adds a Summary Page to BloodHound Community Edition (BHCE).
Adds scroll support to the simple domain selector for environments with many domains.
Bumps SharpHound and AzureHound collector versions.
Cloud C2 v3.5.2 adds LAN Turtle Hub support and a Show Online Devices Only filter
└──▷ BREAKING ON UPGRADE
!Adjusted TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. validity window requires users to re-register their Two-Factor Authentication tokens after upgrading.
M5 Stick C firmware for high-tech pranks and digital self defense.
Adds BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems. Hunter, Deauth Hunter, Pine hunter, and BadUSB hunter modes
└──▷ GET THIS VERSION
$ git clone --branch d0f42f3 https://github.com/n0xa/m5stick-nemo.git
# already have the repo? check out this version:$ git checkout d0f42f3
Adds BLE Hunter mode for Bluetooth Low Energy scanning and analysis
Adds DeauthHunter mode for detecting and handling deauthentication frames
Adds Pine hunter module (likely Pine64 or specific hardware interaction support)
Adds Bad usb hunter module for USB attack detection or simulation
Flipper Zero Unleashed Firmware, an unlocked alternative firmware.
Unleashed Firmware unlshd-083 adds SubGHz protocol decoders, NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. MFC key management, FeliCaFeliCaA contactless smart card standard developed by Sony, widely used in Japanese transit and payment systems, operating at 13.56 MHz with its own proprietary protocol distinct from ISO 14443. dump improvements, and CLI commands
└──▷ GET THIS VERSION
$ git clone --branch unlshd-083 https://github.com/DarkFlippers/unleashed-firmware.git
# already have the repo? check out this version:$ git checkout unlshd-083
Adds support for Came Atomo (TOP44RBN) remotes in SubGHz mode.
Adds Elplast 18bit static code protocol to the SubGHz decoder list.
Enables on-the-fly decoding of BFT (2-button remotes) in regular Read mode without external tools.
Improves Linear and Dickert MAHS protocol decoders with better EZCode support.
Adds ZKTeco 430.5 MHz manual entry capability for SubGHz.
The open-source wireless research platform for ESP32.
GhostESP v1.8 adds PN532/Chameleon NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. support, Karma attack, 802.15.4802.15.4An IEEE standard defining the physical and MAC layers for low-rate wireless personal area networks, used as the radio foundation for protocols like Zigbee and Thread in embedded and IoT device research. capture, Cardputer ADV hardware support, and UI/menu layout changes.
└──▷ GET THIS VERSION
$ git clone --branch v1.8 https://github.com/GhostESP-Revival/GhostESP.git
# already have the repo? check out this version:$ git checkout v1.8
Adds NTAG (Type 2) read/write support for NTAG213/215/216 with NDEF parsing to Flipper .nfc format via PN532
Adds MIFARE ClassicMIFARE ClassicA family of contactless smart card chips made by NXP, widely used in access control and transit systems, whose weak proprietary encryption makes it a frequent target for RFID analysis and cloning tools. (Mini/1K/4K) support via PN532 including dictionary attack, magic backdoor detection, and NDEF TLV parsing
Adds Chameleon Ultra CLI commands for connect/disconnect, status/battery, reader/emulator toggles, and chameleon savehf/savedump/saventag for .nfc exports
Adds Kconfig support for a secondary status display
Adds Kconfig support for IO Expander
+7 moreshow less
Adds 2 alternate main menu layouts (Grid and List) via WebUI redesign
Adds set/getneopixelbrightness commands and ability to set settings via CLI in serial console
Adds joystick support for keyboard input in terminal view
Adds command history with up/down navigation and full in-line cursor editing to the serial console
Adds 802.15.4 packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. capability (limited to C5, C6 hardware)
Adds Karma attack capability
Adds heartbeat-based auto-reconnect for dual communication
xnLinkFinder v7.3 adds domain-format detection so domain-only input files are correctly processed as URL inputs.
└──▷ GET THIS VERSION
$ git clone --branch v7.3 https://github.com/xnl-h4ck3r/xnLinkFinder.git
# already have the repo? check out this version:$ git checkout v7.3
Adds is_domain_format() function to detect domain/subdomain-formatted lines (e.g., example.com, sub.example.com, example.co.uk), enabling input files and STDIN starting with bare domains to be correctly identified and processed as URL files rather than content files.
1 detail in Everything
1 more release in this issue
· 2025-10-08 → 2025-10-17
waymore v6.2 adds --stream mode for real-time URL output to STDOUT as they are discovered.
└──▷ GET THIS VERSION
$ git clone --branch v6.2 https://github.com/xnl-h4ck3r/waymore.git
# already have the repo? check out this version:$ git checkout v6.2
└──▷ TRY IT
Pipe live URL discoveries into a grep filter during a recon session without waiting for waymore to finish.
$ waymore -i example.com -mode U --stream | grep '\.js'
Stream URLs to STDOUT in real time while also saving a deduplicated copy to a file for later analysis.
$ waymore -i example.com -mode U --stream-oU results.txt
Adds --stream argument to output URLs to STDOUT in real time as they are found (works with -mode U only; use -oU to also save deduplicated results to file).
Enhances --version to display whether the installed version is outdated alongside the version number.
Adds --no-cookies option to disable cookie handling entirely during scans.
Adds --cookie-jar option to persist cookies to a file across a scan session.
Improves cookie retention across redirects for more accurate multi-hop fingerprinting.
New plugin: Cisco Meraki detection.
New plugin: GoAnywhere Web Client detection.
+2 moreshow less
New plugin: Oracle EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. detection.
Collects the netlogon registry key during enumeration, expanding registry-based attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. data.
Adds ObjectId to CompStatus (computer collection status) output for more precise per-host tracking.
Sickle v4 adds new Windows shellcode stubs, a built-in handler module, and EXITFUNC support for staged payloads.
└──▷ GET THIS VERSION
$ git clone --branch v4.0.0 https://github.com/wetw0rk/sickle-pdk.git
# already have the repo? check out this version:$ git checkout v4.0.0
Adds built-in handler module for staged payloads, replacing the Netcat workflow for second-stage stub delivery.
New shellcode stub: windows/aarch64/shell_reverse_tcp — reverse shell for Windows on ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead..
New shellcode stub: windows/x64/egghunter — egg-hunter technique for x64 Windows.
New shellcode stub: windows/x64/virtualalloc_exec_tcp — VirtualAlloc-based exec over TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. for x64 Windows.
New shellcode stub: windows/x64/virtualalloc_exec_https — VirtualAlloc-based exec over HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. for x64 Windows.
+2 moreshow less
New shellcode stub: windows/x64/reflective_pe_loader — reflective PE loader for x64 Windows.
Adds EXITFUNC support to select payloads for controlled shellcode exit behavior.
wifite 2.8.0 adds Hashcat mode 22000 for WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes./WPA2, WPA3WPA3The third generation of the Wi-Fi Protected Access authentication and encryption standard, maintained by the Wi-Fi Alliance, offering stronger handshake protection and per-session encryption compared to WPA2.-SAE hash support, and a new ProcessManager class.
└──▷ GET THIS VERSION
$ git clone --branch 2.8.0 https://github.com/kimocoder/wifite2.git
# already have the repo? check out this version:$ git checkout 2.8.0
Adds support for Hashcat mode 22000 (replaces deprecated mode 2500) for WPA/WPA2 cracking.
Introduces a new ProcessManager class for tracking and cleaning up zombie processes.
Enforces scanner target list size limits (1000 max) and archived target cleanup (500 max, keep newest 300), preventing memory bloat during long scans.
Adds output size limits in the Process class to handle large command outputs without memory exhaustion.
Adds graceful shutdown with escalating signal termination (SIGINT → SIGTERM → SIGKILL).
Build AFL++ without Unicorn, QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware., and Frida backends to reduce build time and dependencies on minimal environments.
$ make NO_UNICORN=1 NO_QEMU=1 NO_FRIDA=1
Adds IJON integration for structure-aware fuzzing guided by user annotations (see docs/IJON.md).
Upgrades unicorn_mode to UnicornAFL v3.
Enables LLVM 22 support in afl-cc.
New AFL_COMPILER_LAUNCHER env var in afl-cc to allow ccache and similar compiler launchers.
Makes AFL_DUMP_MAP_SIZE work for CLASSIC instrumentation modes.
+3 moreshow less
Adds NO_UNICORN, NO_QEMU, and NO_FRIDA build options to selectively disable optional backends.
Adds AIXCC Team Atlanta's ZeroMQ plugin for custom_mutators to ingest testcases from a remote source.
Larger improvements to CMPLOG handling in afl-fuzz.
Adds url_expiration_seconds to Snyk Export API for configurable presigned URL TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit.
Allows setting a custom expiration time for Export API presigned URLs via the url_expiration_seconds attribute (0-3,600 seconds)
Snyk adds Python 3.14 scanning through CLI and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations; projects without a specified Python version must select it in the UI.
Snyk CLI v1.1300.0 adds system JAR scanning behind a flag, Maven metaversion resolution, and SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. runAutomationDetails ID
Adds support for scanning system JARs in Snyk Container (behind a feature flag).
Adds runAutomationDetails to SARIF outputs.
Improves Maven project scanning by correctly resolving metaversions (RELEASE/LATEST).
Snyk adds general availability support for pnpm across CLI and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations.
Veracode Azure DevOps extension v3.33.0 adds automatic SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. work item closure and Node.js 20 support
└──▷ HOW TO FIND IT
Allow the extension to automatically handle lifecycle management for SCA findings without manual intervention.
📍Upgrade to Azure DevOps extension v3.33.0 and allow the automatic tagging logic to run on subsequent flaw imports.
Enables automatic closure of remediated SCA vulnerability work items in Azure DevOps
Adds Node.js 20 support and automatic work item closure for remediated SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. vulnerabilities in the Veracode Azure DevOps extension v3.33.0.
Adds Node.js version 20 support
Enables automatic closure of work items for remediated SCA vulnerabilities
Azure DevOps extension v3.33.0 adds automated tagging and auto-closure for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. work items.
Adds automatic tagging of SCA work items in Azure DevOps to enable tracking of active findings
Enables automatic closure of SCA work items when their associated findings are remediated
Static Analysis Engine v2025.10 adds Semantic Kernel, PySpark, DynamoDB, and FastAPI support with new detection engines.
Adds .NET support for Semantic Kernel KernelContent and Taint Injection
Adds .NET improved detection of third-party code
Adds .NET improved detection of CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-352 flaws
Adds Android skipping of ProGuard-obfuscated classes
Adds Android optimized scan performance to reduce analysis time
+8 moreshow less
Adds C/C++ improved detection of CWE-73 flaws
Adds COBOL automatic copybook detection via enhanced parsing
Adds Java improved detection of CWE-611 flaws
Adds Java enhanced identification of third-party code
Adds Python support for PySpark
Adds Python support for DynamoDB
Adds Python support for FastAPI
Adds cross-language improved detection of CWE-259 and CWE-798 flaws
Veracode adds OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 (2021) secure coding courses in English, Portuguese, and Spanish for .NET, Java, JavaScript, PHP, and Python.
Veracode Scan for Visual Studio v0.6.0 adds OAuth/SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. authentication support
Veracode Scan for Visual Studio v0.6.0 adds OAuth/SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. authentication support
GitLab 18.5 adds Maven virtual registry UI, instance-wide security policy groups, C/C++ Advanced SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., and GPT-5 support
security_report_time_window parameter allows specifying a time window for merge request approval policies to use older baseline security reports
Ping enabled setting on external controls disables automatic status updates from external systems
Instance-wide compliance and security policy groups enable centralized management of frameworks and policies across all top-level groups on Self-Managed/Dedicated instances
Maven virtual registry management now available via a web-based interface in beta, replacing API-only access for routine maintenance
C/C++ support added to Advanced SAST as a beta feature for cross-file and cross-function scanning
+9 moreshow less
secret.validity_checks feature in beta displays the active status of detected GitLab secrets to aid triage
GPT-5 is available as a model option for GitLab Duo Agentic Chat, configurable by Owners/Admins
Customizable detection logic for Advanced SAST allows creating custom security rules tailored to organization requirements
Advanced SAST diff-based scanning in merge requests analyzes only code changes to reduce scan times
Dependency scanning template Jobs/Dependency-Scanning.v2.gitlab-ci.yml is released for generating component vulnerability reports
environment:deployment_tier field now supports CI/CD variable expansion for dynamic configuration
Status lifecycles can be configured independently for issues and tasks, allowing distinct workflows per work item type
GitLab Duo Agent Platform is available in beta for Self-Hosted instances, supporting Anthropic Claude, OpenAI GPT, and compatible models
Mistral Codestral is supported for GitLab Duo Chat (Classic) on Self-Managed instances
Mend SCA 25.10.1 adds Security Assistant MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. integration for real-time vulnerable library replacement in IDEs.
Mend SAST is a static application security testing service that scans source code for vulnerabilities and helps teams prioritize remediation.
Mend SAST 25.10.1 adds Gen 2 C/C++ engine, finding suppression approval workflow, and HTTP handler entry points for JS/TS
Gen 2 C/C++ detection engine with improved CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. and framework coverage
New approval process for security finding suppressions in code repositories
Reading HTTP Handler Methods from an array as entry points for JavaScript/TypeScript
Gen 2 C/C++ engine, finding suppression approval process, JS/TS HTTP entry points, and PR-based repo onboarding in Mend SAST 25.10.1
Introduces the Gen 2 C/C++ detection engine for improved CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. and framework coverage
Adds a new approval workflow for security finding suppressions where developers propose and security managers approve or reject changes
Enables repository onboarding via the first pull request when no prior scans exist, causing initial findings to fail the check rather than becoming backlog
Supports reading HTTP Handler Methods from an array as entry points in JavaScript/TypeScript
Updates SCMs .whitesource or .mend onboarding configuration templates to explicitly list available options
Openlayer adds user/session tracking, test tags, LiteLLM guardrails, and AWS env var support
AWS_SIGNATURE_VERSION environment variable allows setting the AWS signature version for On-Prem deployments.
Adds user_sessions support in the API to track traces per user session.
Adds user-defined tags on tests with filtering capabilities via the API.
Adds batch LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. call support to the API.
StackHawk adds official Semgrep integration for correlating DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. findings
└──▷ HOW TO FIND IT
Correlate static and dynamic analysis results in the StackHawk platform to reduce noise.
📍1. In the StackHawk Platform, navigate to Integrations.
2. Select Semgrep from the list of available integrations.
3. Follow the prompts to link your Semgrep account and enable automatic finding correlation.
LavaMoat webpack plugin adds a meta field to policy resources to surface webpack optimization info.
└──▷ GET THIS VERSION
$ git clone --branch webpack-v1.5.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout webpack-v1.5.0
Adds a meta field to policy resource entries, recording webpack optimization data (e.g. sideEffect tree-shaking) for each module.
Cosign v3 enables protobuf bundle format, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. 1.1 artifacts, and unified trust config by default.
└──▷ GET THIS VERSION
$ git clone --branch v3.0.1 https://github.com/sigstore/cosign.git
# already have the repo? check out this version:$ git checkout v3.0.1
Enables standardized Sigstore protobuf bundle format by default (previously opt-in via --new-bundle-format).
Supports providing roots of trust and service URLs via a single --trusted-root or --signing-config file.
Fetches service URLs from the TUF PGI signing config by default, removing manual service URL configuration.
Makes --bundle flag required (not optional) when writing Sigstore bundle output files.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The --bundle flag (specifying an output file for the Sigstore bundle) is now required rather than optional.
GuardDog v2.7.0 adds DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls.-loading detection, API obfuscation rules, unicode evasion filtering, and Extensions ecosystem support.
└──▷ GET THIS VERSION
$ git clone --branch v2.7.0 https://github.com/DataDog/guarddog.git
# already have the repo? check out this version:$ git checkout v2.7.0
New detection rule for DLL loading patterns in scanned packages.
New rule to detect API obfuscation techniques used to hide malicious behavior.
New filter rule to catch detection evasion via unicode manipulation.
Adds support for scanning the Extensions ecosystem.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The code execution rule now also applies to __init__ files, which may produce new findings on packages that were previously clean.
Adds CSV export capability to the Scans view (SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. Report Page)
Socket Firewall Enterprise adds on-prem HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. proxy deployment, org-wide policy controls, and multi-ecosystem support.
Adds Socket Firewall Enterprise edition with flexible deployment options including long-lived HTTPS proxy for on-prem environments
Adds configurable organization-wide policies to customize which alerts trigger warnings or blocks via integration with Socket's security and license policies
Adds support for Maven, Go modules, RubyGems, and NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. package ecosystems alongside existing JavaScript, Python, and Rust coverage
Introduces MUSL build for improved compatibility with CI pipelines and containerized deployments
Socket adds experimental scanning of GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflows for security and license risks.
Supports scanning GitHub Actions workflows for security and license risks via deep package inspection
Detects malicious or obfuscated code in action dependencies using the Argus taint-tracking engine
Socket launches Basics to unify SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., secret detection, container scanning, CVE checks, and policy management via Dashboard.
Unifies Static analysis (SAST) for 14 programming languages, Secrets detection, Container/Dockerfile scanning, and CVE scanning under one workflow
Centralizes policy management through the Socket Dashboard
Socket Basics expands configuration options for SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., secrets, and notifications with UI updates
Adds over 100 new configuration options for Socket Basics to control security scanning settings
Supports per-language rule customization across 17 language SAST scanners
Enables secret and container scanning configuration via expanded config keys
Adds Socket Tier 1 reachability analysis controls in the configuration
Integrates 12 notification channels (Slack, Jira, GitHub, Microsoft Teams) via config settings
+1 moreshow less
Redesigns the UI with organized sections and an All Languages toggle
Socket introduces experimental supply chain protection for AI models, allowing users to detect hidden payloads in major frameworks and integrate scanning via API or AIBOMAIBOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk..
OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. Index credentials now required; SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. license list updated to 3.27.0
└──▷ GET THIS VERSION
$ git clone --branch 4.13.5 https://github.com/DependencyTrack/dependency-track.git
# already have the repo? check out this version:$ git checkout 4.13.5
Safe Chain 1.1.0 adds a proxy-based blocker for all package managers and Bun support
└──▷ GET THIS VERSION
$ git clone --branch 1.1.0 https://github.com/AikidoSec/safe-chain.git
# already have the repo? check out this version:$ git checkout 1.1.0
Adds a lightweight proxy server that intercepts and blocks downloads of packages containing malware, enabling full dependency tree protection for all package managers.
Adds bun install and bunx command protection via the same malware detection engine used for other package managers.
Syft v1.34.1 adds ffmpeg/libav detection, pnpm v9 lockfile support, and Windows ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. releases.
└──▷ GET THIS VERSION
$ git clone --branch v1.34.1 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.34.1
Detects ffmpeg and libav libraries when generating SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
Supports pnpm lockfile version 9.0 for JavaScript dependency scanning.
Publishes official Windows ARM64 release binaries.
Handles unquoted dependencies in setup.py when cataloging Python packages.
sbomify v0.18 adds user onboarding with email notifications and promo code support for Stripe
└──▷ GET THIS VERSION
$ git clone --branch v0.18 https://github.com/sbomify/sbomify.git
# already have the repo? check out this version:$ git checkout v0.18
└──▷ USE IT
Run sbomify commands using the new UV dependency manager
shell
uv run sbomify --help
Adds a comprehensive user onboarding system that sends email notifications to new users
Adds promo code support for Stripe checkout, allowing discount codes during payment
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Python commands now require uv run instead of poetry run due to migration from Poetry to UV
!Django apps are no longer in the root directory; they are now located under sbomify/apps/
!ASGIASGIA Python async web server interface specification that defines how servers and applications exchange HTTP and WebSocket messages; cyber tools use it to serve high-concurrency APIs without blocking on I/O. server is now Uvicorn instead of Gunicorn for handling requests
Fastly extends its analytics capabilities by introducing the upgrade field in both Historical and Real-Time Stats APIs to track WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. upgrade requests.
Adds upgrade field to Historical Stats API response
Adds upgrade field to Real-Time Analytics API response
2 details in Everything
4 more releases in this issue
· 2025-10-06 → 2025-10-29
Fastly adds false positive reporting endpoint to the Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. Requests API to flag incorrectly blocked traffic.
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. agent 4.71.0 adds FIPS 140-3FIPS 140-3A US federal standard, maintained by NIST, that defines requirements for cryptographic modules used in government systems. Cyber tools target it to satisfy procurement mandates requiring validated crypto. compliance support and improved SQLI detection
└──▷ BREAKING ON UPGRADE
!Ended support for Alpine 3.11 & 3.12, Debian 8, and Ubuntu 12.04
Adds export=true query parameter and text/csv response support to the Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. requests endpoint.
Exports Next-Gen WAF requests as CSV files for offline analysis by setting export=true in the request
Adds Accept: text/csv header support to the requests endpoint to retrieve data in CSV format
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. for NGINX (Native) 1.4.0 adds support for new NGINX/NGINX Plus versions and Ubuntu 26.04.
BunkerWeb v1.6.5 adds a REST control-plane API, HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. for internal API, token auth, reCAPTCHA v3 support, and a new Templates management UI.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.5 https://github.com/bunkerity/bunkerweb.git
# already have the repo? check out this version:$ git checkout v1.6.5
└──▷ USE IT
Limit how long idle UI user sessions persist in the database, reducing stale-session exposure.
yaml
DATABASE_MAX_SESSION_AGE_DAYS=7
Create and apply a reusable service template from the new Templates management page so new services inherit a consistent baseline configuration.
📍In the UI, go to Templates › New Template, define your settings, save, then when creating or editing a service select the template from the Template column in the Services page.
Introduces a dedicated control-plane service exposing a REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. to programmatically list/register instances, trigger reload/stop, and manage bans, plugins, jobs, and configurations.
Adds HTTPS support for BunkerWeb's internal API.
Adds optional API token authentication for BunkerWeb API calls to enable token-based access control.
Adds reason data for bad behavior bans and reports.
Adds session retention configuration via the DATABASE_MAX_SESSION_AGE_DAYS setting in the Database plugin, with an automatic cleanup job to purge old UI user sessions.
+10 moreshow less
Adds support for the new reCAPTCHA version in the Antibot plugin.
Adds the ability to ignore IPs in the DNSBL plugin.
Introduces a Templates management page in the UI to create, edit, clone, and delete service templates.
Adds a new Template column in the services page showing which template a service is based on, with filtering support.
Adds the ability to quickly ban IP addresses directly from the reports page.
Introduces a reloading health status for BunkerWeb when NGINX is reloading.
Updates the default Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. header value to include additional features and remove deprecated ones.
Updates CoreRuleSet to v4.19.0.
All-in-One image updates CrowdSec to v1.7.0 and adds support for disabling specific CrowdSec parsers.
Adds upgrade capability to the easy-install script for seamless in-place Linux package updates.
15 details in Everything
0 more releases in this issue1 more release in this issue · 2025-10-06 → 2025-10-31
Inline node logs are now viewable and filterable in the Security Edge Telemetry Portal.
Adds a new Telemetry Portal → Wallarm → Inline Node Logs dashboard for viewing access and error logs
Adds filtering via facets (region, host, request_method, nginx_status, upstream_status, remote_addr, upstream_addr, request_uri, req_id) with wildcard and regex support
2 details in Everything
1 more release in this issue
· 2025-10-13 → 2025-10-15
Invicti adds Zero-Config API discovery, API-only scans, automated report emailing, and Rediscovered vuln tracking in dashboards.
└──▷ HOW TO FIND IT
Scan only API endpoints to reduce noise and improve speed compared to a full web app scan.
📍In the scan profile, enable API-only capability for the target URL.
Automate report delivery by configuring the system to email a specific recipient upon completion.
📍Configure the new automation feature in Settings › Automation to trigger an email with the scan report.
View newly discovered APIs and their reconstructed specifications directly from the discovery interface.
📍Navigate to the API Discovery view to see reconstructed REST API specifications and filtered third-party APIs.
Added Engine-based Zero-Config API discovery service
Implemented API-only scan capability to improve scan speed and efficiency
Implemented a new automation feature to automatically email a specified scan report upon scan completion
Updated requirements for the Internal Agent to specify CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware., RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed., and disk space
Added an ability to copy custom scan profiles
+4 moreshow less
The Executive and API Insights dashboards now include Rediscovered vulnerabilities in the total open counts
Reconstructed REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. specifications are now displayed in the API Discovery view
Implemented filtering out third-party APIs during web application scans to improve API discovery accuracy
Added an updates panel to the Application dashboard showing last scanned status and tags
9 details in Everything
1 more release in this issue
· 2025-10-09 → 2025-10-23
New jwt-hack scan subcommand for vulnerability scanning, server mode, and --config flag support
└──▷ GET THIS VERSION
$ git clone --branch v2.4.0 https://github.com/hahwul/jwt-hack.git
# already have the repo? check out this version:$ git checkout v2.4.0
Adds jwt-hack scan subcommand to perform JWT vulnerability scanning
Adds jwt-hack server subcommand to enable API server mode
Adds --config flag to specify configuration files from HOME and XDGXDGA set of specifications maintained by freedesktop.org that standardise where Linux applications store config, data, and cache files, letting tools respect user-defined paths instead of hardcoding locations. directories
Enhanced identity graph unifies public leak detection and displays large occurrence patches in incident views
Displays severity levels, source information, and occurrence data directly within the unified identity graph interface for both internal and public monitoring incidents
Adds three distinct types of public exposure categorization to the HasMySecretLeaked integration: secrets in monitored public sources, incidents in your public perimeter, and external GitHub locations
Unifies previously scattered exposure indicators under a new Publicly Leaked tag across Internal Monitoring, Public Monitoring, and NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems. modules
3 details in Everything
3 more releases in this issue
· 2025-10-09 → 2025-10-28
Enhanced Slack notifications now cover incident lifecycle events, public monitoring, and honeytoken alerts with granular per-channel configuration.
Slack notifications now include incident resolution, assignment, status changes, comments, access control, and sharing events in addition to new detections and regressions
Public monitoring incidents can be sent to Slack channels alongside internal monitoring alerts for perimeter security visibility
Honeytoken alerting is now supported in Slack notifications, previously limited to custom webhooks and email
Slack webhook configuration supports subscribing to specific event types per channel for granular notification control
Custom Monitored Perimeter can now be edited via the Public API for all sources except custom sources
GitGuardian Bridge expands to all self-hosted services; adds Generic Secret Enricher v2 and False Positive Remover v2.5
GitGuardian Bridge now supports comprehensive integration with any self-hosted service in private networks, including GitHub Enterprise, GitLab, Jira Data Center, Confluence, Container registry, and custom sources, using flexible domain mapping.
Generic Secret Enricher v2 introduces 50 new providers and enhances enrichment by 75% for public data and 50% for internal data.
False Positive Remover v2.5 improves detection of false positives in secret identifiers, file paths, variable names, and plugin versions; the vendor reports twice as many identified, varying by customer.
Added automatic Jira ticket assignment to incident authors via email matching for both Jira Cloud and Data Center.
Adds gateway CLI helper, MySQL PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. support, GitHub PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. integration and PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. auto-renewal to Infisical v0.153.0
└──▷ GET THIS VERSION
$ git clone --branch v0.153.0 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.153.0
Adds infisical-gateway-deploy interactive CLI command for gateway and relay deployment helpers
Adds MySQL as a supported PAM (Privileged Access ManagementPrivileged Access ManagementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded.) target in the pam integration scope
Adds Personal Access Token (PAT) support for the GitHub integration
Adds certificate auto-renewal and manual renewal workflow support in the PKI subsystem
Adds organization-level option to block duplicate destinations on secret syncs
5 details in Everything
3 more releases in this issue
· 2025-10-13 → 2025-10-29
Adds account credential rotation via PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. for Infisical service accounts and user accounts.
└──▷ GET THIS VERSION
$ git clone --branch v0.152.0 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.152.0
Adds pam subcommand for service-account and user-account credential rotation with a new template-driven policy model.
Moves PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. management to use Template Policies and Certificate Profiles for certificate issuance.
Updates HSMHSMA tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them. backend integration with improved key access workflows.
Introduces new navigation structure in the web UI to reduce clicks for account and secret management.
PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Platform V1, Azure Audit-Log-Stream, Org Relay Registration, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Group Mapping, and more
└──▷ GET THIS VERSION
$ git clone --branch v0.150.0 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.150.0
feat(pam) introduces PAM Platform V1
feat(audit-log-stream) adds Azure support for audit log streams
feat(notifications) expands notification coverage
feature(app-connections) adds support for project scoped app connections
feat(machine-identities) implements LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. Auth Lockout
+8 moreshow less
Dynamic Secrets now supports Temporary Credentials for AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. Roles
feat adds Certificate Syncs and Azure Key Vault Sync
Redis app connection and secret rotation support
Add Azure SQL Database Dynamic Secret support
feat adds SAML group mapping
add qradar as a preview option for log streams adds QRadar as a preview log stream provider
feat(gateway-v2, relays) adds health check on relays and health alerts
TruffleHog finds, verifies, and analyzes leaked credentials across Git, chat, wikis, cloud storage, and more
TruffleHog v3.90.12 adds private repo support for github-experimental and bypass filtering for explicitly listed repositories.
└──▷ GET THIS VERSION
$ git clone --branch v3.90.12 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.90.12
Adds ability to run github-experimental source against private repositories.
Explicitly listed repositories now bypass wantRepo() filtering entirely, ensuring they are always scanned regardless of filter configuration.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The include_repos option has been removed from the GitHub source configuration.
1 more release in this issue
· 2025-10-15 → 2025-10-27
OpenBao v2.4.3 allows BAO_NAMESPACE=root to map to the root namespace and redacts sensitive parameters from audit logs
└──▷ GET THIS VERSION
$ git clone --branch v2.4.3 https://github.com/openbao/openbao.git
# already have the repo? check out this version:$ git checkout v2.4.3
Adds BAO_NAMESPACE=root support: Setting the X-Vault-Namespace header or the BAO_NAMESPACE environment variable to root now maps to the root namespace, eliminating the need for special-case handling of that value.
Introduces redaction of HTTPRawBody response parameters in audit logs to prevent sensitive data leakage (CVE-2025-62513).
Adds automatic redaction of []byte type response parameters in audit logs to prevent binary data leaks (CVE-2025-62705).
New Microsoft Teams attachment scanning, unified leak graph, and incident-based secret revocation in GitGuardian Self-Hosted 2025.10
Adds Microsoft Teams attachment scanning to detect secrets in shared files within incidents.
Adds unified graph with public leak intelligence to correlate internal and public exposures.
Enables secret revocation directly from incidents via the new Secret Revocation workflow.
Adds Context preview for non‑VCS incidents to view surrounding content for leaks in SharePoint, OneDrive, and Confluence.
Adds ggshield vault name and path display to show secret manager details for vaulted secrets.
+3 moreshow less
Updates Helm configuration to change the log collector MinIO image (see breaking changes).
Adds ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. cluster support for Helm deployments alongside existing AMD64 support.
Adds support for the read-only root filesystem constraint in container deployments.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Upgrading to Helm installations changes the MinIO image used in the log collector; you must update your Helm values file.
malwaredb-rs v0.2.0 adds mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing. server advertisement and client discovery, optional label-based search, and pagination for search results.
└──▷ GET THIS VERSION
$ git clone --branch v0.2.0 https://github.com/malwaredb/malwaredb-rs.git
# already have the repo? check out this version:$ git checkout v0.2.0
Adds multicast DNS support so the server can advertise itself on the local network
Client can now discover servers via multicast DNS
New: Client is able to store/retrieve credentials on the Keychain (macOS)
Adds optional search with labels capability for filtering results
Adds pagination of search results for large query sets
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The variables in the API crate have changed, requiring updates to any code using the API library.
!The server response format is now messages instead of just HTTP codes, changing how errors are parsed by clients.
Velociraptor analyzer gains base64 API config support for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. deployments; Slack responder gets improvements.
└──▷ GET THIS VERSION
$ git clone --branch 3.6.1 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.6.1
Adds base64-encoded API configuration support (b64 api configuration) to the Velociraptor analyzer, enabling SaaS deployment scenarios.
Improves the Slack responder with unspecified enhancements.
2 details in Everything
1 more release in this issue
· 2025-10-06 → 2025-10-07
Cortex-Analyzers 3.6.0 adds CIRCL AIL Onion-Lookup analyzer and a Slack responder for channel-to-task sync.
└──▷ GET THIS VERSION
$ git clone --branch 3.6.0 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.6.0
Adds CIRCL AIL Onion-Lookup Analyzer for analyzing onion addresses via the CIRCL AIL platform.
Adds Slack responder to sync created Slack channels into TheHive tasks.
Corellium 7.7 adds iPhone 17/Android 16/iOS 26 support, user-resizable device storage, and live MATRIX risk scores
└──▷ HOW TO FIND IT
Create a new IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. virtual device with custom primary storage size to test boundary conditions on limited flash memory.
📍Configure Your Device › Advanced Boot Options › Storage › set size value (or use pre-configured dropdown for supported flavors)
Track remediation progress by viewing the updated MATRIX risk score in the report's Activity tab after nullifying a high-severity finding.
📍Report › Activity tab › review findings changes and live score updates
Supports iPhone 17 models including iPhone 17 Pro, Pro Max, and Air with instruction-only Memory Integrity Enforcement (MEI) via Arm MTE.
Adds Android 16 as a supported mobile operating system platform.
Adds iOS/iPad OS 26.0.x as a supported mobile operating system platform.
Enables specifying primary storage volume size directly during virtual device creation in Advanced Boot Options and Configure Your Device pages for iOS, Android, and IoT flavors.
Introduces the live MATRIX risk score panel for computing real-time app risk based on vulnerability severity and enabling audit-ready traceability via the Activity tab.
pwndbg 2025.10.20 adds a new kbpf command for kernel BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. introspection and improves page marker detection.
└──▷ GET THIS VERSION
$ git clone --branch 2025.10.20 https://github.com/pwndbg/pwndbg.git
# already have the repo? check out this version:$ git checkout 2025.10.20
Adds kbpf command for inspecting kernel BPF internals during live kernel debugging sessions.
pwndbg 2025.10.10 adds musl mallocng commands, new kernel debug commands, LLDB Objective-C/Mach-O support, and cyclic --detect.
└──▷ GET THIS VERSION
$ git clone --branch 2025.10.10 https://github.com/pwndbg/pwndbg.git
# already have the repo? check out this version:$ git checkout 2025.10.10
└──▷ TRY IT
Detect cyclic pattern offsets automatically across all registers and memory after a crash, instead of manually inspecting each register.
$ cyclic --detect
Inspect musl mallocng heap state for a target binary to find corruption or understand allocator internals during exploit development.
$ ng-dump
During Linux kernel debugging, list loaded kernel modules to identify attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. or verify module state without debuginfo.
$ kmod
New kdmesg command for dumping kernel dmesg during kernel debugging.
New ktask command for dumping kernel task info during kernel debugging.
New kmod command for dumping kernel module info during kernel debugging.
New ksyscall command for dumping kernel syscall info during kernel debugging.
New kdmabuf command for dumping DMA buf info during kernel debugging.
+20 moreshow less
Improved vmmap output for kernel debugging sessions.
New ng-explain command to explain musl mallocng slot layout.
New ng-find command to locate a slot, group, or meta by address in musl mallocng.
New ng-slots command to inspect musl mallocng slots.
New ng-metaarea and ng-ctx commands to inspect musl mallocng internals.
New ng-vis command to visualize the musl mallocng heap.
New ng-dump command to dump musl mallocng heap state.
Adds --detect flag to cyclic command to detect cyclic sequences in registers and memory.
New max-decimal-number config option to set the threshold above which values display in hex instead of decimal.
New disasm-branch-on and disasm-branch-off theme options for branch jump markers in disassembly.
New disasm-reg-alias config option to force disassembly to use register aliases (e.g. aarch64 x29 → fp).
Adds Objective-C and Mach-O support on Darwin under LLDB.
Improved vmmap output on Darwin under LLDB, incorporating DYLD Shared Cache.
New commpage command in LLDB to dump Apple commpage memory mapping.
Adds arm64e architecture support in LLDB.
Adds fzf (fuzzy finder) tab completion in LLDB.
Adds help set command in LLDB.
Adds Go binaries support for mips, loongarch64, and s390x architectures.
Updated Capstone disassembly engine to version 6 alpha5.
Portable releases now include zig, enabling commands such as cyclic in portable builds.
25 details in Everything
└──▷ BREAKING ON UPGRADE
!The PWNDBG_PLEASE_SKIP_VENV environment option is removed; setups that relied on it will break.
!The PWNDBG_DISABLE_COLORS environment option is removed; use NO_COLOR instead.
Cortex Analytics 2025.10.08 adds detections for impaired logging, hidden BCCs, and masquerading processes.
Adds 2 new Medium Analytics BIOCs for 'Logging was impaired via external encryption key' and Suspicious HTTP parameters detected.
Adds 20 new Informational Analytics BIOCs covering process masquerading, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware.EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. snapshot creation, Windows system folder moves, hidden BCC emails, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. instance profile associations, and homograph characters in attachments.
Adds 2 new Informational Analytics Alerts for 'A compromised process accessed a rare cloud resource' and 'Abnormal connections to a dormant host from a newly seen endpoint'.
Removed the Possible Microsoft process masquerading Low Analytics BIOC.
PAN-OS 10.2 adds automatic certificate renewal on passive HA devices via the HA interface.
└──▷ TRY IT
Verify a passive device has successfully renewed its certificate after failover or automatic renewal.
$ show device-certificate status
Passive HA devices now receive certificate updates and renewals through their HA interface connected to the active device when service routes are configured.
PAN-OS 11.1 adds PPPoE client support for IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. on Ethernet Layer 3 interfaces.
Enables dynamic IPv6 address acquisition via stateful or stateless DHCPv6 on PPPoE interfaces
Prisma Cloud adds two new Azure policies for flow logs and Entra-only auth in the October 2025 release.
└──▷ TRY IT
Detect if an Azure Virtual Network has network flow logging disabled to prevent blind spots in traffic monitoring.
$ config from cloud.resource where api.name = 'azure-network-vnet-list' AND json.rule = ['properties.provisioningState'] equal ignore case Succeeded AND flowLogs[*].id does not exist
Check if an Azure SQL Server is configured to use Entra-only authentication, reducing the risk of legacy credential attacks.
$ config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-server-list' AND json.rule = ['sqlServer'].['properties.state'] equal ignore case ready and (['sqlServer'].['properties.administrators'].['azureADOnlyAuthentication'] is false or ['sqlServer'].['properties.administrators'].['azureADOnlyAuthentication'] does not exist)
azure-network-vnet-list API ingestions now expose properties.encryptionProtector and properties.encryptionProtectorAutoRotation fields for Azure SQL Database resource JSON.
azure-security-center-settings API ingestion removes deprecated permissions from the CFT template to align with latest Azure API requirements.
gcloud-ai-applications-cmek-config API ingestion adds new required permission discoveryengine.cmekConfigs.list for Google AI Applications service.
New policy check Azure Network Watcher virtual network flow log is disabled detects absence of network flow logging in Azure Virtual Networks using the azure-network-vnet-list API.
New policy check Azure SQL Server not using Entra-only authentication detects legacy authentication methods on Azure SQL Server by checking the sqlServer.properties.administrators.azureADOnlyAuthentication field.
+9 moreshow less
Updated RQL for Azure Microsoft Defender for Cloud disk encryption monitoring now checks gcLinuxDiskEncryptionMonitoringEffect and gcWindowsDiskEncryptionMonitoringEffect parameters instead of diskEncryptionMonitoringEffect.
Updated RQL for Azure Microsoft Defender for Cloud system updates monitoring now checks systemUpdatesV2MonitoringEffect parameter instead of systemUpdatesMonitoringEffect.
Updated RQL for Azure Microsoft Defender for Cloud security contact additional email now correctly references securityContacts[?any(properties.emails is empty)] instead of properties.email.
Updated RQL for Azure App Service web apps with public network access now includes logic to consider privateLinkIdentifiers to reduce false positives and checks for IP rules allowing 0.0.0.0/0.
Updated RQL for Azure Network Watcher NSG flow logs retention now ensures flowLogsSettings.retentionPolicy.days exists before evaluating the 90-day threshold.
Updated RQL for Azure Network Watcher NSG flow logs disabled now requires flowLogsSettings.storageId to be non-empty before checking if logging is enabled.
Updated RQL for GCP Cloud Run function using default service account now uses state equals ACTIVE instead of status equals ACTIVE for the gcloud-cloud-function-v2 API.
Updated RQL for GCP PostgreSQL log_min_error_statement flag ensures the database flag exists before checking its value against allowed members.
Updated RQL for GCP PostgreSQL log_min_messages flag ensures the database flag exists before checking its value against allowed members.
14 details in Everything
└──▷ BREAKING ON UPGRADE
!The azure-security-center-settings API ingestion no longer includes the autoProvisioningSettings[*] field in the JSON resource as it is unsupported by the Azure API.
!Three Azure Defender policies (adaptive application controls, endpoint protection, and security configurations monitoring) have been deleted.
Sophos MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. API now public; NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. logs include threat score.
SNMP user interface improved in Sophos Central Firewall management
Sophos Firewall 21.5 MR1 adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. email auth, NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. data-center selection, Windows Server 2025 AD SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., and HA passphrase/SSH-key hardening.
└──▷ HOW TO FIND IT
Migrate email notifications from password-based auth to OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 to stay ahead of Gmail dropping password authentication.
📍In the Sophos Firewall admin console, go to Administration › Notification settings, locate the email server configuration, and set the authentication method to OAuth 2.0, then complete the OAuth authorization flow for your Gmail account.
Select a specific NDR data-center region to satisfy data residency requirements rather than using the default lowest-latency selection.
📍In the Sophos Firewall admin console, go to the NDR Essentials settings page and under Data center, choose the required regional location instead of the default automatic selection.
Adds OAuth 2.0 as an authentication method for firewall email notifications, with migration recommended for Gmail accounts.
Adds NDR Essentials data-center location selection to meet regional and data residency requirements, defaulting to lowest-latency location.
Adds threat score visibility in Active threat response logs for NDR Essentials, improving reporting and analytics.
Adds Windows Server 2025 support for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. SSO (NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. and KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application.) authentication.
Adds device_name field to syslog output, capturing the hostname of the firewall that produced the logs to differentiate data sources across multiple firewalls.
+11 moreshow less
Adds HA passphrase complexity requirements — passphrases are no longer auto-generated, requiring administrators to set strong passphrases.
Adds unique SSH host key verification for high availability configurations to prevent man-in-the-middle attacks.
Adds node name and current role information to the ha.log high availability log for improved troubleshooting.
Adds automatic XFRM MTU assignment on route-based VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. tunnels, subtracting maximum IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. overhead from the physical interface MTU to prevent packet fragmentation.
Adds firewall hostname, firmware version, serial number, and model to backup email subject lines for easier multi-firewall management.
Adds Created date column to the hotspot vouchers page in the user portal, with sortable voucher listing.
Adds RFC compliance for SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. MIB files, supporting SNMPv1 (RFC 1157), SNMPv2 (RFCs 1901, 1905, 1906), and SNMPv3 (RFCs 3411–3418).
Adds resizable columns to network menu pages, SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. routes and profiles, gateways, and local service ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. exception rules, persisted in browser memory.
Enables localization for scheduled PDF reports, automatically generated in the administrator's sign-in language.
Disables L2TP and PPTP by default when importing groups from Active Directory and Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. authentication servers.
Optimizes DPDK memory in the DAQ layer for XGS 87, 87w, 107, 107w, 116, and 116w desktop firewalls, eliminating out-of-memoryout-of-memoryAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process. instances.
16 details in Everything
└──▷ BREAKING ON UPGRADE
!RED system host objects are now assigned a /32 subnet mask instead of the subnet mask configured at interface creation time; firewall rules or configurations that relied on the RED system host matching a non-/32 subnet will no longer match traffic and must be updated to use the correct IP host or network host.
!LINCE mode must be enabled on both HA devices before configuring HA, and a restored HA backup requires the receiving devices to match the backup's LINCE status.
!L2TP and PPTP are no longer turned on by default when importing groups from Active Directory and Microsoft Entra ID; groups or VPN configurations that previously relied on this default must explicitly enable L2TP or PPTP.
Sophos Central adds resiliency icons on the System details page to visualize switch stack connection health
└──▷ HOW TO FIND IT
Visually monitor the health of stacked switch uplinks directly from the web console to identify saturation risks without calculating percentages manually.
📍In Sophos Central, navigate to Switch › System details and check the connection resiliency icons in the stack topology view.
Adds visual resiliency indicators (Green/Orange/Red icons) on the System details page to show link speed, Rx/Tx transfer rates, and port utilization thresholds for connections within a stack.
NetPerfMeter dissector adds QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. support; Mongo displays command name.
Adds NetPerfMeter dissector with QUIC protocol support
mongo dissector now includes the command name in the Info column
2 details in Everything
4 more releases in this issue
· 2025-10-05 → 2025-10-26
Wireshark adds dsraddresstositenames dissection, GNSS Galileo OSNMA support, Bluetooth UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. registration, and Ubiquiti AP parsing.
Netlogon dissector now decodes dsraddresstositenames[ex]w fields
New support for dissecting GNSS Galileo OSNMA DSM-PKR
Register Bluetooth UUID type in the protocol hierarchy
Added parsing logic for Ubiquiti AP names
TLS dissector handles Abbreviated Handshake Using New Session Ticket (RFC 9132)
Wireshark 4.6.0 adds NTP over NTS decryption, Zstd HTTP compression, new Plots dialog, and extensive protocol/decoding support.
Adds NTP packet decryption using Network Time Security (NTS), requiring NTS-KE packets and TLS client/exporter secrets.
Adds support for Zstandard (zstd) Content-Encoding in HTTP and HTTP/2 dissectors.
Adds a new Plots dialog providing scatter plots, supporting multiple plots, markers, and automatic scrolling.
Adds X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. certificate export via File › Export Objects (X509AF) and TShark --export-objects x509af.
Adds float and double display filter functions for explicit type conversion in filters and custom columns.
+2 moreshow less
Adds the Conversation object to the Lua API, exposing conversation data to scripts.
Adds support for importing hex dumps with 2-4 byte groups (little-endian option) and 0x prefixes.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!tshark -G with no argument is removed; use tshark -G fields instead.
!tshark -G fields syntax for prefix listing changed to tshark -G fields,prefix.
!Wireshark and TShark no longer support WinPcap; Windows users must uninstall it and use Npcap.
Zeek v8.0.3 adds tls_options_websocket for TLS configuration on the management controller's WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. server.
└──▷ GET THIS VERSION
$ git clone --branch v8.0.3 https://github.com/zeek/zeek.git
# already have the repo? check out this version:$ git checkout v8.0.3
Netcap v0.7.6 adds per-execution performance metrics, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. stream size limits, and multi-file processing summaries.
└──▷ GET THIS VERSION
$ git clone --branch v0.7.6 https://github.com/dreadl0ck/netcap.git
# already have the repo? check out this version:$ git checkout v0.7.6
Adds extensive performance metrics and a performance.log file written on every execution, with improved error handling and feedback.
Adds stream size limits for TCP reassembly to bound memory consumption during large captures.
Adds a summary table at the end of multi-file processing runs, with panic catching and logging to file.
Adds a Windows AMD64 build (no-DPI), expanding platform support beyond macOS and Linux.
Adds musl-based Linux builds for Alpine Linux and minimal container environments.
5 details in Everything
2 more releases in this issue
· 2025-10-22 → 2025-10-25
Netcap v0.7.5 adds DPI results for more record types, a decoder tree view, wildcard multi-file input, and a new dpi-modules flag.
└──▷ GET THIS VERSION
$ git clone --branch v0.7.5 https://github.com/dreadl0ck/netcap.git
# already have the repo? check out this version:$ git checkout v0.7.5
└──▷ TRY IT
Inspect all available decoders and their encapsulation hierarchy before deciding what to capture or filter.
$ net util -decoders
Adds DPI results to additional audit record types, broadening protocol/application classification coverage beyond previously supported records.
New --dpi-modules flag lets practitioners configure which DPI frameworks (nDPInDPIAn open-source deep packet inspection library maintained by ntop that classifies network traffic by protocol and application, giving cyber tools visibility into what flows are actually carrying beyond port numbers., libprotoident, etc.) are used during analysis.
New net util -decoders subcommand displays an overview of all available decoders and their encapsulation levels, including a tree view.
Supports providing multiple input PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic./audit files via wildcard or shell expansion for batch processing.
Populates IPProfile.Applications field with DPI-derived application data.
+1 moreshow less
CSV output now uses semicolon as the default field separator, with commas used to separate multi-values within a field.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The CSV default separator is changed to semicolon (previously comma); pipelines or scripts parsing netcap CSV output with comma delimiters will break.
Netcap v0.7.0 integrates a DB hosting server, daily IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. feeds from dbs.netcap.io, and upgrades nDPInDPIAn open-source deep packet inspection library maintained by ntop that classifies network traffic by protocol and application, giving cyber tools visibility into what flows are actually carrying beyond port numbers. to v4.
└──▷ GET THIS VERSION
$ git clone --branch v0.7.0 https://github.com/dreadl0ck/netcap.git
# already have the repo? check out this version:$ git checkout v0.7.0
└──▷ TRY IT
Pull the latest IOC databases from dbs.netcap.io before a threat-hunting session so detections are up to date.
$ net util -download-dbs
Adds integrated DB hosting server into the netcap binary; databases are now served from dbs.netcap.io by default and regenerated daily with the latest IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself..
New net util -download-dbs command to pull the latest IOC databases on demand.
Supports self-hosted DB generation service as an alternative to the default dbs.netcap.io.
Upgrades nDPI from v3 to v4 (v4.14) with updated go-dpi bindings and libprotoident, expanding deep packet inspection coverage.
Switches from the unmaintained dreadl0ck/gopacket fork to the actively maintained gopacket/gopacket fork.
Security Onion 2.4.190 adds BYOH hypervisor support, exclusion toggles, CSV delimiter config, OOMOOMAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process. detection, and upgrades Elasticsearch to 8.18.8.
└──▷ GET THIS VERSION
$ git clone --branch 2.4.190-20251024 https://github.com/Security-Onion-Solutions/securityonion.git
# already have the repo? check out this version:$ git checkout 2.4.190-20251024
Adds Bring Your Own Hypervisor (BYOH) support, enabling users to create VMs that mount a virtual disk for /nsm.
Introduces a new nsm_total grain for tracking total NSM storage across virtual disk mounts.
Adds an exclusion toggle in the UI for managing detection exclusions.
Adds OOM (out-of-memoryout-of-memoryAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process.) check to so-log-check for proactive health monitoring.
Adds CSV delimiter configuration and query name support for data export workflows.
+7 moreshow less
Adds a new field for assistant health check status.
Adds filter support in the relevant UI views.
Adds new configuration entries for expanded service customization.
Implements host OS overhead calculation based on node role for more accurate resource planning.
Upgrades Elasticsearch to version 8.18.8.
Supports non-async Salt state apply for synchronous configuration management operations.
Updates the default AI investigation prompt for improved analyst guidance.
Abnormal AI introduces automatic removal of malicious calendar invites linked to remediated emails and a new Calendar Invite Attack Insight.
└──▷ HOW TO FIND IT
Use guided setup to grant Graph APIGraph APIMicrosoft's unified REST API for accessing data across Microsoft 365 services — mail, calendar, users, files — letting cyber tools query or monitor cloud environments through a single authenticated endpoint. and PowerShell permissions for automated remediation of malicious calendar invites.
📍Initiate the guided setup in the Abnormal console to grant Graph API and PowerShell permissions for deletion and restoration.
Adds automatic detection and deletion of .ics and embedded calendar events tied to remediated messages
Surfaces calendar-based attack activity directly in the Threat Log for faster investigation
Abnormal AI adds explainability for URL rewriting via Click Tracking Dashboard visibility and SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. click-event publishing.
URL Rewriting now displays the specific reason a link was rewritten to improve user trust and reduce false-positive perception.
Abnormal AI adds realistic credential phishing simulations with just-in-time coaching for Google, Microsoft, LinkedIn and other platforms
Adds support for credential phishing simulations mimicking Google, Microsoft, LinkedIn, X, Apple, Stripe, and GitHub to identify employees willing to enter credentials.
Self-service branded video training generation in AI Phishing Coach
└──▷ HOW TO FIND IT
Configure automated video generation without support tickets by navigating the settings interface.
📍In the console, go to Settings › AI Phishing Coach. Underneath Generate Video Training Content, upload your company logo and a short description. Save changes to generate training videos automatically.
Rspamd 3.13.2 adds Metadefender hash lookups, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. user/domain context, Vault KV v2, fuzzy split keys, and DMARC RUA exclusions.
└──▷ GET THIS VERSION
$ git clone --branch 3.13.2 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:$ git checkout 3.13.2
New Metadefender hash lookup module enables file-hash reputation checks against the Metadefender cloud.
Adds user/domain context support for LLM-based email classification, allowing per-user or per-domain tuning of AI-driven decisions.
Supports HashiCorp Vault KV version 2 for secret storage, enabling use of versioned KV secrets in Rspamd configuration.
Adds separate encryption keys for read and write operations in the fuzzy_check module, enabling split-key access control on fuzzy hash storage.
Adds RUA address exclusion support in dmarc.lua, allowing specific reporting addresses to be suppressed from DMARC aggregate reports.
Snort3 3.9.6.0 adds AppID Lua detector API, QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. logging events, and an HTTP encoding-type inspection API.
└──▷ GET THIS VERSION
$ git clone --branch 3.9.6.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.9.6.0
Adds setUserDetectorDataItem Lua detector API to AppID for setting user detector data items programmatically.
Adds QUIC logging events via pub_sub, enabling visibility into QUIC traffic flows.
Adds an API in HttpEvent to determine whether an HTTP response uses a supported encoding type.
Adds a log message when Snort is unable to set CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. affinity, improving operational diagnostics.
Extends trace output to print n-tuple information for non-TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. packet types that have an IP layer set.
CrowdSec v1.7.1 adds WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. glob includes, FQDN alert metadata, auditd detection, and AWS SDK v2 for cloud datasources.
└──▷ GET THIS VERSION
$ git clone --branch v1.7.1 https://github.com/crowdsecurity/crowdsec.git
# already have the repo? check out this version:$ git checkout v1.7.1
WAF: stores the target FQDN in alert metadata for richer context in WAF-triggered alerts.
WAF: supports glob patterns when including SecLang rule files, enabling flexible rule-set organization.
WAF: adds fromFile match type for WAF rules, allowing match lists to be loaded from external files.
Adds cscli setup detection support for auditd, expanding automatic service discovery.
Updates Kinesis, CloudWatch, and S3 datasources to AWS SDK v2.
cloud-nuke v0.44.0 adds tag-based filtering support for ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. services, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. launch templates, and CloudMap namespaces/services.
└──▷ GET THIS VERSION
$ git clone --branch v0.44.0 https://github.com/gruntwork-io/cloud-nuke.git
# already have the repo? check out this version:$ git checkout v0.44.0
Adds tag filtering support for ECS services, enabling inclusion/exclusion of services by tag when nuking.
Adds tag filtering support for CloudMap namespaces and services.
Prowler 5.13.0 adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. and LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. providers, MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface., API key auth, PDF ThreatScore reports, and new AWS/GCP checks.
└──▷ GET THIS VERSION
$ git clone --branch 5.13.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 5.13.0
└──▷ TRY IT
Scan Oracle Cloud Infrastructure against the CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. 3.0 benchmark after authenticating a local OCI session.
$ oci session authenticate && prowler oci
Run a comprehensive LLM red team evaluation (OWASP LLM Top 10OWASP LLM Top 10A ranked list of the ten most critical security risks specific to large language model applications, maintained by OWASP, giving cyber tool developers a shared taxonomy for prioritizing LLM attack surfaces., MITRE ATLASMITRE ATLASA MITRE-maintained knowledge base of adversarial tactics and techniques targeting AI and machine learning systems, modelled on ATT&CK, giving cyber tools a structured taxonomy for AI-specific threat modelling., NIST AI RMFNIST AI RMFA voluntary framework published by NIST that gives organizations a structured process for identifying, assessing, and managing risks introduced by AI systems, giving cyber tools a common vocabulary and governance scaffold.) against an AI/LLM target.
$ npm install -g promptfoo && prowler llm
New prowler oci provider with full Oracle Cloud Infrastructure support and CIS 3.0 benchmark coverage (CLI).
New prowler llm provider for AI/LLM red team security testing via promptfoo, covering OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. LLM Top 10, MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATLAS, and NIST AI RMF with 5000+ test cases (CLI).
Launches the Prowler MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server, exposing Prowler Cloud, Hub, and documentation to MCP-compatible AI assistants (Claude Desktop, Cursor) over STDIO or HTTP.
Adds native API key authentication for programmatic access to the Prowler API, suitable for CI/CD and third-party integrations.
Enables PDF export of Prowler ThreatScore reports for stakeholder presentations and compliance audits.
+9 moreshow less
Findings and Findings Severity Overview API endpoints now support provider_id and provider_id__in filter parameters for multi-cloud reporting.
Adds database read replica support for horizontal scalability, configurable via environment variables.
Adds new check ec2_instance_with_outdated_ami for AWS.
Adds new check cloudstorage_bucket_lifecycle_management_enabled for GCP.
Adds C5 compliance framework support for AWS (German cloud requirements).
Adds Common Cloud Controls compliance framework across AWS, Azure, and GCP.
Adds certificate-based authentication for M365/Microsoft Entra, replacing deprecated username/password auth.
Standardizes metadata format across 15+ AWS services, including inline NativeIaC and Terraform remediation code.
Adds Prowler Hub menu item and Markdown/AdditionalURLs support in the findings detail UI.
14 details in Everything
└──▷ BREAKING ON UPGRADE
!The MANAGE_ACCOUNT permission is now required to modify or read user permissions instead of MANAGE_USERS.
!M365 username/password authentication is deprecated and no longer supported; certificate-based authentication is required.
!At least one user with MANAGE_ACCOUNT permission is now required in each tenant.
Inspektor Gadget v0.45.0 adds a new tcpdump gadget with generic packet filters, PIE symbolization, and Notation signature verification.
└──▷ GET THIS VERSION
$ git clone --branch v0.45.0 https://github.com/inspektor-gadget/inspektor-gadget.git
# already have the repo? check out this version:$ git checkout v0.45.0
Introduces generic packet filters and a new tcpdump gadget for packet-level capture and filtering via eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic..
Adds PIE (Position Independent Executable) support in the symbolizer, enabling accurate user-space stack symbolization for PIE binaries.
Adds Notation-based signature verification for gadget artifacts alongside the existing Cosign support.
Supports runtime/Kubernetes filtering in localmanager and kubemanager, enabling more granular gadget targeting.
Adds a buildid field to ustack output to support client-side symbolization workflows.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The undeploy command removes legacy logic for deleting old IG deployments — clusters with older Inspektor Gadget deployments may not be cleaned up correctly on upgrade.
!In the trace_exec gadget, arguments are now joined with a non-breaking space (nbsp) instead of a regular space, which may break parsers or scripts that split on whitespace.
Grype v0.101.0 adds fixed-state filtering to db search, VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. support for directory/SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. scans, and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. RpmMetadata.
└──▷ GET THIS VERSION
$ git clone --branch v0.101.0 https://github.com/anchore/grype.git
# already have the repo? check out this version:$ git checkout v0.101.0
Adds fixed-state filtering to grype db search so practitioners can narrow vulnerability lookups to only fixed (or only unfixed) entries.
Supports VEX documents when scanning directories and SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., enabling VEX-based vulnerability suppression beyond just container images.
Adds CycloneDX output support for RpmMetadata, enriching CycloneDX SBOMs with RPM package details.
Adds experimental_force_guest_pull support, new TEE configs for runtime-rs (TDXTDXIntel Trust Domain Extensions, a CPU feature that creates hardware-isolated virtual machines whose memory is encrypted and inaccessible even to the hypervisor, letting tools run workloads in a confidential computing environment. QGS port=0, Dragonball seccomp), and nydus/erofs snapper selection in kata-deploy
└──▷ GET THIS VERSION
$ git clone --branch 3.22.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:$ git checkout 3.22.0
runtime-rs: add seccomp support for dragonball enables Seccomp filtering within the Dragonball VMMVMMA Virtual Machine Monitor is software that creates and manages virtual machines, abstracting physical hardware so multiple OS instances run in isolation; cyber tools use it to sandbox execution or emulate target environments safely..
runtime: config: allow TDX QGS port=0 allows setting qemu.qgs_port to 0 in the configuration.
kata-deploy: Allow users to set experimental_force_guest_pull adds a helm chart option to force guest-side image pulling.
kata-deploy: Add the ability to set up different snapshotters (nydus & erofs) allows configuring the container runtime snapper in the deployment manifest.
runtime-go | kata-deploy: Add Arm CCA confidential Guest Support enables support for Arm Confidential Computing Architecture.
Plerion adds attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis for Azure environments
└──▷ HOW TO FIND IT
Explore how risks link across your Azure environment to identify where to focus fixes.
📍View the attack paths in action
Enables exploration of risk links across Azure environments via attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately.
Plerion 2025-10-08 adds attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. visualization for Azure environments.
Enables exploration of risk links across Azure infrastructure via attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..
Falco 0.42.0 adds live .scap capture recording, static output fields, thread-table auto-purging, and mimalloc support.
└──▷ GET THIS VERSION
$ git clone --branch 0.42.0 https://github.com/falcosecurity/falco.git
# already have the repo? check out this version:$ git checkout 0.42.0
└──▷ USE IT
Attach a static environment label to every alert — useful for distinguishing prod vs. staging alerts in a shared SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
yaml
static_fields:
environment: production
cluster: k8s-us-east-1
Enable automatic thread-table purging to reclaim memory in long-running deployments with high process churn.
New ability to record live .scap capture files directly from a running Falco instance.
Adds static_fields configuration option to attach statically defined key-value fields to every Falco alert output.
Adds falco_libs.thread_table_auto_purging_interval_s and thread_table_auto_purging_thread_timeout_s config options to automatically purge stale thread-table entries.
Logs plugin name and version at plugin load time for easier auditability of loaded plugin inventory.
Engine now emits a warning when rules use the deprecated evt.dir field in conditions or output strings.
+3 moreshow less
Adds mimalloc allocator support for improved memory performance.
Docker images now include the source SHA in image labels for supply-chain traceability.
Falco v0.42.0 adds static fields, scap capture, thread table purging, plugin version logging, and mimalloc support
Adds falco_libs.thread_table_auto_purging_interval_s and thread_table_auto_purging_thread_timeout_s configuration options to control automatic thread table cleanup
Adds ability to define static fields via the static_fields configuration section in falco.yaml
Adds the ability to record .scap files (capture feature) for post-capture analysis
Logs plugin version information at loading time for easier troubleshooting
Emit a warning when a rule contains the deprecated evt.dir field or uses it in conditions
+2 moreshow less
Includes SHA hashes on Docker image labels for provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. verification
Adds mimalloc support via CMake configuration options
Tetragon is an eBPF-based security observability and runtime enforcement tool for Kubernetes and cloud-native environments.
Tetragon v1.6.0 adds USDTUSDTUserspace Statically Defined Tracing probes, a mechanism originating in Solaris and adopted by Linux, that lets a program embed named hook points so debuggers and tracers can attach at runtime with near-zero overhead when idle. sensor, uprobe override action, ring buffer support, range filters, and per-policy action counters.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.0 https://github.com/cilium/tetragon.git
# already have the repo? check out this version:$ git checkout v1.6.0
└──▷ TRY IT
Check whether the running kernel supports the eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. features Tetragon requires before deploying policies.
$ tetra probe config
Override the Tetragon Operator to run as root when your environment requires it (e.g., restricted node policies).
Adds USDT (User Statically Defined Tracing) sensor with action support, set action, sibling argument parsing, and resolve support in USDT tracing policies.
Adds uprobe override action for modifying program behavior at uprobe attachment points.
Adds bpf_prog argument type support for kprobes, enabling introspection of BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. programs.
Supports BPF ring buffer as the default event transport on kernels v5.11 and later for improved performance.
Adds range filter support for selectors in tracing policies.
+8 moreshow less
Adds per-policy action counters to TracingPolicy, exposing how many times each action has fired.
Adds pod.uid field to the Kubernetes Pod API, surfacing pod UIDs in events.
Adds container name regex filtering for tetra getevents.
Adds tetra probe config command to check kernel configuration compatibility.
Adds export.stdout.envFromSecrets Helm value to inject environment variables from Kubernetes Secrets into the export stdout process.
Adds nameOverride Helm support for the tetragon-rthooks component.
Enables k8s control plane metadata enrichment for non-Kubernetes (standalone) deployments.
Tetragon Operator now defaults to running as non-root (UID 65532); a new tetragonOperator.runAsRoot Helm option allows overriding this.
13 details in Everything
└──▷ BREAKING ON UPGRADE
!The --enable-process-ancestors boolean flag has been removed; configurations using this flag will fail on upgrade.
!The Tetragon Operator now runs as non-root (UID 65532) by default; workloads relying on root-based operator behavior must set tetragonOperator.runAsRoot: true to preserve the previous behavior.
Supervisor Agent now supports Unity Catalog functions and external MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers as tools
Adds support for Unity Catalog functions as tools in Supervisor Agent
Adds support for external MCP (Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) servers as tools in Supervisor Agent
Databricks extends its Model Serving capabilities to include Google's Gemini 2.5 Pro and Flash models for pay-per-token usage.
Adds Gemini 2.5 Pro and Gemini 2.5 Flash to supported model list in Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves. pay-per-token endpoint
Databricks adds Zerobus Ingest connector in Lakeflow Connect (Public Preview) for record-by-record gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. ingestion into Delta tables.
This release introduces tagging capabilities for Dashboards and Genie Agents in Databricks, allowing users to organize resources and trigger automated processes such as warehouse assignment based on tag values like Work in progress or Certified.
This release marks the general availability of Declarative Automation Bundles, allowing users to collaboratively manage bundle updates within the Databricks workspace interface.
Mosaic AI Model Serving adds multimodalmultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. input support for Databricks-hosted foundation models via paid APIs and AI Functions.
Adds multimodal input support to Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves. (pay-per-token and provisioned throughput) for hosted foundation models
Enables multimodal inputs in both real-time inference and batch inference workloads via AI Functions
Databricks releases SQL MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server in beta, allowing AI agents to execute queries against Unity Catalog via a new API endpoint.
Adds the https://<workspace-hostname>/api/2.0/mcp/sql endpoint for the SQL managed MCP server
Mosaic AI Model Serving adds Anthropic Claude Sonnet 4.5 as a Databricks-hosted model with Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves. support
Databricks Git folders now allow configuring a separate email identity for commits via GIT_AUTHOR_EMAIL and GIT_COMMITTER_EMAIL environment variables
Adds support for specifying a custom Git provider email address in Databricks Git folders that is used as both the author and committer identity for commits
Exabeam New-Scale October 2025 adds Salesforce/Snowflake collectors, IP-based UI/API restrictions, expanded search context tables, and new registry analytics rules.
Adds Salesforce EventLog Cloud Collector to ingest event data from the Salesforce cloud.
Adds Snowflake Cloud Collector for Login History, Others, and Query History event types.
Adds Broadcom Carbon Black Cloud Collector in Early Access to ingest Alerts, Events, and Audit Logs from storage buckets.
Enables import and export of JSON configuration settings for the REST API Cloud Collector via the Early Access program.
Adds a new IP-Based Access page in Settings to restrict UI and public API access by IP address or range.
+12 moreshow less
Adds an Entities tab in the Search Details panel to view user entity information and pivot to timelines directly from search results.
Expands context table display in Search results, showing source table name, column, and extracted value in purple chips within List/Timeline views.
Increases analytics rule description character limit to 1,024 characters in the analytics rule builder.
Makes actOnCondition mandatory and trainOnCondition mandatory/true (defaulted to true) for factFeature rules created via JSON.
Removes configurability of trainOnCondition in the analytics rule builder for factFeature rules, defaulting it to true.
Makes value optional for factFeature rules in JSON configuration.
Makes Count per field optional for numericCountProfiledFeature, numericDistinctCountProfiledFeature, and numericSumProfiledFeature rules in the builder.
Adds 30+ new pre-built analytics rules focused on registry manipulations, service configurations, and DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. registrations.
Excludes Advanced Analytics rules with session-end events from coverage calculations, marking them as Unsupported.
Enhances Event tab Parsed Fields in Details panel to show expanded context table records with arrows indicating the source column.
Adds host-to-IP enrichment using a dynamic mapping table for logs matching specific activity types by default.
Allows customization of host-to-IP enrichment conditions (activity types, outcomes, vendors) via Early Access program.
17 details in Everything
└──▷ BREAKING ON UPGRADE
!trainOnCondition is no longer configurable in the analytics rule builder for factFeature rules and defaults to true.
!actOnCondition becomes a mandatory field when creating factFeature rules via JSON.
New Chrome Enterprise Premium integration with Safe Browsing logs, curated dashboards, and SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. actions for extension management.
└──▷ HOW TO FIND IT
Use the new SOAR action to automatically block a malicious Chrome extension from your organization's devices.
📍In the SOAR workflow, trigger the Block Extension action for a specific extension ID.
View the new pre-built visualization to monitor Chrome Enterprise Premium security posture and Safe Browsing events.
📍Navigate to the Chrome Enterprise Premium dashboard in Google SecOps.
Adds Streamlined connection to Google SecOps for Chrome Enterprise Premium using recommended security defaults
Adds Enhanced log events with Google Safe Browsing context for Chrome logs
Adds Curated dashboards for Chrome Enterprise Premium in Google SecOps
Adds Google Workspace SOAR actions Block Extension and Delete Extension to manage Chrome extension blocklist policies
4 details in Everything
5 more releases in this issue
· 2025-10-03 → 2025-10-29
Adds ENTITY_RISK_CHANGE UDM event type for YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. rules triggering on entity risk score shifts
└──▷ TRY IT
Write a rule to alert when any entity's risk score increases significantly without needing specific log events.
Google SecOps Oct 7 2025 introduces preview feature to manage pre-built parser versions including opt-in/out for updates and manual revert capabilities.
└──▷ HOW TO FIND IT
Review and revert a specific pre-built parser to a previously stable version via the management interface.
📍In the SecOps console, navigate to Parser Management › Pre-built Parsers › AZURE_AD_CONTEXT › Version History, select the previous stable version, and click Revert.
Adds granular control over pre-built parser versions in preview, allowing users to opt in or out of automatic updates, compare processing logic between versions, manually update parsers, and revert to previous stable versions.
Google SecOps adds new parser documentation for AlphaSOC, Cisco vManage, Citrix, and Tanium log sources.
└──▷ HOW TO FIND IT
Configure your log ingestion pipeline to collect and normalize Tanium Asset logs using the new documentation.
📍In the console, go to Ingestion settings › Select Tanium Asset and follow the configuration guide in the new parser documentation.
Set up log collection for Cisco vManage SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. devices.
📍In the console, go to Ingestion settings › Select Cisco vManage SD-WAN and follow the configuration guide in the new parser documentation.
New parser documentation available to ingest and normalize logs from AlphaSOC alert logs
New parser documentation available to ingest and normalize logs from Cisco vManage SD-WAN logs
New parser documentation available to ingest and normalize logs from Citrix Analytics logs
New parser documentation available to ingest and normalize logs from Citrix Monitor Service logs
New parser documentation available to ingest and normalize logs from Citrix StoreFront logs
+24 moreshow less
New parser documentation available to ingest and normalize logs from Delinea SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. logs
New parser documentation available to ingest and normalize logs from SailPoint IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. logs
New parser documentation available to ingest and normalize logs from Sentry logs
New parser documentation available to ingest and normalize logs from Snipe-IT logs
New parser documentation available to ingest and normalize logs from Sophos AV logs
New parser documentation available to ingest and normalize logs from Sophos Capsule8 logs
New parser documentation available to ingest and normalize logs from Sophos DHCP logs
New parser documentation available to ingest and normalize logs from Sophos Intercept EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. logs
New parser documentation available to ingest and normalize logs from Swimlane Platform logs
New parser documentation available to ingest and normalize logs from Symantec WSS logs
New parser documentation available to ingest and normalize logs from Tailscale logs
New parser documentation available to ingest and normalize logs from Tanium Asset logs
New parser documentation available to ingest and normalize logs from Tanium audit logs
New parser documentation available to ingest and normalize logs from Tanium Comply logs
New parser documentation available to ingest and normalize logs from Tanium Discover logs
New parser documentation available to ingest and normalize logs from Tanium Insight logs
New parser documentation available to ingest and normalize logs from Tanium Integrity Monitor logs
New parser documentation available to ingest and normalize logs from Tanium Patch logs
New parser documentation available to ingest and normalize logs from Tanium Question logs
New parser documentation available to ingest and normalize logs from Tanium Reveal logs
New parser documentation available to ingest and normalize logs from Tanium Stream logs
New parser documentation available to ingest and normalize logs from Tanium Threat Response logs
New parser documentation available to ingest and normalize logs from TeamViewer logs
New parser documentation available to ingest and normalize logs from Tines audit logs
Wazuh v4.14.0 adds syscollector inventory fields, hot config reload for Linux agents, Amazon Inspector v2 support, and new REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints.
└──▷ GET THIS VERSION
$ git clone --branch v4.14.0 https://github.com/wazuh/wazuh.git
# already have the repo? check out this version:$ git checkout v4.14.0
Added system users and groups to the inventory data (Manager/Agent)
Added browser extensions and services to the inventory data (Manager/Agent)
Added IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support to Maltiverse integration
Added capability to do a hot configuration reload in Linux agents
Added support for Amazon Inspector v2
+2 moreshow less
Added syscollector users and groups endpoints to the RESTful API
Added syscollector services and browser_extension endpoints to the RESTful API
RunReveal adds custom ClickHouse views, detection testing with 30-day log validation, and new data source integrations.
Adds support for creating reusable SQL views in the workspace to define complex data transformations once.
Enables testing and validating detections before saving them by scanning the last 30 days of logs for matches.
Adds FireHydrant as a supported data source connector.
Adds AWS WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. as a supported data source connector.
Adds Linear Audit Logs as a supported data source connector.
+3 moreshow less
Adds SentinelOne Endpoint Logs (blob storage version) as a supported data source connector.
Enforces fine-grained role-based access controls across the UI for dashboards, notifications, destinations, enrichments, topics, and pipelines.
Adds AI chat cancellation to stop queries mid-execution.
ESET PROTECT 6.5 adds low deployment rate MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. warnings, Windows Server install task parameters, and Vulnerability & Patch Management diagnostic logs.
Install only when reboot is not needed parameter added to Software install task for Windows Servers
Option to enable diagnostic logs for Vulnerability & Patch Management
Low deployment rate warnings in MDR monthly reports and email notifications
Sophos Core Agent 2025.2.1.709 adds trusted network detection via DNS for ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. agents and process-level exclusion for CredGuard.
Adds DNS-based trusted network detection for ZTNA agents to bypass traffic interception and reduce latency for local resources like CIFS and RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely.
Trend Vision One adds automatic analysis of user-reported emails and bulk mitigation via Correlated Intelligence policies in CEC Protection
Cloud Email and Collaboration Protection automatically analyzes user-reported suspicious emails to identify threats like phishing or spam and key indicators such as malicious URLs or suspicious senders.
Administrators receive a list of recent emails sharing similar suspicious indicators from the reported message, enabling manual or automatic actions to mitigate identified threats.
Trend Vision One ZTSAZTSAZero Trust Security Architecture: a network access model where no user or device is trusted by default, requiring continuous verification before granting access, letting cyber tools enforce least-privilege policies across any environment. On-premises Gateway v1.0.72 adds Perplexity AI support and enhanced reputation caching.
Adds Perplexity to the list of public AI services supported for advanced content inspection
Enhances Cloud (application) Reputation Service (CRS) query handling to cache null results for a short period
Enhances Web Reputation Service (WRS) query handling to recognize application name and category for untested URLs, except at HIGH security level
Trend Vision One Tag Management preview enables asset tagging rules and third-party attribute mapping.
Adds Tag Management in public preview with a centralized tag library for viewing custom and platform tags
Adds automated asset tagging via condition-based rules to reduce manual effort
Adds external tag mapping between Trend Vision One properties and attributes from Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments., and cloud providers
Firmware release adding OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. deployment support and cipher management via CLISH.
Agentless Vulnerability & Threat Detection adds support for Oracle Cloud Infrastructure (OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant.) accounts.
Agentless Vulnerability & Threat Detection gains native OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. support for Compute, volumes, and registry images.
Enables vulnerability scanning on Oracle Cloud Infrastructure (OCI) Compute VM instances.
Adds agentless anti-malware scanning for OCI disk volumes.
Supports scanning of Oracle Container Registry images without agent installation.
Improved subnet creation logic for GCP deployment to limit resources to deployed regions.
Creates subnets only in the regions where Agentless Vulnerability & Threat Detection is deployed, reducing unnecessary resource provisioning and minimizing network overhead.
New CVE impact score column for internet-facing assets and renamed Total CVEs column in Attack Surface Discovery.
Adds a new CVE impact score column to the internet-facing asset table within Threat and Exposure Management
Renames the Highly Exploitable CVEs column to Total CVEs in the IP address asset table in Attack Surface Discovery and Related IPs in domain asset profiles
Trend Vision One adds custom rule creation and import for Container Security Runtime Protection with CDM support.
Support for custom rules in Container Security Runtime Security allows creating, configuring, and importing your own custom rules for runtime protection.
Custom detection model (CDM) support that matches custom rules detections is now available.
XDR Data Explorer can now show and search detections from Container Security custom rules.
TrendAI Vision One Endpoint Security adds TLS 1.3 inspection on Windows Server and Win 11, plus DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. log payload reduction.
Adds Advanced TLS traffic inspection support for TLS1.3 in Server & Workload Protection version 20.0.2-22850
Enhances Standard Endpoint Protection agent to reduce network payload for Data Loss Prevention, Device Access Control, Behavior Monitoring, and Predictive Machine Learning logs
Adds support for Windows 11 25H2 in the Data Loss Prevention (DLP) module version 6.2.6098
This release introduces configurable retention periods for two major data sources, allowing credit-based allocation within the Agentic SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. & XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. platform.
ClamAV 1.5.0 adds URI extraction from HTML/PDF, CVD external signing, FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. limits, per-file hash/type logging, and rich new libclamav scan APIs.
└──▷ GET THIS VERSION
$ git clone --branch clamav-1.5.0 https://github.com/Cisco-Talos/clamav.git
# already have the repo? check out this version:$ git checkout clamav-1.5.0
└──▷ TRY IT
Log the SHA2-256 hash and detected file type for every scanned file — useful for building an allowlist or feeding a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
Enable FIPS-compliant operation in clamd, disabling MD5/SHA1 for signature verification and restricting the SHUTDOWN and RELOAD administrative commands.
ini
FIPSCryptoHashLimits yes
EnableShutdownCommand no
EnableReloadCommand no
Detects whether OLE2-based Microsoft Office documents are encrypted.
Adds URI extraction from HTML documents into JSON metadata, with --json-store-html-uris=no / JsonStoreHTMLURIs no to opt out.
Adds URI extraction from PDF documents into JSON metadata, with --json-store-pdf-uris=no / JsonStorePDFURIs no to opt out.
Supports regex patterns in the clamd.confOnAccessExcludePath option for fine-grained on-access scan exclusions.
Adds CVD signing/verification via external .sign files; Freshclam downloads matching signature files automatically, and Sigtool gains sign/verify commands for them.
+11 moreshow less
Adds --cvdcertsdir CLI option and CVDCertsDirectory config option (plus CVD_CERTS_DIR env var) across Freshclam, ClamD, ClamScan, and Sigtool to specify a custom CVD certificates directory.
Adds new libclamav APIs cl_cvdverify_ex and cl_cvdunpack_ex for verifying and unpacking CVDs with an explicit certs directory.
Adds FIPS-like crypto hash limits (--fips-limits / FIPSCryptoHashLimits yes / CL_ENGINE_FIPS_LIMITS) to disable MD5 and SHA1 for signature verification and false-positive trust checks.
Upgrades the clean-file scan cache from MD5 to SHA2-256, enabling operation in FIPS-mode environments.
Adds extended libclamav hashing APIs (cl_hash_data_ex, cl_hash_init_ex, cl_finish_hash_ex, cl_hash_file_fd_ex, etc.) with a flags parameter to control FIPS hash algorithm limits.
Adds ClamScan options --hash-hint, --log-hash, --hash-alg, --file-type-hint, and --log-file-type for per-file hash pre-supply and post-scan hash/type reporting.
Adds new libclamav scan functions cl_scanfile_ex, cl_scandesc_ex, and cl_scanmap_ex supporting hash hints, hash output, hash algorithm selection, file-type hints, and file-type output.
Adds CL_ENGINE_TMPDIR_RECURSION engine option to libclamav for independently toggling temp directory recursion without requiring --leave-temps.
Adds cl_engine_set_scan_callback API with five callback insertion points (CL_SCAN_CALLBACK_PRE_HASH, CL_SCAN_CALLBACK_PRE_SCAN, CL_SCAN_CALLBACK_POST_SCAN, CL_SCAN_CALLBACK_ALERT, CL_SCAN_CALLBACK_FILE_TYPE) allowing callers to inspect or alter scan behavior at each stage.
ClamScan scan summary now reports bytes-scanned and bytes-read in exact GiB/MiB/KiB/B units instead of always using MB.
16 details in Everything
└──▷ BREAKING ON UPGRADE
!The original cl_cvdverify and cl_cvdunpack libclamav functions are deprecated in favour of cl_cvdverify_ex and cl_cvdunpack_ex.
!The older cl_scan*() functions (cl_scanfile, cl_scandesc, cl_scanmap) are deprecated and may be removed in a future release.
$ git clone --branch 3.1.6 https://github.com/CISOfy/lynis.git
# already have the repo? check out this version:$ git checkout 3.1.6
Adds notice to screen output when a platform's end-of-life state is unclear.
Supports three new platforms: CachyOS, macOS Tahoe, and OpenMandriva Lx.
FIRE-4586: Accepts NFLOG as a valid logging target when auditing iptables firewall rules.
MALW-3280: Improved detection of the Wazuh agent.
ACCT-9634: Defines a default auditd log file location for accounting checks.
+1 moreshow less
Releases older than 6 months are now flagged as old (previously the threshold was higher), surfaced directly in screen output rather than as a generic suggestion.
Sigma r2025-11-01 adds 37 new detection rules spanning AWS, Linux, GitHub, and Windows threat vectors.
└──▷ GET THIS VERSION
$ git clone --branch r2025-11-01 https://github.com/SigmaHQ/sigma.git
# already have the repo? check out this version:$ git checkout r2025-11-01
Adds AWS cloud detection rules for bucket deletion, console login monitoring, failed authentication, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. console access without MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. imported key material usage, STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets. GetCallerIdentity enumeration via TruffleHog, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow Logs deletion, and EnableRegion command monitoring.
Adds detection for EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.-Freeze hacktool execution, targeting EDR evasion techniques.
Adds rule detecting unsigned or unencrypted SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. connections to shares.
Adds detection for audit rules deleted via auditctl, covering tampering with Linux audit subsystems.
Adds Linux-specific rules for sudo chroot execution, Python web server execution, Kaspersky Endpoint Security stopped via command line, and masking system power settings via systemctl.
+15 moreshow less
Adds detection for WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host. KaliLinux installation and usage.
Adds GitHub-specific rules for repository archive status changes and Pages site visibility changes to public.
Adds detection for potential exploitation of CVE-2025-32463 via non-standard nsswitch.conf creation.
Adds detection for potential GoAnywhere MFT vulnerability exploitation.
Adds detection for lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. via Windows Remote Shell (winrs), including local command execution.
Adds detection for FTP connection attempts via WinSCP CLI and WinSCP execution from non-standard folders.
Adds detection for file access of Signal Desktop sensitive data.
Adds detection for IIS web server log deletion via command-line utilities and syslog clearing or removal via system utilities.
Adds detection for WFP filter additions via registry.
Adds detection for RunMRU registry key deletion (process and registry log variants).
Adds detection for WinRAR creating files in startup locations.
Adds detection for ISATAP router address configuration changes.
Adds detection for PUA Restic backup tool execution.
Adds detection for executables running themselves as sacrificial processes.
Adds detection for BaaUpdate.exe suspicious DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. load and suspicious BitLockerBitLockerA full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints. Access Agent Update Utility execution.
20 details in Everything
1 more release in this issue
· 2025-10-01 → 2025-10-29
Sigma r2025-10-01 adds 43 new detection rules covering SharePoint ToolShell, SAP NetWeaver, FunkLocker ransomware, and more.
└──▷ GET THIS VERSION
$ git clone --branch r2025-10-01 https://github.com/SigmaHQ/sigma.git
# already have the repo? check out this version:$ git checkout r2025-10-01
New rule: Detects ADExplorer writing a complete Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. snapshot to a .dat file.
New rule: Detects CrushFTP RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. vulnerability CVE-2025-54309 exploitation.
New rule: Detects disabling of Windows Defender WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. Autologger Session via Reg.exe.
New rule: Detects FunkLocker ransomware file creation activity.
New rule: Detects Low Reputation Effective Top-Level Domain (eTLD) usage.
+31 moreshow less
New rule: Detects MMC executing files with reversed extensions via RTLO abuse.
New rule: Detects MMC loading script engine DLLs.
New rule: Detects macOS FileGrabber infostealer activity.
New rule: Detects password-never-expires accounts set via WMI.
New rule: Detects Potential ClickFix execution patterns via the registry.
New rule: Detects Potential Hello-World Scraper Botnet activity.
New rule: Detects potential JLI.dll side-loading.
New rule: Detects potential PowerShell console history file access attempts.
New rule: Detects potential SSH tunnel persistence installed via a scheduled task.
New rule: Detects potentially suspicious child processes spawned by ConHost.
New rule: Detects PowerShell setting Windows Defender default threat action to Allow or NoAction.
New rule: Detects registry manipulation via WMI Stdregprov.
New rule: Detects TacticalRMM agent registration to potential attacker-controlled servers.
New rule: Detects scheduled task creation masquerading as system processes.
New rule: Detects schtasks combining curl download with PowerShell execution.
New rules: Detects security event logging disabled via the MiniNt registry key (process and registry set variants).
New rule: Detects suspicious .library-ms file creation as a potential CVE-2025-24054 exploit.
New rule: Detects suspicious file creation in the Outlook temporary directory.
New rule: Detects suspicious file writes to the SharePoint Layouts directory.
New rule: Detects suspicious process suspension via WERFaultSecure through EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.-Freeze.
New rule: Detects suspicious uninstallation of the Windows Defender feature via PowerShell.
New rule: Detects suspicious Velociraptor child processes.
New rule: Detects WDAC policy file creation in the CodeIntegrity folder.
New rule: Detects Windows Defender default threat action modifications.
New rule: Detects Windows Recovery Environment being disabled via Reagentc.
Updated rules: Expanded invoke-restmethod cmdlet coverage across multiple PowerShell web-request and download detection rules.
Updated rule: Potential Defense Evasion Via Right-to-Left Override and File Extension Spoofing rules now include the U+202E character and additional extensions.
Tenzir is a data pipeline engine for security teams that collects, transforms, enriches, and routes telemetry.
tenzir v5.19.0 adds ocsf::cast operator and one-level OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. recursion support
Adds ocsf::cast operator for OCSF schema transformations including timestamp conversion.
Enables one-level recursion in OCSF objects for fields like process.parent_process.
Flips tenzir.pipeline-subprocesses config option to opt-in with default false.
Optimizes memory consumption during import by releasing events immediately after disk write.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The ocsf::apply operator is deprecated and now equivalent to ocsf::cast null_fill=true.
7 more releases in this issue
· 2025-10-13 → 2025-10-27
Entry filenames now carry zero-padded numeric prefixes so they sort chronologically without relying on file metadata
Promotes tenzir-changelog show as the single entry point for browsing changelog entries with quick transforms (-c, -m, -j)
Allow setting the preferred release and export layout in config via export_style key in config.yaml
Split the release command into dedicated release create, release notes, and release publish subcommands
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Retires tenzir-changelog bootstrap in favor of an automatic setup path: the first tenzir-changelog add now creates config.yaml, prepares the required directories, and infers the project identifier so new repositories can capture entries immediately.
!Release manifests now treat the entries/ directory as the single source of truth, so the redundant entries: lists were removed and the version is implied by the directory name.
Initial release of tenzir-ship v0.1.0 adds the tenzir-changelog CLI for bootstrapping, capturing, browsing, and assembling changelogs.
tenzir-changelog release subcommand assembles release manifests from unreleased entries
tenzir-changelog bootstrap command interactively scaffolds a changelog project workspace
tenzir-changelog list and tenzir-changelog show commands provide rich terminal views of changelog entries
tenzir-changelog add workflow guides users through capturing new changelog entries
tenzir-changelog validate command and GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflow enforce changelog integrity in CI
Splunk Security Content v5.17.0 adds 5 new analytic stories and 18 new detections covering WSUSWSUSWindows Server Update Services, a Microsoft service that lets administrators centrally manage and distribute Windows and software updates to machines on a network instead of each host pulling from the internet.RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., HTTP smuggling, Oracle EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives., and ransomware groups.
└──▷ GET THIS VERSION
$ git clone --branch v5.17.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v5.17.0
New analytic story: Microsoft WSUS CVE-2025-59287, covering unauthenticated RCE via WSUS deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution., with a new *Windows WSUS Spawning Shell* detection for post-exploitation shell activity.
New analytic story: HTTP Request Smuggling, with five new detections — *HTTP Suspicious Tool User Agent*, *HTTP Request to Reserved Name on IIS Server*, *HTTP Rapid POST with Mixed Status Codes*, *HTTP Possible Request Smuggling*, and *HTTP Duplicated Header* — targeting CL.TE, TE.TE, and CL.0 abuse patterns.
New analytic story: Oracle E-Business Suite Exploitation (Cisco Talos collaboration), with Snort-based detections for anomalous web requests, payload delivery, and lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. against enterprise ERP systems.
New analytic story: Scattered Lapsus$ Hunters, covering TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. for Scattered Spider, Lapsus$, and Shiny Hunters — including MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. bypass, credential theft, remote access tool abuse, PowerShell infection chains, and SSH persistence.
New analytic story: Hellcat Ransomware, tagging TTPs for this RaaS group targeting critical infrastructure, telecom, and government sectors.
+11 moreshow less
New detection: *Windows Defender ASR or Threat Configuration Tamper* for identifying tampering with Defender Attack Surface Reduction rules.
New detection: *Windows Default RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. File Creation By Non MSTSC Process* to flag suspicious RDP file creation outside of the standard MSTSC process.
New detection: *Windows Process Execution From RDP Share* for identifying process launches originating from RDP-mapped shares.
New detection: *Windows WBAdmin File Recovery From Backup* to detect abuse of the wbadmin utility for file recovery from backups.
New detection: *Wmiprvse LOLBASLOLBASLiving Off the Land Binaries and Scripts — legitimate Windows executables and scripts that attackers abuse to run malicious code, letting cyber tools detect or emulate attacker behavior without custom malware. Execution Process Spawn* for identifying LOLBAS child process spawning via WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. provider host.
New detection: *Advanced IP or Port Scanner Execution* for identifying reconnaissance tool usage.
New detection: *File Download or Read to Pipe Execution* for detecting piped file download-to-execution patterns.
New detection: *Windows NirSoft Tool Bundle File Created* for flagging creation of NirSoft credential and forensics tool bundles.
New detection: *Windows PowerShell Process Implementing Manual Base64 Decoder* for identifying custom base64 decoding in PowerShell execution chains.
New detection: *Windows PsTools Recon Usage* for detecting reconnaissance activity via PsTools utilities.
New Cisco Secure Firewall detections: *Oracle E-Business Suite Correlation* and *Oracle E-Business Suite Exploitation* for network-layer ERP attack visibility.
16 details in Everything
└──▷ BREAKING ON UPGRADE
!The detection Windows Change Default File Association For No File Ext is deprecated and scheduled for removal in v5.20.0; replace with Windows Change File Association Command To Notepad.
!The detection Detect Rundll32 Application Control Bypass - setupapi is deprecated and scheduled for removal in v5.20.0; replace with Windows Application Whitelisting Bypass Attempt via Rundll32.
!The detection Detect Rundll32 Application Control Bypass - syssetup is deprecated and scheduled for removal in v5.20.0; replace with Windows Application Whitelisting Bypass Attempt via Rundll32.
!The detection Detect Rundll32 Application Control Bypass - advpack is deprecated and scheduled for removal in v5.20.0; replace with Windows Application Whitelisting Bypass Attempt via Rundll32.
1 more release in this issue
· 2025-10-15 → 2025-10-30
Splunk Security Content v5.16.0 adds 6 new analytic stories and 19 new detections covering Ollama LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. abuse, M365 Copilot risks, PromptLock GenAI ransomware, LokiBot, and APT37.
└──▷ GET THIS VERSION
$ git clone --branch v5.16.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v5.16.0
New Suspicious Ollama Activities analytic story with 8 detections covering abnormal network connectivity, API endpoint scanning, memory exhaustion, model exfiltration, RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. via model loading, excessive API requests, service crash attacks, and prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools./jailbreak against locally hosted LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code..
New Suspicious Microsoft 365 Copilot Activities analytic story with 4 detections: usage pattern anomalies, failed authentication patterns, non-compliant device access, and session origin anomalies for enterprise AI assistant risk.
New PromptLock analytic story targeting the first known GenAI-driven ransomware PoC, with detections focused on anomalous AI invocation patterns, file encryption activity, and local LLM API (Ollama/gpt-oss:20b) abuse for malicious automation.
New Lokibot analytic story with added Windows Visual Basic Commandline Compiler DNSQuery detection for suspicious DNS communications and credential-stealing exfiltration.
New APT37 Rustonotto and FadeStealer analytic story including a detection for Windows Cabinet file extraction via Expand, targeting phishing-based infections and data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..
+2 moreshow less
New GhostRedirector IIS Module and Rungan Backdoor analytic story covering malicious IIS module abuse, SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., and stealthy PowerShell for server compromise and web traffic manipulation.
New endpoint detections added: Web or Application Server Spawning a Shell, Windows Application Whitelisting Bypass via Rundll32, Windows Change File Association Command To Notepad, Windows Set Network Profile Category to Private via Registry, Windows Symlink Evaluation Change via Fsutil.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The notable alert actions are removed from Attempt To Add Certificate To Untrusted Store, Windows Archived Collected Data In TEMP Folder, Windows Rundll32 Apply User Settings Changes, and Windows Scheduled Task Created Via XML — these detections will no longer create notable/findings and will only create risk events.
!The notable alert action is added to Windows Certutil Root Certificate Addition — this detection will now create notable/findings in addition to risk events.
!Several detections previously deprecated in ESCU v5.14.0 have been removed in v5.16.0; users must transition to recommended replacements. See the List of Removed Detections for the full inventory.
!A new set of detections has been deprecated and are scheduled for removal in ESCU v5.18.0; see the List of Detections Scheduled for Removal.
New Banking Cyberattack Dashboard AI Model; RAGRAGRetrieval-augmented generation: looking up relevant documents and adding them to the prompt before the model answers. It grounds responses in private or current data without retraining. source selection and threat graph toggle in Ask AI.
Adds a Banking industry option to the New Cyberattack Dashboard AI Model for monitoring attacks targeting banks
Allows adding articles and selecting sources in Ask AI Research mode to enable RAG, with a toggle to enable/disable the threat graph
2 details in Everything
2 more releases in this issue
· 2025-10-01 → 2025-10-30
Feedly adds Ask AI integration to Vulnerability Dashboard with personalized prompts and expands CSV export limits
Integrates Ask AI directly into the Vulnerability Dashboard to allow personalized prompt input for prioritizing and summarizing CVE intelligence with inline citations.
Expands the CSV export limit in the Vulnerability Dashboard to return up to 10,000 results.
Adds support for sha256 as an IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Hash subtype field in the article JSON output.
Release adds Slack Marketplace integration and improves IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. search normalization, dashboard loading, and AI mapping.
Improved keyword search for specific IoCs using normalization rules for indexing
Improved loading time of the Vulnerability Dashboard when a product version filter is present
MISP 2.5.23 adds first-publication tracking, SQL EXPLAIN/ANALYZE endpoints, and a new preRelease admin shell function.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.23 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.23
└──▷ TRY IT
Dump the current DB schema and describeTypes.json ahead of a release or migration using the new admin shell function.
$ /var/www/MISP/app/Console/cake Admin preRelease
Extends the /benchmarks/sqlMetrics endpoint with /explain and /analyze path parameters to run SQL EXPLAIN or ANALYZE on slow queries.
Adds a preRelease function to the admin shell for dumping the current DB schema and describeTypes.json.
Adds OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. documentation for sharing group blueprints and sharing group blueprints viewOrgs.
3 details in Everything
1 more release in this issue
· 2025-10-02 → 2025-10-15
MISP v2.5.22 adds locked-event creation on feed pulls and expands Event Report View to show full event family trees.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.22 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.22
Supports creating locked events on feed pulls, giving analysts control over event mutability when ingesting threat feeds.
Event Report View now surfaces all children of the current event and all children of the parent event, enabling full visibility into extended event hierarchies.
Cloudmersive releases its first CDR API connector for Microsoft Power Platform, enabling calls to their verification service from Power Automate and Apps.
ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. v18 updates mapping data; STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. model changes detailed in external links.
Updates ATT&CK mapping content for v18.0 as documented in the October 2025 release notes.
Introduces STIX data model changes defined in the main CHANGELOG.md.
Tines 34.7 adds diagram navigation, live activity tracking, Run/Event Transform access control, and OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. traces for self-hosted deployments
└──▷ HOW TO FIND IT
Navigate instantly from a specific story run instance to its corresponding flow diagram node for debugging.
📍Open Story Run › Click the Jump to Route link in the action header
Monitor real-time execution of pending actions across multiple story runs without refreshing pages.
📍Navigate to Stories › Select Story › Open Live Activity tab
Adds direct jump from a story run to its route in the diagram UI.
Introduces live activity view for pending action runs within stories.
Adds ability to restrict access to Run Script and Event Transform actions when running in automatic mode.
Enables exporting OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. traces for self-hosted Tines installations.
Shuffle nightly adds Kubernetes tmp volume mounts for apps and explicit app protocol specification for worker/app services.
└──▷ GET THIS VERSION
$ git clone --branch nightly-31102025 https://github.com/Shuffle/Shuffle.git
# already have the repo? check out this version:$ git checkout nightly-31102025
Supports mounting a tmp volume to apps in Kubernetes deployments.
Enables specifying the app protocol for worker and app services in Kubernetes.
Adds more licensing features.
3 details in Everything
0 more releases in this issue3 more releases in this issue · 2025-10-09 → 2025-10-31
$ git clone --branch nightly-30102025 https://github.com/Shuffle/Shuffle.git
# already have the repo? check out this version:$ git checkout nightly-30102025
Supports mounting a tmp volume to apps in Kubernetes deployments.
Enables explicit app protocol specification for worker and app services in Kubernetes.
Adds expanded licensing features.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!App replicas now default to 3 in Kubernetes deployments, which may increase resource consumption on upgrade if replica count was previously unset.
Shuffle 2.1.1-rc1 adds configurable Kubernetes resource limits for workers and cloud subscription sync.
└──▷ GET THIS VERSION
$ git clone --branch 2.1.1-rc1-09102025 https://github.com/Shuffle/Shuffle.git
# already have the repo? check out this version:$ git checkout 2.1.1-rc1-09102025
└──▷ USE IT
Set CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and memory resource limits on Shuffle workers in Kubernetes to prevent noisy-neighbour issues in shared clusters.
yaml
# In your Helm values file:
worker:
resources:
requests:
cpu: "250m"
memory: "256Mi"
limits:
cpu: "1000m"
memory: "512Mi"
Adds option to set Kubernetes resource limits and requests for worker deployments via Helm chart.
Enables cloud sync for subscription data, keeping subscription state aligned between cloud and self-hosted instances.
Caches cloud sync data to reduce redundant remote calls during synchronization.
Shuffle nightly adds configurable Kubernetes resource limits for workers and cloud subscription sync.
└──▷ GET THIS VERSION
$ git clone --branch nightly-09102025 https://github.com/Shuffle/Shuffle.git
# already have the repo? check out this version:$ git checkout nightly-09102025
New option to set Kubernetes resource requests/limits (CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware., memory) for worker pods in Helm deployments.
Adds cloud sync for subscription data, keeping licensing state consistent across cloud-connected instances.
Caches cloud sync data locally to reduce repeated remote lookups.
Cribl Stream 4.14.1 adds Google Cloud Chronicle API Destination, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for multiple orgs, and gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. encrypted private keys.
Adds Google Cloud Chronicle API Destination with v1alpha ImportLogs ingestion method for per-event labeling and improved scaling
Enables SSO authentication for multiple Organizations sharing the same email domain in Cribl.Cloud
Introduces IAM Admin Permission at the Organization level to manage SSO and members without data engineering access
Adds Passphrase setting in TLS configuration for gRPC encrypted private keys in Model Driven Telemetry and OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. Sources
Adds Key Prefix column to Amazon S3 Destination configuration tables for auditing
+4 moreshow less
Adds Validate and correct log name option to Google Cloud Logging Destination to sanitize illegal characters
Adds Get auth token from header setting to REST Collector Login methods to support JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. in Authorization header
Makes Cribl Guard available in on-prem and hybrid deployments of Cribl Stream
Adds credit spend projection charts per-product and product-specific tabs in FinOps Center
New AWS/Azure harvesters, Remediation Hub filtering by CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it./Risk, Certificate SSH creds, and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Win11 support in InsightVM
Adds AmplifyAppHarvester, CodePipelineHarvester, MediaAnalysisJobHarvester, AppflowHarvester, and MapHarvester to Cloud Security for new AWS/Azure resource discovery.
Adds filter by CVSS score and filter by Active Risk score in Response & Remediation > Remediation Hub to prioritize vulnerabilities.
Adds Certificate-Based SSH Authentication as a credential option for authenticated scans of Linux/Unix systems in InsightVM.
Adds built-in policy support for CIS Microsoft Windows 11 Benchmark v4.0.0 in InsightVM.
Adds environment_variables_configured field source of truth for AWS/GCP Serverless Functions in Cloud Security.
+1 moreshow less
Adds new Query Filters: Amplify App Without Web Application Firewall, Amplify App Using Basic Auth, Local Authentication Turned Off On Map Account, and Rekognition status filters.
Adds osv-scanner experimental-mcp subcommand for the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server
└──▷ GET THIS VERSION
$ git clone --branch v2.2.4 https://github.com/google/osv-scanner.git
# already have the repo? check out this version:$ git checkout v2.2.4
Updates the base image enrichment logic by replacing the baseimagematch component with a new base image enricher in the osv-scalibr integration.
1 detail in Everything
1 more release in this issue
· 2025-10-01 → 2025-10-29
Adds --experimental-no-default-plugins CLI flag to disable default experimental plugins while keeping explicitly listed ones via --experimental-plugins
Adds support for resolving git packages that have a version specified
Updates osv-scalibr dependency to v0.3.4 for improved dependency extraction
New Inventory export formats and Attack Path filters for Tenable Exposure Management.
Adds CSV and JSON export options for asset and finding information in the Inventory section
Adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ID filtering to Attack Path analysis
Adds Archived by User filtering to Attack Path analysis
3 details in Everything
7 more releases in this issue
· 2025-10-02 → 2025-10-29
Tenable One Vulnerability Management adds an Early Access feature called Scanner Profiles. Accessed via the UI under Sensors > Nessus Scanners > Profiles, this capability allows administrators to manage settings for groups of linked Tenable Nessus scanners. Key controls include enforcing specific scanner versions and dictating how and when those scanners receive plugin updates, as well as which plugins are installed during daily synchronization.
Tenable Security Center 6.7.0 adds Explore-Assets preview, Triggered Agent Scans UI, Credential Verification policy template, and BeyondTrust Domain field support
Explore - Assets technology preview enables a new data grid view with group-by tools for Asset-based information.
Configure Triggered Agent Scans directly in the Tenable Security Center UI (requires Nessus Manager 10.9.0+).
New Credential Verification Scan Policy template reports on success of provided host credential pairs.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Web App Scanning using Tenable Nessus is deprecated; move scanners to Tenable Core or Docker-based scanners.
!LCE (Log Correlation Engine) functionality has been removed from the application.
Tenable One ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. adds bulk management of subscription alerts in the UI.
└──▷ BREAKING ON UPGRADE
!Bulk modifications overwrite any existing alert settings for the selected subscriptions.
DefectDojo 2.51.3 adds MSRC vulnerability ID support and refreshed favicon/theme UI.
└──▷ GET THIS VERSION
$ git clone --branch 2.51.3 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.51.3
Adds MSRC vulnerability ID (msrc_vulnid) support via a new settings configuration.
Reimplements favicons and updates the application theme.
Implements authorization controls for the Risk Acceptance class.
Adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server documentation.
4 details in Everything
3 more releases in this issue
· 2025-10-06 → 2025-10-27
DefectDojo 2.51 adds new parsers, fix-availability tracking, MS Teams Adaptive CardsAdaptive CardsAn open-source card schema from Microsoft that lets apps render structured UI snippets — buttons, text, images — natively inside any host surface, so a tool can push rich, interactive notifications without owning the renderer., OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. button customization, and major import performance gains.
└──▷ GET THIS VERSION
$ git clone --branch 2.51.0 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.51.0
└──▷ USE IT
Customize the OIDC login button text shown on the login page for your identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
python
SOCIAL_AUTH_OIDC_LOGIN_BUTTON_TEXT = "Login with Okta"
Allow users to log in with their full email as their username when using social auth.
python
SOCIAL_AUTH_USERNAME_IS_FULL_EMAIL = True
New GitHub Secrets Detection Report parser ingests GitHub secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. results.
New Semgrep Pro parser supports Semgrep Pro findings import.
Snyk Issue API (SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself.) scan import implementation added.
Adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. details extraction to the AWS Inspector2 parser.
Adds AWS security bulletins as a recognized vulnerability ID source.
+26 moreshow less
Adds OXAS-ADV-, VAR, and NN vulnerability ID namespaces for enriched vuln tracking.
Adds fix_available information to the BlackDuck binary analysis, BlackDuck component risk, JFrog On-Demand, JFrog Xray Unified, JFrog, WPScan, Mend, Aqua, and KrakenD Audit parsers.
MS Teams notifications now support Power Automate Workflows via Adaptive CardAdaptive CardA JSON-defined UI snippet, maintained by Microsoft, that renders natively in host apps like Teams or Outlook, letting tools surface structured data without building platform-specific UI code. format.
UI: findings list supports ordering by additional fields.
UI: planned_remediation_version field added to the finding list.
UI: Similar Findings panel restricted to the current product scope.
Introduces text labels for API v3 responses.
Password Reset disabled for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. users.
UI import now allows providing a custom test title.
OpenVAS parser improvements for broader result compatibility.
Qualys Hacker Guardian parser updated to handle larger CSV files.
SonarQube Scan and SonarQube Scan Detailed parsers now capture the Line field.
Engagement's branch_tag included in Jira Epic description.
SOCIAL_AUTH_USERNAME_IS_FULL_EMAIL is now a configurable setting.
New SOCIAL_AUTH_OIDC_LOGIN_BUTTON_TEXT setting to customize the OIDC login button label.
Django Debug Toolbar can now be enabled via environment variable.
Default audit log type updated to django-auditlog.
Bulk edit now supports updating the under_review flag.
Watson search index updates now performed asynchronously.
Performance: import pipeline reduces number of finding.save() calls and adds tags in bulk.
Performance: product grading calls reduced and optimized using a Celery Chord.
uWSGI defaults changed to 4 processes × 4 threads for better out-of-box throughput.
Generic parser updated with extended support.
Wazuh v4.8 parser implemented.
Requested-review notifications now include additional data in the notification title.
31 details in Everything
└──▷ BREAKING ON UPGRADE
!The default audit log type is changed to django-auditlog (was previously different); existing setups using the old default may need to verify audit log configuration after upgrade.
!django-tagging dependency is dropped; a database migration is required.
!django-pghistory is added as an optional audit log backend; a database migration is required.
Adds --input-dir flag to recursively scan directories and extract CVE IDs from all contained vulnerability report files, enabling batch processing of multiple scanner outputs.
Export results now automatically saved to a dedicated /results directory when available.
2 details in Everything
2 more releases in this issue
· 2025-10-07 → 2025-10-18
SploitScan v0.14.1 adds Metasploit module discovery and a redesigned HTML export with dark mode and sidebar filters.
└──▷ GET THIS VERSION
$ git clone --branch v.0.14.1 https://github.com/xaitax/SploitScan.git
# already have the repo? check out this version:$ git checkout v.0.14.1
└──▷ TRY IT
Check a CVE and export an HTML report to see the new Tailwind-styled layout with Metasploit module counts and dark mode toggle.
$ python -m sploitscan CVE-2024-1234 --export html
Adds Metasploit integration via Rapid7's modules_metadata_base.json with conditional caching, counting only modules whose references contain the exact CVE ID.
New HTML export redesign using Tailwind CSS: dark mode toggle, sticky header, sidebar filters, sortable summary table, responsive detail cards, and a readable AI section — no build step required.
Modular codebase reorganization into distinct modules (fetchers, metrics, display, AI providers, importers, exporters, utils) while preserving existing CLI usage; supports both python -m sploitscan and direct script execution.
SploitScan v0.14.0 adds Metasploit module discovery and a fully redesigned HTML export with dark mode and filtering.
└──▷ GET THIS VERSION
$ git clone --branch v0.14.0 https://github.com/xaitax/SploitScan.git
# already have the repo? check out this version:$ git checkout v0.14.0
└──▷ TRY IT
Export a CVE report as HTML to review Metasploit module hits alongside CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. scoring in a filterable, dark-mode-capable report.
$ python -m sploitscan CVE-2024-1234 -e html
Adds Metasploit integration via Rapid7's modules_metadata_base.json with conditional caching, counting only modules whose references contain the exact CVE ID.
Redesigned HTML export with Tailwind CSS: dark mode toggle, sticky header, sidebar filters, sortable summary table, responsive detail cards, and a readable AI section — zero-build setup with optional offline CSS.
Reorganized into clear modules (fetchers, metrics, display, AI providers, importers, exporters, utils); supports both python -m sploitscan and direct script execution.
Faraday agent dispatcher 3.9.0 allows TARGET_URL to accept a list in the burp agent configuration.
└──▷ GET THIS VERSION
$ git clone --branch 3.9.0 https://github.com/infobyte/faraday_agent_dispatcher.git
# already have the repo? check out this version:$ git checkout 3.9.0
Updates TARGET_URL parameter in the burp agent to accept a list of URLs
Refactors executor parameters to eliminate code duplication
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The burp agent's TARGET_URL parameter type is changed from a single URL string to a list of URLs. #229
Nessus 10.10 adds global scan timeout, agent CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. limits via profiles, and an API to export all Tenable Agent data.
Added a global timeout setting to define the maximum duration for a host scan
Added support for upcoming CPU resource limit setting for Tenable Agents, configurable via agent profiles in Tenable Nessus Manager
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Disabled the ability to export scan data and audit files in trial versions of Tenable Nessus
!Removed Terrascan from Tenable Nessus Essentials, Professional, Expert, and trials
NodeZero October 2025 adds HVT/ADP simulation, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. GA, AD Tripwires, and SCCM TAKEOVER-1 support
Generally Available the Hosted Managed Control Plane (MCP) Server for automated orchestration.
Adds High-Value Targeting (HVT) and Advanced Data Pilfering (ADP) capabilities to simulate sophisticated asset targeting and data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..
Adds support for exploiting the TAKEOVER-1 misconfiguration in Microsoft SCCM to compromise managed machines.
Adds NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. credential support to key internal network attack modules.
Introduces Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. (AD) Tripwire capabilities with dedicated Tripwire Jobs navigation.
+3 moreshow less
Allows bulk enable/disable of tripwires across multiple templates from the Templates overview page.
Adds new Rapid Response tests for critical vulnerabilities in Redis, Oracle EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives., and WatchGuard Fireware OS.
Improves Vulnerability Hub performance with 50% faster Weaknesses Over Time queries and optimized data tables.
Munki 7 adds version_script pkginfo key and sidebar customization for Managed Software Center
└──▷ GET THIS VERSION
$ git clone --branch v7.0.1 https://github.com/munki/munki.git
# already have the repo? check out this version:$ git checkout v7.0.1
Adds version_script pkginfo key to allow script-based version detection
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!The startosinstall installer_type is no longer supported
!The apple_update_metadata installer_type is no longer supported
!The profile installer_type is no longer supported
!Adobe installer_types AdobeSetup, AdobeUberInstaller, AdobeAcrobatUpdater, AdobeCS5AAMEEPackage, AdobeCS5PatchInstaller, and AdobeCCPInstaller are no longer supported
Munki v7 introduces version_script pkginfo key and sidebar customization for Managed Software Center.
└──▷ GET THIS VERSION
$ git clone --branch v7.0.0 https://github.com/munki/munki.git
# already have the repo? check out this version:$ git checkout v7.0.0
version_script: pkginfo items may now contain the key version_script. The expected value for this key is a string, containing a script that outputs the version number of a currently-installed version of the software, or an empty string (or exits non-zero) if the software is not currently installed. This is a new mechanism Munki can use to determine whether or not an item needs to be installed (or updated). Since it returns a version number, and Munki can use its existing version number logic, in most cases using a version_script will be superior to using an installcheck_script.
Managed Software Center now supports customization of the sidebar. See https://github.com/munki/munki/wiki/Customizing-Managed-Software-Center-sidebar for details.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The startosinstall installer_type is no longer supported.
!The installer_type apple_update_metadata is no longer supported.
!The following Adobe installer_types are no longer supported: AdobeSetup, AdobeUberInstaller, AdobeAcrobatUpdater, AdobeCS5AAMEEPackage, AdobeCS5PatchInstaller, AdobeCCPInstaller
!The appdmg installer_type is no longer supported.
!The suppress_bundle_relocation pkginfo key is no longer supported.
Fleet 4.75.0 adds Smallstep CA, Arch Linux support, Android config profiles, Santa osquery tables, and IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.-driven labels for iOS/iPadOS.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.75.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.75.0
└──▷ TRY IT
Query the new Santa tables to audit allowed and denied binaries on macOS hosts.
$ SELECT * FROM santa_denied;
Adds support for Smallstep certificate authority integration.
Adds santa_allowed, santa_denied, and santa_status osquery tables via Fleet's built-in Santa extension.
Adds false-positive filtering for Linux vulnerability scanning.
Adds support for Arch Linux hosts, including software inventory ingestion.
Adds fleetctl support to generate fleetd installers for Arch Linux (.pkg.tar.zst format).
+14 moreshow less
Adds configuration profile support for Android hosts, with activity logging for profile creation, modification, and deletion.
Adds support for software installation during Windows setup experience.
Adds ability to read server private_key from AWS Secrets Manager.
Adds support for vulnerabilities feed CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. translation JSON to override the sw_edition field.
Adds ability to specify a Fleet host ID when declaring a manual label in a GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. YAML file.
Adds a dedicated labels management page with table and UI integrations.
Adds OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. instrumentation to scheduled jobs and several API endpoints.
Adds ability to unenroll personal iOS/iPadOS devices from Fleet.
Adds support for assigning host labels based on IdP attributes for iOS and iPadOS hosts.
Adds ability to turn off MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. for iOS and iPadOS devices when the refetcher returns a device token as inactive.
Adds support for hosts enrolled with Company Portal using the legacy SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. extension for Entra conditional access.
Updates DEB and RPM packages generated by fleetctl package to be safe to upgrade in-band through the Software page.
Adds count to list host certificates API response.
Adds new rate limiting for Fleet Desktop API endpoints to support large deployments behind NAT.
19 details in Everything
└──▷ BREAKING ON UPGRADE
!If you deploy a custom Santa osquery extension (e.g., Trail of Bits) with tables named exactly santa_allowed, santa_denied, or santa_status, Fleet's agent will crash on upgrade. You must uninstall the custom extension before upgrading.
1 more release in this issue
· 2025-10-06 → 2025-10-17
Fleet 4.74.0 adds Hydrant CA support, Linux setup experience, batch MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. profile APIs, and AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. auth for RDS/ElastiCache.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.74.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.74.0
└──▷ USE IT
Scope a Fleet Maintained App's setup experience and self-service settings at the team level in a GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. YAML file.
Adds Hydrant as a supported Certificate Authority, plus an experimental API to request certificates from Hydrant.
Adds POST /api/v1/fleet/configuration_profiles/batch endpoint to batch-modify MDM configuration profiles.
Adds /batch/{batch_execution_id}/host-results endpoint to list hosts targeted in a batch execution.
Adds new UI page for batch script run details, with improved sorting by started/finished date.
Adds AWS RDS (MySQL) IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. authentication support.
+17 moreshow less
Adds AWS ElastiCache (Redis) IAM authentication support.
Adds support for hosts enrolled with Company Portal using the legacy SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. extension for Entra conditional access.
Adds setup experience software items for Linux devices, including new device and admin API endpoints (POST /api/fleet/orbit/setup_experience/init, POST /api/v1/fleet/device/{token}/setup_experience/status).
Extends PUT /api/v1/fleet/setup_experience/software and GET /api/v1/fleet/setup_experience/software with a platform argument supporting linux or macos.
Adds ability to upload custom software icons.
Adds IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.fullname attribute as a valid Fleet variable for Apple configuration profiles.
Adds username of the managed user account for user-scoped profiles on macOS host details.
Enables webhook and Jira/Zendesk ticket policy automations for No team.
Adds support for writing multiple packages in a single GitOps YAML file under software.packages.
Moves self_service, labels_include_any, labels_exclude_any, categories, and setup_experience declarations to team level for software in GitOps; setup_experience can now be set on packages, Fleet Maintained Apps, or App Store apps.
Adds a Fleet-maintained app for macOS: Omnissa Horizon Client.
Adds opening instructions to self-service macOS apps and Windows programs.
Adds FLEET_SECRET variable guard to disallow secrets in Apple configuration profile <PayloadDisplayName> fields.
Adds OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. tracing to async tasks (host seen, labels, policies, query stats) with gzip compression and improved HTTP span naming.
Improves performance for YARA rules when modifying config with large rule sets or when large numbers of hosts fetch rules.
Updates fleetctl get mdm-command-results to display output in a vertical format instead of a table.
Adds database index to distributed_query_campaign_targets to speed up live query performance, with automatic cleanup of targets 24 hours after campaign completion.
22 details in Everything
└──▷ BREAKING ON UPGRADE
!Software YAML structure has breaking changes: self_service, labels_include_any, labels_exclude_any, categories, and setup_experience declarations have moved to team level; migration is required (see the linked migration document).
An asset discovery and inventory platform that identifies and maps all devices on networks without requiring agents.
runZero v4.0.251028.0 introduces customizable asset ownership attribution, multi-account AWS imports via IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Role, and enhanced certificate search capabilities.
Organization and account administrators can now modify and reorder the attribute list that determines default asset ownership, per organization or at the account level
The AWS integration can now import from multiple AWS accounts without AWS Organizations, using a new AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. Role credential type
A new Certificate and TLS Service Risks finding groups the Certificates and TLS Services queries that contribute to Certificate Risk
You can now search services by all certificates in the certificate chain, using their sha256, sha1, or bk_hash attributes
4 details in Everything
6 more releases in this issue
· 2025-10-03 → 2025-10-28
runZero v4.0.251023.0 adds @tanium.dev.lastLoggedInUser to ownership logic and a start_scan MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool
The runZero MCP service now includes the start_scan tool.
Software CSV exports now include ownership information.
runZero 4.0.251015.0 adds Explorer group selection to task forms and passive scan support for unassigned IPs.
Adds Explorer groups selection in the task forms for NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment., Intune, Meraki, Miradore, Google Workspace, Censys, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory., Shodan, and AzureAD integrations
runZero 4.0.251008.0 adds CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. disable config and fixes asset reports/merge
Adds a system configuration option to disable CSRF protection for self-hosted instances.
Custom integration scripts can set asset fingerprints via trust_device_type attributes; AWS static external ID support added.
Custom integration scripts can now use the trust_device_type, trust_os and trust_os_version attributes on the ImportAsset object to set an asset’s fingerprint, even if runZero’s fingerprint engine cannot normalize the custom values
AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. credentials configuration now supports a static external ID at the account level
Windows Package Manager v1.12.350 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server support, font management commands, and new manifest schema types.
└──▷ GET THIS VERSION
$ git clone --branch v1.12.350 https://github.com/microsoft/winget-cli.git
# already have the repo? check out this version:$ git checkout v1.12.350
└──▷ USE IT
Start the MCP server to allow external clients to query and manage installed packages via the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface..
shell
winget mcp
Search specifically for fonts available in the dedicated font source repository.
shell
winget search font -s winget-font
Adds winget mcp subcommand for Model Context Protocol server assistance
Adds explicit winget-font source for font package operations
Updates manifest schema to v1.12 supporting Font in InstallerType and NestedInstallerType
Enables --details flag on winget font list for detailed font information output
Acronis Cyber Protect combines backup, disaster recovery, and endpoint protection in one platform for businesses and managed service providers.
macOS 26 Tahoe support, SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Connector 2.0 with JSON/CEFCEFCommon Event Format, an ArcSight (Micro Focus) log standard that defines a fixed header plus extensible key-value pairs so cyber tools can emit and ingest alerts in a predictable, parseable structure. and self-protect maintenance windows, plus PSA email customizations
Adds complete cyber protection for macOS 26 Tahoe workloads including Acronis Backup, EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device., RMM, and Files Sync & Share.
Replaces agent password protection with configurable uninstallation prevention to block ransomware agent removal during a defined maintenance period.
Allows technicians to configure which ticket events trigger email notifications in the PSA service desk to reduce alert fatigue.
Enables upfront billing for actual usage via monthly contracts and supports invoicing Acis Cyber Cloud usage against partner custom products.
Adds SIEM Connector 2.0 that repurposes the agent to send alerts, events, activities, and tasks to a file location in CEF or JSON format without a gateway server.
Commvault Cloud is a backup, recovery, and cyber-resilience platform for hybrid, multi-cloud, and SaaS workloads.
Commvault Cloud October 2025 adds MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. support, Arlie SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. integration, and various protection enhancements.
Adds Commvault MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server for natural language management of backup jobs, job reviews, and SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. insights
Integrates Arlie AI assistant with Commvault support, enabling ticket creation and live agent escalation in the console
Enables backups of Azure SQL Managed Instance databases encrypted with service-managed keys via MSSQL Data-Tier Application Framework
Provides unified self-service onboarding for IaaS databases including Informix, MySQL, Oracle, PostgreSQL, SAP HANA, and SQL Server
Adds Command Center support for scheduling backup, restore, and media management operations
+17 moreshow less
Allows job retries, priority changes, comments, and MediaAgent visibility in Command Center job details
Supports cloud assemblies to protect multi-region Azure resource groups
Introduces Storage Pool compression configuration directly in Command Center
Allows modification of recovery targets for existing cleanroom recovery groups
Adds guided wizard for cleanroom control plane recovery
Expands Credential Vault storage to include SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure., webhook, identity server, and network path credentials
Enables failback for IntelliSnap-based primary copies using streaming backup copies in DR regions across Azure, AWS, and Google Cloud
Adds threat scanning for malware anomalies in AWS Cleanroom during recovery
Integrates HPE Zerto for continuous VM replication with zero RPO
Adds incremental backup support for Google Cloud BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data.
Replaces traditional username/password fields in CommCell Console with Credential Vault entries
Achieves FedRAMP HighFedRAMP HighA US federal authorization tier for cloud services, managed by GSA, certifying that a provider meets the strictest NIST 800-53 controls required to handle the most sensitive unclassified government data. certification for Air Gap Protect in AWS GovCloud US
Automates GCP boot driver injection for replication and failover to Google Cloud
Enables flat mode scan by default for object storage backups across major providers
Simplifies onboarding with new VMware access node wizard
Adds Companies section to Command Center top-level navigation
Adds Forest Recovery option to recover AD database to a clean VM built from ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability.
Druva Cloud Platform adds DruAI report insights and enhanced reporting with unified subscriptions, custom filters, and ZIP export options
Adds Actionable Insights feature (DruAI) that automatically analyzes report data to deliver summaries of key trends and performance highlights along with AI-driven recommendations.
Introduces Unified Subscriptions for reports, allowing a single global subscription managed by all admins instead of duplicate emails.
Enables creation of Custom Reports by selecting specific filters and data columns, with the ability to subscribe to them on a preferred schedule.
Adds compressed (ZIP) or non-compressed file format options for exporting reports or scheduled subscriptions.
Adds preserved ENI and security group selection during EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. AMI/snapshot restoration for network continuity.
Enables selection of available preserved Elastic Network Interfaces (ENI) when restoring EC2 AMIs and EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. snapshots to an instance
Druva AWS Workloads allows selecting preserved ENIs when restoring EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. AMIs and EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. snapshots.
Adds option to select from available preserved Elastic Network Interfaces (ENI) when restoring EC2 AMIs and EBS snapshots, preserving associated security groups for network continuity.
Druva MSC adds Restricted access model with on-demand temp access and ConnectWise PSA alert integration
Adds Restricted customer access level that limits persistent access and requires time-based, user-approved temporary access for support.
Enables ConnectWise PSA integration to automatically create service tickets from Enterprise Workloads alerts via MSC customer and severity mappings.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. Power BI Template 1.0.0 is decommissioned on October 30, 2025; administrators must download the new MSP Power BI Template 2.0.0 to ensure reporting continuity.
!Tenant and Service Plan APIs V2 are no longer functional and return an error; integrations must migrate from endpoints like Create Tenant V2, Get Tenant List V2, etc., to their corresponding V3 replacements.
Veeam Kasten is a Kubernetes-native platform for backing up, restoring, and migrating containerized applications and their persistent data.
Kasten K10 8.0.12 adds native KubeVirtKubeVirtA Kubernetes extension, maintained by the KubeVirt open-source community, that lets virtual machines run as native Kubernetes workloads alongside containers, giving cyber tools a single orchestration layer for both VMs and pods. VM guest filesystem freeze/unfreeze and a new vmSnapshotsPerCluster concurrency limiter.
└──▷ USE IT
Raise the concurrent VM snapshot limit on a busy cluster to allow more parallel KubeVirt snapshots without saturating storage.
yaml
vmSnapshotsPerCluster: 3
Adds vmSnapshotsPerCluster limiter to control the number of concurrent VM snapshots per Kubernetes cluster, defaulting to 1.
KubeVirt VM guest filesystem freeze and unfreeze operations are now invoked directly by Kasten, removing the dependency on a Kanister Blueprint.
2 details in Everything
1 more release in this issue
· 2025-10-21 → 2025-10-29
Ubiq Dashboard gains SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. via SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider./OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. and Prometheus healthcheck endpoints
Adds Ubiq Dashboard SSO support for enterprise SAML or OpenID sources such as Google Workspace, Microsoft Entra, and Okta
Adds a Prometheus healthcheck endpoint for internal observability platforms (requires Ubiq-generated auth token)
Netskope Cloud Exchange 6.0 adds EDM/CFC Beta modules, HA via UI/GlusterFS, and cloudexchange.config file.
Adds Exact Data Match (EDM) Beta module to retrieve data files for custom DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. rules
Adds Custom File Classification (CFC) Beta module to train custom classifiers on Netskope Tenant
Adds UI-based High Availability deployment and node management
Adds built-in GlusterFS shared storage to remove NFS requirement
Adds cloudexchange.config file for simplified setup inputs
+5 moreshow less
Adds support for password-protected custom SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certs
Adds KVMKVMA Linux kernel module that turns the kernel into a hypervisor, letting a process run fully isolated virtual machines using hardware virtualisation extensions. Cyber tools use it to sandbox execution environments at near-native speed. QCOW2 Image deployment support
Adds Ticket Orchestrator Webhook support with manual approval workflow
Adds business rule filtering for Cloud Exchange logs
New Google NotebookLM and Photos app connectors, Perplexity AI visibility controls, and expanded DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. for Amazon Bedrock and GitHub.
Adds Google NotebookLM (PLUS) App Connector with support for Create, Edit, Delete, Rename, Generate, Upload, Download, Share, Post, Response activities, including DLP and instance_id support.
Adds Google Photos App Connector with support for Create, Share, Post, Delete, Archive, Edit, Move, Upload, Download activities, including DLP and instance_id for browser traffic.
Enables granular policy control for Perplexity AI, allowing visibility into enterprise usage and limiting capabilities to sanctioned instances via Generative AI category policies.
Adds Response activity support with DLP for Amazon BedrockLLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. interactions.
Adds Upload activity detection for saving files from Google Colab to GitHub.
+4 moreshow less
Adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login support for AWS sandbox.
Enhances DLP capability for GitHub Upload activity via API for data exceeding 64k bytes.
Adds Download activity detection with content inspection for Google Cloud BigQuery Data Transfer API.
Adds new load balancer support for Amazon Elastic Load Balancing including the from_user field.
Netskope Private Access 131 adds multi-tenant macOS clients, dynamic latency-based reconnection, Hyper-V Ubuntu 22.04 brokers, and AnyApp RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely./SSH enhancements.
Adds support for accessing private applications across up to 20 Netskope tenants on macOS without uninstalling the client
Enables Dynamic Reconnection Based on Relative Latency in the Publisher Wizard to switch Points of Presence
Supports a pre-built Ubuntu 22.04 VM Hyper-V image (VHDX) for Local Brokers
Adds clipboard controls for AnyApp RDP/SSH sessions allowing Full or No access configuration
Introduces Daily Time Window configuration for the Auto-reconnect feature
Netskope Cloud R131 adds SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. for M365/Salesforce, API Traffic Steering, Windows 64-bit SWGSWGA Secure Web Gateway is a network proxy that inspects outbound web traffic, enforcing policy by blocking malicious sites, filtering content, and decrypting TLS — giving cyber tools a choke point for all user HTTP/S sessions. client, and NPA Hyper-V support.
Adds pre-built Ubuntu 22.04 VM Image for Netskope Private Access (NPA) on Hyper-V
Netskope R131 introduces API Data Protection for Salesforce, DNSaaS egress IP policies, Access Proxy, RBI push mode, and new REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services..
Adds doh.dns.apple.com to DNS Over HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. providers in Cloud Confidence Index (CCI).
Enables Egress IP-based DNS security policies for DNS-as-a-Service (DNSaaS) traffic in Cloud Firewall.
Adds CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. support for DNS profiles via REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. v2 endpoints.
Makes Fingerprint 2.0 multimodalmultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats., adding image detection and bulk upload exclusions for DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest..
Allows tenant identification in Email DLP using custom SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. headers instead of domain matching alone.
+25 moreshow less
Increases SMTP proxy DLP scanning limits to 64MB file size and 120-second timeout.
Enables Salesforce File Exposure scanning in Next-Generation API Data Protection via Policies > API Data Protection > Next Gen > New Policy.
Adds quarantine tombstone support for Google Drive file types (.docx, .xlsx.xlsxThe file format used by Microsoft Excel for spreadsheets, based on the Open XML standard. Cyber tools use it to ingest or export structured tabular data in a format analysts already work with., .pptx, etc.) in Next-Gen API DLP.
Introduces Access Proxy objects to segment traffic by destination IP:Port in NG SWGSWGA Secure Web Gateway is a network proxy that inspects outbound web traffic, enforcing policy by blocking malicious sites, filtering content, and decrypting TLS — giving cyber tools a choke point for all user HTTP/S sessions..
Exposes Access Proxy management via the REST API endpoint /api/v2/profiles/accessproxies.
Provides full CRUD for Custom Categories via the new REST API endpoint api/v2/profiles/customcategories (new tenants only).
Enables default alert suppression for Block actions in Real-time Protection policies to reduce SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. noise.
Adds Netskope One for Microsoft Purview DLP integration agent for real-time policy enforcement via Purview.
Allows macOS users to switch between multiple NPA tenants without reinstalling the client.
Supports pre-built Ubuntu 22.04 VM Hyper-V images for NPA Local Brokers.
Enables dynamic reconnection based on relative latency in the NPA Publisher Wizard.
Introduces a new RBI template management interface at /ns#/rbi-templates with full CRUD and REST APIs.
Switches RBI internal communication to a push content model for smoother interaction.
Adds French language support for all standard RBI messages and pop-ups.
Moves Microsoft 365 onboarding to Next-Gen SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. (discontinued in Classic).
Ships 2 new SSPM predefined rules for Azure AD and Workday, plus 5 Salesforce templates.
Adds Deepscan On Demand via REST API supporting files up to 128 MB for Threat Protection.
Supports Netskope Client on macOS Tahoe (v26) and iOS v26.
Enables automatic termination of Netskope Client Debug Mode using the -t [duration] parameter.
Relocates On-Prem Detection setting to Traffic Steering > Steering Configuration in the WebUI.
Upgrades Netskope Client architecture to 64-bit Windows for improved performance.
Makes One-Time Password client disable GA for macOS under Settings > Security Cloud Platform > Client Configuration > Tamperproof.
Makes Block Private IP in Fail-Close GA (request-enabled).
Integrates Gainsight PX telemetry into the Management Console for admin guidance.
Removes Google’s servers from default DNS Over HTTPS providers in Enterprise Browser.
30 details in Everything
└──▷ BREAKING ON UPGRADE
!Cloud TAP Stitcher no longer accepts the --user-id option; it is now automatically added by the system.
Adapter 214.253.15.10 improves Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. v1 to v2 migration with clean resync and out-of-scope cleanup
DEM adds browser extension performance monitoring for steered/bypassed apps and NPA network path visualization.
Adds Error column to the Tunnel Status widget in Network Steering section showing technical error reasons for IPSEC/GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. tunnel down states
Enhances DEM tunnel status and tunnel flapping alerts to include the Error field in alert details, email templates, and webhook payloads
Introduces real user monitoring at transaction level for steered and bypassed browser-based applications via the Browser Extension without requiring the Netskope client
Adds Apps dependencies automated discovery (CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. providers, 3rd-party infra) within Browser Extension monitoring
Adds Page load and API calls performance telemetry collection from end users’ browsers in the Browser Extension
+7 moreshow less
Adds Local connectivity and network path impact metrics in the Browser Extension
Adds App server performance metrics in the Browser Extension
Adds Data transfer and transactional error tracking in the Browser Extension
Adds Network Path Visualization for private apps mapping all paths between users and applications to identify routing gaps and bottlenecks
Integrates NPA performance monitoring into root cause analysis to identify degradations from network and application issues
Adds Other Impacted Users metric in NPA to highlight users experiencing similar degradations across the network
Standardizes custom webhook payloads for Tunnel Status Alerts to include detailed information previously available only in Slack and email
$ git clone --branch 3.11.0 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 3.11.0
Adds Require Issue Approval and Plan Check Enforcement as configurable rollout requirements to control issue deployment behavior
Supports key-value instance labels for database instances
Adds pre-flight validation and circuit breaker to the gh-ost workflow
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Environment rollout policy now requires bb.taskRuns.create permission for manual rollouts; Issue Creators and Last Issue Approvers can no longer roll out issues automatically
!Deprecates bb.sql.export permission and roles/projectExporter role; use appropriate task permissions instead
!Replaces request.row_limit in project IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy with maximum_result_rows in QueryDataPolicy
!Standardizes CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. attribute naming to prefixes resource.*, statement.*, request.* (e.g., environment_id becomes resource.environment_id)
!Unifies risk levels to single RiskLevel enum strings (LOW, MODERATE, HIGH) instead of integers (100, 200, 300); CEL expressions must change from level == 300 to level == "HIGH"
!Simplifies approval template to singleton with flat role array; replaces approval_finding_done/approval_finding_error with approval_status enum
!Consolidates task types into DATABASE_MIGRATE (with migrate_type: DDL/DML/GHOST) and DATABASE_SDL; splits changelog Type into Type and MigrationType enums; merges DatabaseSchemaUpdate and DatabaseDataUpdate into DatabaseUpdate
!Terraform provider: uses RiskLevel enum instead of numeric values for level in bytebase_risk
!Terraform provider: removes disable_copy_data_policy; moved into query_data_policy as the disable_copy_data field
!Terraform provider: updates structure of the approval_flow setting
!Terraform provider: removes row_limit from bytebase_iam_policy setting
JumpCloud introduces dedicated Service Accounts for APIs in the Oct 31 release, enhancing integration security and maintenance by separating API identities from admin users.
Adds the ability to create Service accounts that are not tied to individual Admin accounts for API integration.
1 detail in Everything
3 more releases in this issue
· 2025-10-01 → 2025-10-31
JumpCloud adds AI-powered command generation for Windows/macOS/Linux and ABM service discovery for Apple enrollment
AI Commands Builder (Preview) enables creating and refining scripts for Windows, macOS, and Linux devices via natural language in the Admin Portal.
Apple Business Manager is now a selectable service discovery method for Account-driven Enrollment in Apple MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies..
JumpCloud MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. reaches GA, enabling direct connection between compatible AI tools and administrative capabilities via Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface..
GA release of the JumpCloud MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server integration, allowing compatible AI tools and code editors to interact with organization data and admin capabilities
Nudge Security browser extension auto-approves apps on JumpCloud or OneLogin SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login
Adds automatic app approval when a JumpCloud or OneLogin SSO login is detected
Passbolt 5.6 adds standalone notes for non-password secrets and metadata key rotation with trusted_proxies env var support
Adds new standalone_notes resource type allowing text-based secrets up to 50 KB that are not tied to passwords or TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. entries
Adds organisation settings capability to rotate the shared metadata key without instance downtime, supported by new background services (RotateResourcesMetadataKeyService, UpdateMetadataKeysService)
Adds Client ID Metadata DocumentsClient ID Metadata DocumentsOAuth 2.0 documents hosted at a client's own URL that declare its identity and redirect URIs, letting authorization servers fetch and verify client metadata without manual registration. (CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows.) support for Connected Apps to enable automatic client discovery and registration.
└──▷ HOW TO FIND IT
Turn on CIMD discovery and registration through the Stytch dashboard interface.
📍In the Stytch Dashboard, navigate to your Connected App settings and toggle Enable CIMD discovery and registration.
Enables CIMD discovery and registration for Stytch Connected Apps via dashboard or Terraform modules.
Adds Client ID Metadata DocumentsClient ID Metadata DocumentsOAuth 2.0 documents hosted at a client's own URL that declare its identity and redirect URIs, letting authorization servers fetch and verify client metadata without manual registration. (CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows.) support for OAuth client discovery and registration
Enables CIMD discovery and registration directly in the Stytch Connected Apps dashboard.
Ory Enterprise adds SQL connection pool metrics/tracing and updates the base image to distroless/static-debian12:nonroot
Adds distributed tracing and OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor.-compliant metrics collection for the high-performance SQL connection pool in Ory Enterprise components (Hydra, Kratos, Keto, Oathkeeper).
Updates the default container base image from gcr.io/distroless/static-debian12:debug-nonroot to gcr.io/distroless/static-debian12:nonroot, reducing image size and attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
Ory Kratos triggers login hooks for FedCM sign-in and updates Google OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. parameter handling
└──▷ BREAKING ON UPGRADE
!The configuration option selfservice.methods.link.config.base_url has been removed.
Ory Hydra Enterprise extends refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. rotation grace period to 180 days for migration scenarios
Increases the maximum rotation_grace_period in Ory Hydra Enterprise from 30 days to 180 days when a reuse count is configured.
Ory Kratos Courier Messages endpoint drops X-Total-Count header and adds secrets.pagination config for pagination tokens.
Removes the X-Total-Count HTTP response header from the /admin/courier/messages endpoint.
Adds secrets.pagination configuration key to define encryption keys for encoding and decoding pagination tokens.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The X-Total-Count HTTP response header is no longer present in responses from the /admin/courier/messages endpoint; clients relying on it must detect the last page by checking if returned items are fewer than the requested page size.
Account Experience 2.0 GA introduces new default UI, legacy opt-in, updated config defaults, and claim enhancements.
Adds Account Experience 2.0 as the default UI for new Ory projects
Requires explicit Use legacy Hosted UI toggle to retain previous interface
Changes kratos_feature_flags_legacy_oidc_registration_node_group and kratos_feature_flags_password_profile_registration_node_group defaults to false for new projects
Sets default post-login redirect to /session
4 details in Everything
└──▷ BREAKING ON UPGRADE
!New projects now use Account Experience 2.0 by default instead of the legacy UI.
!kratos_feature_flags_legacy_oidc_registration_node_group and kratos_feature_flags_password_profile_registration_node_group now default to false for new projects.
!Default post-login redirect URL changes from previous value to /session.
Adds prometheus metrics for enterprise license usage and expiry
└──▷ GET THIS VERSION
$ git clone --branch version/2025.10.0 https://github.com/goauthentik/authentik.git
# already have the repo? check out this version:$ git checkout version/2025.10.0
ZPA App Connector OVAOVAAn Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. images updated for RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 to support OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. enrollment and automated OS security updates.
Adds OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 enrollment support to ZPA App Connector on Red Hat Enterprise Linux 9 via updated OVA images for Nutanix AHVAHVAcropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license. and VMware
Updates App Connector OVA images on Red Hat Enterprise Linux 9 to support automated OS security updates
2 details in Everything
30 more releases in this issue
· 2025-10-01 → 2025-10-31
Authentication Service supports common domains for multiple tenants with OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. flow
Adds support for using the same domain across multiple Authentication Service tenants
Enables tenant selection via a drop-down menu during login for users on shared domains
Supports OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. (OIDC) flow redirection for Experience Center, Breach Predictor, EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do., and DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores.
ZIA adds Creative Commons search filter and End User Notifications for Zscaler Client Connector firewall/DNS/IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. policies.
Adds the Enable Creative Commons Search Results option to the Policy > URL & Cloud App Control > Advanced Policy Settings page in the admin portal.
Enables End User Notifications (EUNs) for ZIA Firewall Filtering, DNS Control, and IPS Control policies when using Zscaler Client Connector version 4.8 or later on Windows.
Adds a customizable EUN message selection field to individual firewall, DNS, and IPS policy rules in the ZIA Admin Portal.
Adds an Adaptive Access Profile column and filter to Web Insights Logs for tracking adaptive access decisions.
New ZPA API endpoints for application management, OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. auth, and device posture failure notifications
Adds Device Posture Profile Failure Notification to send default or custom alerts when a device fails a posture check
Adds multiple new GET/POST/PUT/DELETE endpoints under /mgmtconfig/v1/admin/customers/{customerId}/application/ for application management, including export and validation
Zscaler Client Connector 4.8 adds Z-Tunnel 2.0 support, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. forwarding, OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. pre-auth, and per-profile packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic..
Adds the ability to download, validate, and cache the CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. used when performing the CRL check for the Client Certificate device posture check in certain fallback scenarios
Supports using one-time passwords (OTPs) for customers with Authentication Service tenants
Supports IPv6 traffic forwarding from IPv6-only Windows devices to Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA)
Adds support to install the latest Zscaler Root CA Certificate if Install Zscaler SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Certificate is enabled and remove the existing certificate for SSL Inspection
Supports identifying the system proxy manually instead of using the default Microsoft Windows APIs
+26 moreshow less
Adds an app profile option to define the default language for the Zscaler Client Connector app and an in-app option that allows users to change the language as needed
Adds an install option that can be used to prevent Zscaler Client Connector from starting automatically after installation
Supports enabling and disabling ZIA and Digital Experience (ZDX) remotely via CLI
Supports enabling local packet capture on an app profile in addition to the existing global packet capture enablement
Enhances the Packet Capture on the More window in the app to provide separate filter options for adapter packets and Lightweight Filter (LWF) driver packets
Supports automatically starting packet capturespacket capturesA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. for specific scenarios such as tunnel failures and health checks
Updates Zscaler Client Connector to always use the packet-based filter driver when in Tunnel mode regardless of the Tunnel Driver Type setting in a user’s forwarding profile
Updates captive portal detection to make asynchronous requests to reduce latency
Supports controlling how End User Notifications (EUNs) from ZIA are displayed for users
Expands support for adding additional user login domains in the Additional IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. Domains field, making it available to all customers, not just those using Imprivata
Supports using OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 to authenticate for Authentication Service users before the machine tunnel starts, requiring end users to use an external device
Updates Zscaler Client Connector to always use the packet-based filter driver when in Tunnel mode regardless of the Tunnel Driver Type setting in a user’s forwarding profile
Expands HTTP_CONNECT_TIMING metrics for Web probes, improving visibility into TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. handshake and HTTP connection times between Z-Tunnel 1.0 and the Service Edge
Supports a new traffic forwarding action for ZIA Disaster Recovery so you can forward traffic using Zscaler Tunnel (Z-Tunnel) 2.0
Supports testing Business Continuity mode with a group of users
Supports the Adaptive Access Engine used to receive user-related context signals from Microsoft Defender
Supports automatically switching to a TLS connection if the Z-Tunnel 2.0 DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. connection becomes unstable
Supports displaying a customizable notification to end users who are blocked from a ZPA app due to a failed device posture
Enables Zscaler Client Connector to steer traffic and manage endpoint firewall rules based on the user’s network type (e.g., On-Trusted or Off-Trusted)
Supports automatic ZPA reauthentication settings on the app profile that can override the global setting and can be applied based on a user’s network environment (e.g, On-Trusted or Off-Trusted)
Supports using location services on the user’s device to find the nearest data center
Supports preventing automatic reauthentication to ZPA while a user’s device is locked
Supports a device posture check for specific Zscaler Client Connector versions
Supports monitoring system proxy settings and re-caching them if Zscaler Client Connector detects changes
Updates Zscaler Client Connector to run Npcap in non-promiscuous mode (instead of promiscuous mode) when performing packet captures
Supports creating and assigning notification templates per app profile to allow more granularity in which users see different notifications
31 details in Everything
└──▷ BREAKING ON UPGRADE
!Zscaler Client Connector version 4.8 always uses the packet-based filter driver when in Tunnel mode regardless of the Tunnel Driver Type setting in a user’s forwarding profile.
Adds Jira integration for External Attack Surface Management findings to create and sync tickets from the Admin Portal.
Adds Jira Integration for EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do., allowing admins to connect a Jira instance to individual EASM organizations.
Enables creation of Jira tickets for EASM findings with automatic synchronization between the two applications.
Zscaler ZTB 8.0.6 introduces Gateway Version Manager, separate WAN/private DNS, static route sharing over RT, and single-VLAN DNS source.
Adds Gateway Version Manager panel for per-gateway upgrade operations, version download (up to 3), activation, and default designation with status observation (Initializing, Restarting, Standalone, Active, Standby).
Adds ability to designate a single VLAN in LAN as the source for DNS proxy requests over Routed Tunnels via Use for DNS Proxy on the VLANs tab.
Enables sharing static routes over Routed Tunnels via BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. by enabling Share Over RT on static routes, advertising target subnets to the hub and SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. fabric.
Allows separate configuration of WAN and Private DNS servers for a site in DNS settings, populating distinct system groups (e.g., System-Private-DNS-Servers-Group) for different query resolution paths.
ZIA adds Sublocation Scopes for AWS Cloud Connector workloads via new UI fields and API attributes
Adds Scope, Account, Namespace, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware., and VPC Endpoint fields to the Administration > Location Management > Locations > Add Sublocation window to map workload traffic for granular policy application.
Updates /locations cloud service API endpoints (models Location and LocationLite) with new attributes: subLocScopeEnabled, subLocScope, subLocScopeValues, and subLocAccIds.
Adds AWS endpoint APIs for account/group management and JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. auth support for GCP tag-based policies.
Adds programmatic access to AWS accounts and groups via GET/POST/PUT/DELETE APIs under /publicCloudInfo and /accountGroups.
Enables JSON Web Token (JWT) authentication for Zscaler Cloud & Branch Connector workloads.
Supports applying security policies in Google Cloud Platform using user-defined tags, attributes, labels, and network tags.
Client Connector 4.5.0.498 for Windows adds automated Zscaler Root CA cert management during SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection installation.
Adds support to install the latest Zscaler Root CA Certificate if Install Zscaler SSL Certificate is enabled and to remove the existing certificate for SSL Inspection.
ZIA adds JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. authentication for Zia Cloud & Branch Connector workloads and enhances US Driver's License DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries with state-level sub-dictionaries.
Adds JWT Authentication support for Cloud & Branch Connector workloads, configurable via Advanced Settings page exemptions and managed via Authentication Service Admin Portal token validators
Adds Enhanced Driver's License (United States) predefined DLP dictionary with individually configurable state sub-dictionaries (50 states + DC) accessible via DLP Dictionaries & Engines page
Adds GET /casbTenant/scanInfo and GET /casbTenant/validate/status/{tenantId} endpoints to retrieve SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Scan Configuration and validation status
Adds Adaptive Access Profile filter and column to Web Insights Logs for tracking adaptive access decisions
Incidents page gains External Collaborators Groups, File Link Expiry, and File Modified/Shared columns for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security source DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. incidents
Adds External Collaborators Groups, File Modified By, and File Shared By attributes as new filter options in the Filters window on the Incidents page.
ZIA adds CASBCASBA Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. tenant scan APIs and JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. workload auth; Adaptive Access in limited availability.
Adds GET /casbTenant/scanInfo API endpoint to retrieve SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Scan Configuration
Adds GET /casbTenant/validate/status/{tenantId} API endpoint to validate SaaS application tenant status
Adds support for Adaptive Access Engine in Experience Center Limited Availability
Client Connector 4.7.0.113 for Windows updates packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. mode and firewall rule lifecycle; fixes numerous reliability issues.
Updates Zscaler Client Connector to run Npcap in non-promiscuous mode (instead of promiscuous mode) when performing packet capturespacket capturesA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic..
Updates a previous change to keep a Zscaler Client Connector firewall rule active from starting to stopping the app to also delete the rule when exiting the app and add the rule when restarting the app.
Workflow Automation adds SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. attributes and new time range filters for incidents.
Adds Current Tag Name, Is Copilot Accessible, External Groups Collaborators, Internal Groups Collaborators, Document Sub Type, File Line Expiry, File Modified By, File Shared At, and File Shared By as mapping properties for Incident Group Mappings and Workflow Mappings of Source DLP type SaaS Security.
Adds Current Hour, Last Hour, Last 2 Hours, Last 6 Hours, and Last 12 Hours options to the time range selector on the Incidents page and Incident Analytics dashboard.
Adds a clickable Username/User Email link on the Incidents page and Incident Analytics dashboard that filters incidents by that specific user.
Admin Portal adds SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. certificate expiration banners, email reminders, and multiple IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. cert upload support
Adds a banner in the Admin Portal and visual indicators on the External Identities page when SAML certificates (IdP Certificate or SAML Request Signing and Decryption Certificate) are expiring within 90 days or have expired.
Enables weekly email reminders for the last 90 days before SAML certificate expiration, plus two post-expiration reminder emails to administrators.
ZIA adds API endpoints for IP Groups, NSS download, SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. scan status; Adaptive Access Engine in limited availability.
Adds override boolean query parameter to the PUT /ipDestinationGroups/{ipGroupId} endpoint to override IPs.
Adds GET /nssDownload/{nssId} endpoint to download NSS virtual appliance information by server ID.
Adds GET /casbTenant/scanInfo and GET /casbTenant/validate/status/{tenantId} endpoints for SaaS Security scan configuration and validation status.
Adds Adaptive Access Engine support for URL Filtering and Cloud App Control policies under Limited Availability.
Adds Adaptive Access Profile filter and column to Web Insights Logs.
ZPA Network Connector gains GCP prebuilt image support for upcoming VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. redundancy.
Adds a new Google Cloud Platform (GCP) prebuilt image for the ZPA Network Connector.
Includes preliminary support for upcoming VPN redundancy features in the GCP Network Connector.
ZPA Private Access adds global BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. configuration, redundancy monitoring, and new CLI capabilities for VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Service Edges and Network Connectors.
Adds global BGP configuration options to VPN Service Edges and Network Connectors, including BGP Timers and bidirectional forwarding detection (BFD) session failure detection.
Introduces a new BGP Peers page in the UI to view routing, peers, and connection information for Network Connectors per VPN Service Edge.
Adds a Network Connector Throughput chart on the Network Connectors Dashboard to monitor throughput and capacity planning.
Enables execution of diagnostic commands with VPN sessions for VPN Service Edges, Network Connectors, and Network Connector groups on the VPN Support Information page.
Adds a Redundant Mode option viewable by expanding a group on the Network Connector Groups page or adding it as a column on the VPN Service Edges page.
+1 moreshow less
Allows setting outbound VPN tunnel gateway ports for VPN Service Edges to use a range from 51820 to 53000.
ZPA adds Private Cloud Controller backup scheduling, remote support sessions, and specific BC notifications.
Adds scheduled backup of up to 100 configuration and policy copies for Private Cloud Controllers, restorable via script
Enables creation of remote troubleshooting sessions for Private Cloud Controllers from the ZPA Admin Portal Support Information page
Extends Notifications Service to include events for Private Cloud Controllers: Control Connection Disconnected, CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. Starvation, Enrollment Completed, Invalid System Listen IP Configuration, Last Component Disconnected, Outdated Component Manager Version, Provisioning Key Utilization Exceeded Limit, Upgrade Complete, and Upgrade Failed
Adds Force Business Continuity Mode toggle when editing a Private Cloud to manually override mode for Controllers, Edges, and Connectors
Adds Private Service Edge groups dedicated to Business Continuity or Disaster Recovery
Client Connector 4.5 adds named notification templates, per-app local packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic., location-based firewall steering, and new profile management APIs.
notification_template configuration in app profiles for consolidated end-user notifications
Per-app local_packet_capture enablement option in App Profiles alongside global setting
Traffic steering and endpoint firewall rule management based on user’s network type (On-Trusted/Off-Trusted) via Location-Based Policies
New programmatic API endpoints for managing application profiles, process-based applications, predefined IP-based applications, and custom IP-based applications
Forwarding profile option to automatically switch from Z-Tunnel 2.0 DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. to TLS when connection becomes unstable
+3 moreshow less
App profile setting to disable iCloud Private Relay
Device posture check capability for specific Zscaler Client Connector versions
Automatic ZPA reauthentication settings at the app profile level with network environment (On-Trusted/Off-Trusted) override
ZPA Private Access introduces UI-based diagnostic filters and updates IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. configuration lifecycle for Authentication Service migration.
└──▷ BREAKING ON UPGRADE
!Disabled admin IdP configurations migrated to Authentication Service are permanently deleted after 30 days.
OpenSSH 10.1 adds RefuseConnection, -N to ssh-add, PKCS#11PKCS#11The standard programming interface software uses to ask an HSM, smart card or token to sign or decrypt with a key it holds. Supporting it lets a tool keep its keys in hardware. ed25519, and improved DSCP handling
└──▷ USE IT
Refuse a connection immediately based on host matching in config.
Supports ed25519 keys on PKCS#11 tokens via ssh(1) and ssh-agent(1).
Adds WarnWeakCrypto ssh_config option to control warnings for non-post-quantum key exchangepost-quantum key exchangeA cryptographic handshake algorithm designed to resist attacks from quantum computers, using math problems like lattices that quantum algorithms cannot efficiently solve, letting tools stay secure against future quantum-capable adversaries. algorithms.
Moves default ssh-agent socket path from /tmp to $HOME/.ssh/agent with new flags -U, -u, -uu, and -T.
Termius 9.32.2 adds workspace session persistence, local terminal in templates, Flexoki themes, and SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. fingerprints.
Local terminals can now be saved in workspace templates, allowing you to preserve your local development environment alongside remote connections
Two new terminal themes were introduced: Flexoki Dark and Light
Replaced MD5 fingerprints by SHA256 fingerprints in connection flow
Twingate adds Just-in-Time access requests with configurable duration and approval workflows.
Enables configuring just-in-time (JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility.) access request workflows for on-demand Resource access
Allows setting time-limited access windows between 1 hour and 7 days via JIT configuration
Supports admin-approval or auto-approved audit-mode for JIT resource requests
Headscale v0.27.0 adds autogroup:self/member/tagged support, a new healthcheck command, in-memory node store, and policy direct-manipulation flag.
└──▷ GET THIS VERSION
$ git clone --branch v0.27.0 https://github.com/juanfont/headscale.git
# already have the repo? check out this version:$ git checkout v0.27.0
Adds support for autogroup:member and autogroup:tagged autogroups in ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. policy.
Adds experimental support for autogroup:self autogroup (may be expensive on large installations; report bugs).
Adds a healthcheck CLI command for checking instance health.
Adds a flag to directly manipulate policy stored in the database.
Adds in-memory NodeStore data structure to reduce database reads/writes and improve performance on read-heavy workloads.
+5 moreshow less
Policy now rejects invalid/unknown fields, making spelling errors easier to detect.
DERPMap update mechanism now retries on failure and preserves the previous map if an update fails.
OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.: Group claims are now sourced from UserInfo, and user details are updated from UserInfo claims before evaluating allowed groups, email, and domain.
Adds /version HTTP endpoint to the headscale server.
Default derp.update_frequency changed from 24 hours to 3 hours for faster propagation of upstream DERP changes.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!32-bit binaries are no longer produced or supported.
!Policy: Zero or empty destination port is no longer allowed in ACL rules.
!Stricter hostname validation is enforced: hostnames must be 2–63 characters, alphanumeric and hyphens only, and cannot start or end with a hyphen. During client registration, invalid hostnames are automatically renamed to invalid-XXXXXX; during hostinfo updates and CLI operations, invalid hostnames are rejected with an error.
!Ubuntu 20.04 is no longer supported by the Debian/Ubuntu packaging.
!Policy v1 code has been removed.
!SQLite databases undergo a significant schema migration on upgrade — back up your db.sqlite (and WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites./SHM files) before upgrading.
!The minimum supported Tailscale client version is now v1.64.0.
Adds Relay Service for SSH proxying, ElastiCache Serverless support, and Web UI Workload ID listing
└──▷ GET THIS VERSION
$ git clone --branch v18.3.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v18.3.0
Introduces the teleport relay service to act as a lightweight proxy for SSH connections, allowing clients and agents to bypass the control plane in large deployments.
Adds a Workload Identities page in the Web UI to list all workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. resources registered in the cluster.
Enables continuous health monitoring of registered Kubernetes clusters with status display in the web UI and automatic routing to healthy services.
Allows multiple Teleport clusters to simultaneously discover the same EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instances via auto-discovery without interference.
Adds time_between_imports setting to Okta plugin configuration to control import frequency.
+4 moreshow less
Adds support for regex conditions in AccessMonitoringRule policies.
Adds support for SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. and streamable-HTTP MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers in Teleport's capabilities.
Enables schedule configuration for Access Automation Rules directly within the Web UI.
Updates Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. plugin installation UI to support group filter configuration.
9 details in Everything
3 more releases in this issue
· 2025-10-02 → 2025-10-30
Teleport v18.2.4 adds EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware./GCP/Azure server auto-discovery and Kubernetes recording context name templating
└──▷ GET THIS VERSION
$ git clone --branch v18.2.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v18.2.4
Added support for multiple agents in EC2, GCP and Azure Server auto discovery, allowing server access from different Teleport clusters
Added support for customizing context names with a template in kubernetes/v2 output
Changed the event-handler plugin to skip over Windows desktop session recording events by default
Aembit adds Azure Key Vault private network access, Azure Entra Federation credential provider, and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for admin console.
Adds support for Azure Key Vault private network endpoints through the Azure Key Vault Credential Provider.
Introduces the Azure Entra Federation Credential Provider integration to authenticate with Azure Entra using Workload Identity Federation and OIDC
Enables configuration of OIDC 1.0 Identity Providers for administrator Single Sign-On (SSO) authentication in the Aembit admin console
SPIRE v1.13.3 adds file-based join tokens, caller-path Rego filtering, and absolute X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. CA expiry metrics.
└──▷ GET THIS VERSION
$ git clone --branch v1.13.3 https://github.com/spiffe/spire.git
# already have the repo? check out this version:$ git checkout v1.13.3
New X.509 CA metric exposes absolute expiration time, complementing the existing TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit.-based metric.
New spire-agent configuration option sources join tokens from files, enabling integration with third-party credential providers.
New capability to filter on caller path in spire-server Rego authorization policies.
spire-server now uses SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. for X.509-SVIDX.509-SVIDAn X.509 certificate formatted to carry a SPIFFE Verifiable Identity Document, binding a cryptographic identity to a workload so cyber tools can authenticate services without passwords or static secrets. Subject Key Identifiers when GODEBUG contains fips140=only.
oidc-discovery-provider now fails to initialize when started with unrecognized arguments, surfacing misconfigurations at startup.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!oidc-discovery-provider now refuses to start when passed unrecognized arguments; previously unrecognized arguments were silently ignored, so any deployment passing extra flags will fail on upgrade.
Adds EOL OS detections, known ransomware use risk factor, and enhanced CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmarks
Adds new detections for end-of-life operating systems to identify legacy assets in your infrastructure
Introduces known ransomware use as a new risk factor for prioritizing vulnerability remediation
Enhances existing CIS benchmark policies with updated checks and improved coverage
Drata adds Multi-IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. support allowing connection and unified management of Okta, Google, JumpCloud, and CSV sources.
Adds Multi-IdP support to connect and sync personnel from Okta, Google Workspace, JumpCloud, and CSV in a single setup
Drata adds native MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. integration for XFA to sync device inventory and data.
Vanta adds non-admin custom test creation, Agent framework context, CTM account-level tracking, simplified GitHub connection, and Bedrock model inventory.
Adds ability for users with View and edit permissions on Tests and Documents to create custom tests without Admin access
Enables Vanta Agent to use framework and control context in Public Preview for tailored GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. responses
Adds account-level tracking of questionnaires in CTM alongside existing Trust Center access and commitments
Introduces streamlined OAuth flow for GitHub connection to eliminate redundant configuration steps
Improves evidence eval accuracy by reducing false positives in analysis by approximately 50%
+1 moreshow less
Adds Bedrock AI Model Inventory tab with metadata (last use, detection date, usage frequency) and export support for AWS Bedrock users
6 details in Everything
3 more releases in this issue
· 2025-10-05 → 2025-11-01
Vanta adds ROPA import, CRI v2.1 framework, Trust Center layout customization, and Cloudflare domain inventory.
Adds ability to import data inventory directly from a ROPA spreadsheet
Introduces Cyber Risk Institute (CRI) Profile v2.1 framework with 319 mapped controls
Enables Trust Center layout customization with drag-and-drop section reordering and visibility toggles via Customize layout
Adds custom fields for processing activities in the Data Inventory and ROPA dashboard
Allows attaching supporting evidence (files or knowledge base links) to QAuto responses, exported in a zip file
+5 moreshow less
Provides access to FedRAMP 20xFedRAMP 20xA GSA-led overhaul of the FedRAMP cloud-authorization program aimed at cutting compliance burden through continuous, automated evidence collection rather than point-in-time audits, letting vendors reach federal markets faster. Low and Moderate frameworks with control inventories and baseline toggling
Enables multi-select filters for Integrations and Controls on the Tests page
Supports customizable policy renewal cadences (quarterly, monthly, every two years)
Displays domain inventory for Cloudflare connections, including proxy and protection status
Adds three new tests for verifying Cloudflare protections
Vanta adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for risks/vulns/people/docs/integrations, auto scoping GA, custom test filters, and framework scope overview
Adds Vanta MCP Server endpoint enabling queries for risks, vulnerabilities, people, documents, and integrations from external tools
Reaches General Availability (GA) of Auto Scoping for Personnel with instant scope updates across linked assets
Adds filter logic support to Custom Tests to target specific resource subsets
Adds Framework Scope Overview view showing total/percentage of scoped systems/people and change logs
Adds new Notification Preferences section under Team Settings for managing team alert toggles
Adds 5 new automated compliance tests for AWS DocumentDB, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. backups, risk register, capacity monitoring, and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS.
New DocumentDB Cluster Encrypted test verifies AWS DocumentDB clusters are encrypted at rest
New EC2 Backups Enabled test checks whether Amazon EC2 instances have backup mechanisms enabled
New No Risks Are in Open State test ensures all risks logged in Scrut’s Risk Register are mitigated, accepted, or closed
New Third-party Tool Used for Capacity Monitoring test validates the use of a recognized third-party monitoring tool for capacity monitoring
New Data in Transit is Encrypted test enables adding web platform domains as resources and runs automated SSL/TLS scans to verify minimum A-grade encryption
Azure DevOps integration now uses Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. OAuth with SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. support; existing accounts must reconnect to continue using it.
└──▷ HOW TO FIND IT
Reconnect Azure DevOps account using new Entra ID auth to restore integration.
📍Navigate to Integrations → Azure DevOps in Scrut and follow the prompts to reconnect using Microsoft Entra ID OAuth.
Adds bulk editing, status changes, and deletion of multiple risks from the Risk Register UI
Adds multi-select capability in the Risk Register allowing users to select multiple risks via checkboxes for subsequent bulk operations.
Adds Edit button in the Risk Register toolbar to update common fields (assignee, department category, custom fields) across all selected risks simultaneously.
Adds bulk status transition actions (monitoring, reset, close) for selected risks in the Risk Register.
Adds bulk deletion capability with confirmation prompt for removing multiple risks from the Risk Register.
Scrut adds EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe. framework support in the Frameworks module for compliance management.
Compyl v6.4 adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. via SAML 2.0SAML 2.0A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider., in-app custom control management, Asana/Azure Databricks/BambooHR/Freshdesk/JumpCloud/MongoDB/InsightCloudSec/SentinelOne/Workday integrati
Adds SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. 2.0 federated Single Sign-On (SSO) for enterprise customers via corporate identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. such as Azure AD, Okta, and Ping
Enables in-app creation, editing, and deletion of custom control sets with automatic change tracking for user, action, and timestamp
Adds Asana integration to centralize project and task management data within the GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. platform
Adds Azure Databricks integration to ingest cluster activity, job execution logs, notebook usage, and user access events
Adds BambooHR integration for employee records, job roles, departments, and time-off information
+12 moreshow less
Adds Freshdesk integration for helpdesk tickets, contacts, and company information
Adds JumpCloud integration for user identities, group assignments, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. settings, and login events
Adds MongoDB Atlas integration for clusters, users, custom roles, project events, IP access lists, and organization activity
Adds Rapid7 InsightCloudSec integration to aggregate discovered packages, vulnerabilities, and resource inventories
Adds SentinelOne integration for endpoint detection and responseendpoint detection and responseEndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. (EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.) data including device status, threat events, and policy configurations
Adds Workday integration for employee, organizational, and role-based access data
Introduces Compliance Trend module showing daily trend lines of Control Set compliance scores for up to 90 days in the Compliance Overview
Opens linked Tasks or Queries in a side drawer from the Controls module while preserving context on the Control record
Adds status lights and ToolTips for Tasks and Queries displayed inside Control records
Expands Query Builder visibility to include next-run details, ownership, and automated health statuses
Redesigns Integrations page to show sync history, query activity, linked dashboards, and exposed tables in one view
Improves Compyl.AI to utilize the entire form for text field suggestions including likelihood, impact, owner, and tags
Zanshin adds RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., SentinelOne/Intune scan targets, business impact assignment, new reports, and SAQSAQSelf-Assessment Questionnaire: a PCI DSS compliance form that merchants and service providers complete to validate how they handle cardholder data, with different variants scoping different payment environments. history.
Adds Role-Based Access ControlRole-Based Access ControlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC) with predefined and customized roles accessible via the Roles tab in the Members section.
Expands scan target support to SentinelOne Singularity and Microsoft Intune (under Microsoft 365) for continuous monitoring.
Enables assignment of Business Impact levels to third parties, visible as filters in the Following Organizations List and Portfolio Dashboard.
Introduces new Generate Report functionality for Third-Party assessments and Self-Assessment Report generation from questionnaires.
Adds historical information view for SAQs, showing answer/comment history per question and status changes via the See history toggle.
CISO Assistant v3.5.0 adds JIRA integration, clone-instance CLI command, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. capabilities, and UI enhancements.
└──▷ GET THIS VERSION
$ git clone --branch v3.5.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.5.0
Adds clone-instance Django command to duplicate a CISO Assistant instance
Adds JIRA integration for syncing applied controls and risks with Atlassian projects
Expands Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCP) server capabilities
Adds markdown support in incident observation fields
Adds implementation group column in requirement assessments views
+3 moreshow less
Includes ref_id on applied controls export and threats selection
Indicates attached evidence directly within incident observation entries
Improves audit details page loading performance
8 details in Everything
7 more releases in this issue
· 2025-10-04 → 2025-10-31
CISO Assistant v3.4.1 adds audit comparison capability and a new cloud sovereignty framework with weighted average calculations
└──▷ GET THIS VERSION
$ git clone --branch v3.4.1 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.4.1
Adds the ability to compare audits side-by-side for gap analysis and progress tracking.
Introduces a new cloud_sovereignty framework and an implementation of weighted_average calculation logic.
CISO Assistant v3.4.0 introduces dynamic questionnaires, a mapping builder toolbox, and SCF framework support.
└──▷ GET THIS VERSION
$ git clone --branch v3.4.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.4.0
dynamic questionnaires allow assessments to adapt based on prior answers, reducing noise and guiding users through relevant controls
new experimental toolbox for building and managing mappings between frameworks becomes available to assist with cross-framework translation workflows
adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. authentication request signature support to ensure integrity of identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. requests during federated login flows
new SCF 2025.2.2 Framework is now available as a selectable standard for compliance assessments alongside the updated SCF 2024.2
Adds domain field to the campaign form for perimeters
└──▷ GET THIS VERSION
$ git clone --branch v3.3.1 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.3.1
└──▷ HOW TO FIND IT
Limit a risk assessment campaign to a specific business unit or asset class by selecting its domain during creation.
📍In the CISO Assistant UI, go to Campaigns › Create New. In the Perimeter section, use the new dropdown to select the desired domain before saving.
CISO Assistant v3.3.0 adds Cyfun 2025 framework support, BIA combined report, markdown for task observations, and Kafka SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS capability.
└──▷ GET THIS VERSION
$ git clone --branch v3.3.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.3.0
Adds a BIA combined report view
Enables markdown formatting in task_observation fields
Supports SSL/TLS for communication between dispatcher and Kafka broker
CISO Assistant v3.2.4 adds direct input of support assets on primary assets with link preservation.
└──▷ GET THIS VERSION
$ git clone --branch v3.2.4 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.2.4
Enables inputting support assets directly on primary assets while preserving the links between them.
CISO Assistant v3.2.0 adds vulnerability visualisation, EBIOS RMEBIOS RMA French risk-management method published by ANSSI for analysing cyber threats and selecting countermeasures; tools use it to structure risk assessments that satisfy French and EU regulatory expectations. study reports, CIS v8 controls, folder permissions, and richer dashboards.
└──▷ GET THIS VERSION
$ git clone --branch v3.2.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.2.0
Adds asset owner column to the assets list view.
Adds full-path display to the UserGroup model table.
Adds backup and instance version compatibility check to prevent applying a backup from a mismatched version.
Adds import of elementary actions through the data wizard.
Adds calendar heatmap component to surface activity over time.
+11 moreshow less
Adds vulnerabilities visualisation view.
Adds EBIOS RM study report generation and resolves entity relationship inconsistencies.
Adds management of more entity relationships in EBIOS RM studies.
Adds user-level permissions scoped to individual folders.
Adds owner column to the evidences table.
Adds label support for domains.
Adds flash mode for action plans on each applied-controls section to highlight pending items.
Improves governance, risk, and operations dashboards with richer data views.
Improves GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. dashboard with additional data points.
Improves X-Ray issue aggregation for readability and adds more detection rules.
Allows unselecting a previously chosen answer to a question in assessments.
16 details in Everything
└──▷ BREAKING ON UPGRADE
!v3.1.0 must be applied before upgrading to v3.2.0; skipping that version will cause a failed upgrade.
CISO Assistant v3.1.0 adds data breach tracking, risk scenario/exception/incident CSV export, PMBOK support, and new filters.
└──▷ GET THIS VERSION
$ git clone --branch v3.1.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.1.0
Adds data breach tracking capability for security incidents
Enables exporting risk scenarios, exceptions, and incidents tables to CSV format
Introduces PMBOK framework support with accreditation (homologations) tracking
Adds assigned_to filter for filtering tasks by assignee
Adds not exploitable and unaffected options to vulnerability status
+8 moreshow less
Adds severity filter and status filter to the vulnerabilities view
Adds operations metrics section to the Analytics dashboard
Adds due date column to the ISO objectives table
Enables HTML export of audits with inlined CSS for offline viewing
Adds table of content generation in audit table mode
Adds flash mode visualization for applied controls
Enhances Graph Explorer interface capabilities
Supports INFO severity level across objects that utilize severity metrics
Runlayer is an MCP gateway that enforces identity-mapped permissions and detects threats across the agents and MCP servers employees use.
Runlayer 1.5.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Prompts support, popularity sorting, and server editing.
MCP Prompts Support with full integration for the MCP prompts specification
Enhanced Catalog features popularity-based sorting
Server Editing allows changing server name and description from the details page
3 details in Everything
2 more releases in this issue
· 2025-10-16 → 2025-10-28
Runlayer 1.4.0 adds ChatGPT and Gumloop MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. client support with improved OAuth error handling and prompt detection.
Adds ChatGPT, Gumloop, and additional AI platforms as supported MCP clients
Runlayer 1.3.0 adds local MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. v2, Management API for automation, and redesigned MCP details UI.
Use local MCP servers with the same security, authz, observability and auditing as remote MCPs
Automate server and user provisioning via REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. with API key authentication
Rebuilt server details with tabbed navigation, client-specific setup instructions (Claude, Codex, others), and one-click deeplinks
Migrated catalog to standardized MCP registry schema
Enforced strict timeouts on all MCP operations
+1 moreshow less
Captures stderr output, exit codes, and connection errors for faster troubleshooting of MCP server failures
Portkey Backend 1.3.2 adds Workspace Grouped Analytics API and Multi-Organization SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support
Adds GET /workspaces/analytics API endpoint for workspace-grouped analytics with multi-dimensional grouping and cost-based filtering
Enables authentication via SSO across multiple organizations
2 details in Everything
9 more releases in this issue
· 2025-10-02 → 2025-10-29
Enterprise Gateway 1.16.4 adds bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. auth for AWS Bedrock and EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. Pod Identity support.
Adds support for bearer tokensbearer tokensA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. authentication in AWS Bedrock provider configuration
Adds EKS Pod Identity integration with IRSAIRSAAn AWS mechanism that lets a Kubernetes pod assume an IAM role via a service account, so tools running in EKS can call AWS APIs without embedding long-lived credentials. for EKS clusters
Enterprise Gateway 1.16 adds AWS Service Role auth, request timeout and NO_PROXY env vars, TLS for control plane, Bedrock global profile/name mapping.
Adds REQUEST_TIMEOUT environment variable to configure fetch timeouts for outbound LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. requests in milliseconds (default: 300000).
Adds NO_PROXY environment variable support to bypass outbound requests to specified hosts.
Adds TLS_KEY, TLS_CERT, and TLS_CA environment variables to configure TLS for control plane calls in air-gapped deployments.
Adds AWS Service Role authentication support for AWS Bedrock models, allowing the Gateway to use its own service role.
Adds global profile support for AWS Bedrock models.
+1 moreshow less
Adds name field mapping for the /messages endpoint document object in AWS Bedrock.
Portkey Backend 1.3.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. APIs, SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. org management, workspace key limits, and Budget resets
Adds mcp endpoints for MCP Preview management via new APIs
Adds OAuth support to MCP Preview management
Adds configs_security_settings in organization settings to control view/edit access by role
Adds workspace-level user_api_key_limits to restrict max keys per workspace
Adds configurable default_expiry and max_expiry for user API key expiry
+5 moreshow less
Adds new SCIM provisioning setting to enforce organization-only user management via SCIM while allowing workspace management via Portkey
Adds periodic budget_reset functionality in the update workspaces API
Adds strict name filter parameter to list workspaces API
Adds aws_service_auth as a new auth type for AWS Bedrock integrations
Adds setting to disable the Getting Started page
10 details in Everything
└──▷ BREAKING ON UPGRADE
!API Key Management API updates list api-keys response to no longer return raw keys for other user API keys
Frontend 1.4.6 adds per-key rate limits, user API key security settings, and new model support for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.
Added multiple rate limit support: now possible to set both cost-based and token-based rate limits on a single key
Introduced a security setting to restrict the maximum number of User API keys that can be created per user
Introduced a security setting to configure the default and maximum expiry of User API keys
Updated the MCP OAuthMCP OAuthAn authentication layer for the Model Context Protocol that lets MCP clients obtain delegated access tokens so cyber tools can call MCP servers on a user's behalf without handling raw credentials. consent screen to allow selection from eligible workspaces
Added better states for consent approval, rejection, and failures in MCP
+6 moreshow less
Hide embedding modelsembedding modelsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. in prompt playground
Allow updating base models for custom models
Made alias a required field for Azure-OpenAI deployment configurations
Added gpt-5-codex, gpt-5-pro, and several other OpenAI and Azure-OpenAI models
Added new Together AI and Grok models
Added AWS Bedrock Titan EmbeddingEmbeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. and Titan v1 models
11 details in Everything
└──▷ BREAKING ON UPGRADE
!alias is now a required field for Azure-OpenAI deployment configurations
Data Service 1.3.0 adds KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. key support for custom batch file output and batch operation tracking.
v1.3.0 supports KMS keys for encrypting custom batch file output
Adds batch operation tracking for provider batch requests sent from Gateway
Promptfoo tests, evaluates, and red-teams LLM applications to detect vulnerabilities and compare model outputs.
Promptfoo Oct 2025 adds jailbreak red-teaming, remediation reports, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. export, new providers, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support.
jailbreak :meta strategy uses multiple AI agents to generate attacks, offering up to 50% more effectiveness in single-shot mode.
Remediation reports with executive summary, prioritized action items, and guardrail recommendations accessible via View Remediation Report from any vulnerability report.
SARIF export for vulnerability reports and expanded CSV exports including Strategy ID, Plugin ID, and Session IDs.
New Eval Providers: OpenAI Agents SDK, Claude Agent SDK, Azure AI Foundry Agents, Ruby scripts, Snowflake Cortex, and Slack bots.
metric filtering with operators allows filtering eval results using eq, neq, gt, gte, lt, lte, and is_defined operators.
+6 moreshow less
New Model Support for Claude Haiku 4.5.
Provider Updates: Python provider gets persistent worker pools (10-100x performance improvement); WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. provider streams multiple responses; Ollama adds function callingfunction callingA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions. and tool support.
MCP server configuration enables Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server setup.
New Plugins: Wordplay, COPPA, and data protection preset for privacy testing.
Postman/cURL import auto-populates HTTP target connection details from curl commands or Postman files.
Scan template enhancements: display estimated probe count/runtime and preview generated test cases when selecting plugins.
Introduces the VirtualMCPServer CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. for managing MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server resources in Kubernetes.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.49 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.49
Design and implement the VirtualMCPServer CRD
1 detail in Everything
27 more releases in this issue
· 2025-10-03 → 2025-10-31
ToolHive Operator 0.3.5 adds tool conflict resolution and tools_override in vMCP workload endpoint
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.3.5 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.3.5
Implements tool conflict resolution for Virtual MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. (vMCP)
Returns tools_override in the workload GET endpoint
ToolHive v0.5.1 adds vmcp validation command and new port attributes for MCPServer CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.
└──▷ GET THIS VERSION
$ git clone --branch v0.5.1 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.5.1
└──▷ USE IT
Validate a Virtual MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. configuration before deployment
shell
toolhive vmcp validate <path-to-config.yaml>
Adds vmcp validate subcommand for validating Virtual MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server configurations
Introduces new port attributes to MCPServer Custom Resource DefinitionsCustom Resource DefinitionsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. (CRDs) for clarity
Implements capability discovery and querying interface for Virtual MCP Server
3 details in Everything
└──▷ BREAKING ON UPGRADE
!MCPServer CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. port attribute names are renamed; existing manifests using old names must update to the new names
Adds new port attributes to MCPServer CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. and renames existing ones for clarity.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.47 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.47
Rename MCPServer CRD Port Attributes for Clarity introduces renamed port fields in the MCPServer Custom Resource DefinitionCustom Resource DefinitionA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.
adds new port attributes to crds adds additional port configuration options to the MCPServer CRD
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The previous MCPServer CRD Port Attribute names are renamed; existing manifests using the old field names will fail validation.
ToolHive v0.5.0 adds /health endpoints, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. env vars, and GitHub OAuth provider
└──▷ GET THIS VERSION
$ git clone --branch v0.5.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.5.0
Adds GET /health endpoint to all proxy types for Kubernetes health probes
Adds environment variable support for the Oidc.clientSecret field in InlineOIDCConfig
Adds SecretKeyRef support within InlineOIDCConfig for enhanced secret management
Adds GitHub.com OAuth authentication provider for token introspection
Adds GitHub.com OAuth token introspection and new MCPServer CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. port values.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.45 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.45
Adds /health endpoint to proxies and env var support for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. client secret in toolhive-operator-crds v0.0.44
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.44 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.44
Adds /health endpoint to all proxy types for Kubernetes health probes
Add environment variable support for OIDC client secret
Add SecretKeyRef support to InlineOIDCConfig for enhanced secret management
ToolHive v0.4.2 adds insecure HTTP OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. support for local dev and updates operator docs
└──▷ GET THIS VERSION
$ git clone --branch v0.4.2 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.4.2
└──▷ TRY IT
Enable an insecure HTTP endpoint for local OIDC provider during development when standard HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. is not available.
$ toolhive start --oidc.insecure=true
insecure mode added to allow HTTP-based OIDC discovery for local development workflows
Adds --insecure-http-oidc flag for local development in Helm chart
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.42 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.42
ToolHive v0.4.1 adds --network CLI flag, OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. attributes, registry API, and /check-contribution command
└──▷ GET THIS VERSION
$ git clone --branch v0.4.1 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.4.1
└──▷ USE IT
Configure specific network isolation or host networking for a ToolHive instance.
shell
toolhive start --network host
Adds --network CLI option for flexible network configuration.
Adds support for custom OpenTelemetry resource attributes to enrich trace metadata.
Adds a registry data source API endpoint for integration and data access.
Adds /check-contribution command to the Claude integration.
ToolHive operator CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. v0.0.40 adds claude /check-contribution command and Registry API Data Source
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.40 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.40
Registry API Data Source feature introduced for fetching tool registry data.
Adds --network CLI flag to ToolHive operator and updates base image to v0.4.0
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.3.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.3.0
Adds --network CLI argument to the toolhive-operator command for network configuration
ToolHive v0.4.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Remote Proxy CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. support and k8s-export for workloads
└──▷ GET THIS VERSION
$ git clone --branch v0.4.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.4.0
└──▷ USE IT
Export ToolHive workload definitions to Kubernetes manifests for deployment.
shell
toolhive export --format kubernetes
Adds the MCPRemoteProxyCustom Resource DefinitionCustom Resource DefinitionA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. (CRD) controller for proxying remote MCP servers in Kubernetes.
Adds the --kubernetes format option to the export command (toolhive export --kubernetes) to generate manifests.
Adds a /proxy-logs endpoint to view logs for managed workloads.
Adds MCPGroup CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. support and _meta field parsing for ToolHive Operator
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.38 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.38
Adds MCPGroup custom resource definition to manage Kubernetes deployments of Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. groups
Adds _meta field parsing in the request parser to handle additional metadata in MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. messages
Adds MCPGroup support in Kubernetes and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. _meta field support to request parser.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.2.26 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.2.26
Adds MCPGroup support for deploying multiple MCP servers as a group within Kubernetes via the ToolHive Operator Helm chart
Adds _meta field support to the MCP request parser, allowing clients to pass metadata alongside standard requests
ToolHive adds Kubernetes export format to thv export and remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. proxying via CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. controller
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.2.25 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.2.25
└──▷ TRY IT
Export current ToolHive tool definitions into Kubernetes manifests for deployment in your cluster.
$ thv export --format kubernetes
Adds kubernetes as a supported format to the thv export command for exporting tool configurations
Introduces MCPRemoteProxy CRD controller enabling remote MCP server proxying capabilities
ToolHive Operator adds proxy-logs endpoint and client support for Trae IDE and Claude Code agents.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.2.24 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.2.24
Add proxy-logs workload endpoint
Add Claude Code skills for documentation and PR workflows
Add Claude Code agents for specialized development tasks
Adds MCPRemoteProxyCRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. definition and schema to ToolHive Operator
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.36 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.36
MCPRemoteProxyCustom Resource DefinitionCustom Resource DefinitionA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. (CRD) added via pull #2240
ToolHive v0.3.9 adds MCPExternalAuthConfig CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. RunConfig for the Operator
└──▷ GET THIS VERSION
$ git clone --branch v0.3.9 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.3.9
Adds MCPExternalAuthConfig CRD to define external authentication for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. resources
Enables OIDC RunConfig in the Kubernetes Operator mode
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Removes flag-driven configuration for oidc, authz, audit, toolsfilter, and OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. from the Operator
!Removes unused flag driven code for podTemplateSpec patch and permission profiles in the operator
Adds MCPGroup and MCPExternalAuthConfig CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.; enforces runconfig via ConfigMap
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.35 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.35
MCPGroup proposal added as a new Custom Resource DefinitionCustom Resource DefinitionA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. for the Kubernetes operator.
MCPExternalAuthConfigCRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. and its controller are introduced for handling external authentication.
Operator and ProxyRunner now force use of runconfig via ConfigMap, removing legacy flag-driven configuration.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Flag-driven configuration (oidc, authz, audit, toolsfilter, and OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. flags) is removed from the Operator; runconfig must now be provided via ConfigMap.
ToolHive Operator adds MCPGroup and MCPExternalAuthConfig CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it., standardizes on ConfigMap-driven RunConfig
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.2.23 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.2.23
Adds MCPGroupCRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. proposal for Kubernetes operator to group MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools
Adds MCPExternalAuthConfig CRD and controller to manage external authentication for MCP resources
Forces use of runconfig via ConfigMap for Operator and ProxyRunner, removing flag-driven config
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Removes oidc, authz, audit, toolsfilter and OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. flag driven config from Operator
!Removes unused flag driven code for podTemplateSpec patch and permission profiles in operator
!Removes old unused flag driven OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. functions in Operator
Adds RunConfig ConfigMap operator mode and bumps ProxyRunner images to 0.3.8
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.2.22 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.2.22
Enables RunConfig ConfigMap in operator mode for externalizing agent configuration.
Bumps toolHive ProxyRunner images to version 0.3.8.
ToolHive v0.3.8 adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms.token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. (RFC 8693RFC 8693An IETF standard defining the OAuth 2.0 Token Exchange flow, letting a service swap one token for another with different scopes, audience, or type — enabling delegation and impersonation without re-authenticating the user.), configurable secrets via env vars for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., and pluggable session storage backends.
└──▷ GET THIS VERSION
$ git clone --branch v0.3.8 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.3.8
Adds support for OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 Token Exchange (RFC 8693) with middleware to automatically swap downstream tickets for upstream credentials
Allows client secrets for token exchange to be configured via environment variables instead of static configuration files
Promotes the MCPRegistry feature to stable status and enables secrets management within the ToolHive MCP server
Introduces a new pluggable storage backend system for session management
ToolHive Operator CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. release promotes MCPRegistry feature to stable
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.34 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.34
Promote MCPRegistry feature stabilizes the MCPRegistry Custom Resource DefinitionCustom Resource DefinitionA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. (CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.) for production use in Kubernetes.
ToolHive operator v0.2.21 promotes the MCPRegistry feature and updates dependency modules.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.2.21 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.2.21
Promotes MCPRegistry feature to stable, enabling its use without a feature flag
Updates registry source from toolhive-registry release v2025.10.08 through v2025.10.10
Adds secrets management support to ToolHive MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server and implements OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. Token Exchange (RFC 8693RFC 8693An IETF standard defining the OAuth 2.0 Token Exchange flow, letting a service swap one token for another with different scopes, audience, or type — enabling delegation and impersonation without re-authenticating the user.)
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.33 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.33
ToolHive Operator CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. 0.0.32 updates registry source and e2e testing infrastructure
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.32 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.32
Updates the embedded registry source to toolhive-registry release v2025.10.03
Obsidian Desktop v1.10.0 adds Bases grouping, table summaries, List view, Maps plugin, and initial Bases API.
Adds Group by command to the Sort menu for data grouping by property
Adds right-click table column context option "Summarize..." with built-in functions or custom formulas
Introduces new List view displaying files as bulleted/numbered lists supporting multi-line content
Initial release of Bases API
New official Maps plugin for visualizing base entries on a map
+4 moreshow less
Adds reduce() function for lists in Bases formulas
Adds html() function for rendering custom HTML in Bases formulas
Adds random() function for randomizing sort orders in Bases formulas
Adds timezone offset support in ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 8601 datetime parsing
9 details in Everything
└──▷ BREAKING ON UPGRADE
!The Use light mode and Use dark mode commands have been removed.
!The Change view command has been renamed to Switch view…
OpenSSL 3.6.0 adds LMS signature verification, FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 186-5 deterministic ECDSAECDSAThe elliptic-curve signature algorithm behind most TLS certificates, blockchains and many hardware keys. It is one of the algorithms post-quantum signatures are meant to replace., opaque symmetric key objects, and a new configutl utility.
└──▷ GET THIS VERSION
$ git clone --branch openssl-3.6.0 https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout openssl-3.6.0
└──▷ TRY IT
Inspect the fully resolved OpenSSL configuration (useful when debugging FIPS provider or engine config issues in a deployment).
$ openssl configutl
Adds LMS (Leighton-Micali Signature) signature verification per SP 800-208 in both the FIPS and default providers.
Adds FIPS 186-5 deterministic ECDSA signature generation to the FIPS provider.
Introduces EVP_SKEY opaque symmetric key objects with new EVP_KDF_CTX_set_SKEY(), EVP_KDF_derive_SKEY(), and EVP_PKEY_derive_SKEY() functions for key derivation and key exchange provider methods.
Adds NIST security categories for PKEY objects.
New openssl configutl utility for parsing and dumping the resolved OpenSSL configuration file.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!An ANSI-C (C89) toolchain is no longer sufficient to build OpenSSL; a C99-capable compiler is now required.
The code-oss project is an open-source code editor combining editing, debugging, and extensibility for developers across Windows, macOS, and Linux.
VS Code 1.105 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. marketplace, AI merge conflict resolution, OS notifications, and macOS native auth.
└──▷ GET THIS VERSION
$ git clone --branch 1.105.0 https://github.com/microsoft/vscode.git
# already have the repo? check out this version:$ git checkout 1.105.0
New MCP marketplace preview lets users browse and install MCP servers directly from within the editor.
Adds AI-assisted merge conflict resolution to help automatically resolve conflicts in the editor.
Adds OS-level notifications for task completion and chat responses so you can context-switch freely.
Supports macOS native broker (system authentication dialog) for Microsoft account sign-in.
New recent chats panel lets users resume previous chat sessions from where they left off (experimental).
+1 moreshow less
Supports fully-qualified tool names to avoid conflicts when multiple MCP servers expose identically named tools.
Cloudflare Workers WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. message size limit increased from 1 MiB to 32 MiB
New cf.edge.client_tcp and cf.timings.client_tcp_rtt_msec fields in Cloudflare Rulesets
Adds cf.edge.client_tcp boolean field to detect if a request used TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. instead of QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking.
Adds cf.timings.client_tcp_rtt_msec numeric field providing smoothed client-to-Cloudflare TCP round-trip time
Cloudflare CASBCASBA Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. adds granular IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles to separate read-only visibility from full administration.
AI Search adds rerankingrerankingA model that re-scores a first batch of search results against the query and reorders them, more accurately than the fast first-stage search. config and API-driven system_prompt support for dynamic control.
Adds the reranking field to AI Search API requests, allowing configuration of a rerankerrerankerA model that re-scores a first batch of search results against the query and reorders them, more accurately than the fast first-stage search. model (e.g. @cf/baai/bge-reranker-base) to reorder retrieved documents by semantic relevance
Enables passing system_prompt directly in AI Search API requests for per-query dynamic control over assistant behavior
Cloudflare Access now supports securing private applications on all ports and protocols, removing the previous HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate./port-443/SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. requirement.
Removes the previous requirement that private hostname applications use HTTPS on port 443 with Server Name Indicator (SNI), enabling support for SSH, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely., internal databases, and other non-HTTPS services.
Cloudflare Radar adds TLDTLDThe rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type. insights via new /tlds API endpoints and DNS query dimensions
Adds /tlds endpoint to list all Top-Level Domains (TLDs) in Radar
Adds /tlds/{tld} endpoint to retrieve detailed TLD information including type, manager, DNSSECDNSSECA set of DNS extensions, maintained by the IETF, that add cryptographic signatures to DNS records so resolvers can verify responses have not been tampered with in transit./RDAPRDAPA JSON-based protocol for querying domain and IP registration data, standardized by the IETF as a modern replacement for WHOIS, giving cyber tools structured, machine-readable ownership and contact lookups. support, and WHOIS data
Adds tld filter and tld_dns_magnitude dimension to existing /dns/summary/{dimension} and /dns/timeseries_groups/{dimension} endpoints
Release introduces TanStack Start integration into the Cloudflare Vite plugin and CLI, enabling new project scaffolding and SSR configuration for Workers.
└──▷ USE IT
Scaffold a new TanStack Start app ready for Cloudflare Workers deployment via the CLI.
Workers Preview URLs now default to matching workers.dev setting in Wrangler v4.44.0+
Preview URLs default to enabled when workers.dev is enabled, and disabled when workers.dev is disabled (Wrangler >= v4.44.0).
Explicit configuration of preview URL settings remains supported via the Dashboard, API, or Wrangler to override the new default.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Wrangler v4.44.0+ changes the default behavior of Preview URLs from always enabled (v4.34.0-<v4.44.0: disabled) to matching the workers.dev route state.
!Existing Workers with workers.dev route disabled had a one-time update to disable preview URLs.
Cloudflare WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. adds new managed rule detections for SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly., SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., SSTISSTIServer-Side Template Injection, a vulnerability class where attacker-controlled input is evaluated by a server-side template engine, enabling remote code execution or data exfiltration., and Reverse Shell in October 2025 release.
Adds SSTI - Arithmetic Probe detections across URI, header, and body fields for Server-Side Template Injection
Cloudflare CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. now supports up to 128 KB request and response headers, reducing 413/520 errors
Increases the maximum supported size for both Cloudflare CDN request and response headers from 32 KB to 128 KB
WARP macOS adds PMTUD support and unstable network status in GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands.
Adds Path Maximum Transmission Unit Discovery (PMTUD) to dynamically adjust packet sizing for optimized connection performance
Adds a new GUI connection status message to indicate when the local network connection may be unstable
Cloudflare Load Balancing introduces Monitor Groups to combine multiple health monitors for sophisticated availability checks and smarter failover.
Adds Monitor Groups via the API to combine multiple health monitors (e.g., HTTP, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it.) into a single logical group for advanced health checking.
Adds monitoring only flag to isolate monitors from affecting pool health status while still receiving alerts and data.
Windows WARP client adds PMTUD for dynamic MTU optimization and GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. connection health status.
Adds Path Maximum Transmission Unit Discovery (PMTUD) to dynamically adjust packet sizing and optimize connection performance.
Adds a new GUI connection status message to inform users when the local network connection may be unstable.
SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. configuration moved from API-only to Cloudflare dashboard UI
Adds new dashboard path Manage account > Members > Settings to manage SSO configuration without API access
New CT log stats (growth rate, counts, last update) added to Radar API and UI
Get Certificate Log Details API now returns log_growth_rate, included_certificate_count, eligible_for_inclusion_certificate_count, and last_update fields for Certificate TransparencyCertificate TransparencyA public, append-only log system maintained by various operators (Google runs several) that records every TLS certificate issued, letting anyone audit CAs for misissued or rogue certificates. logs.
Radar's CT log information page now displays log growth rate (certs/hour over 7 days), included certificate count, eligible-for-inclusion certificate count, and last update timestamp.
Cloudflare Workers dashboard gains a new Overview Page with unified request, error, and binding management.
Adds a new Overview page in the Cloudflare dashboard for each Worker, serving as the default landing view with high-level metrics for requests, errors, and CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. time.
macOS WARP client GA release introduces MASQUE-only Proxy mode and L4 tunnel support.
WARP client for macOS is now Generally Available on the stable releases downloads page
Proxy mode has been enhanced with custom congestion control optimizations over an L4 tunnel
Proxy mode now supports SOCKS4, SOCK5, and HTTP CONNECTHTTP CONNECTAn HTTP method that asks a proxy server to open a raw TCP tunnel to a target host, letting clients relay arbitrary traffic — including TLS — through the proxy without the proxy inspecting it. protocols
MASQUE protocol is now the only protocol that can use Proxy mode
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Wireguard devices configured to use Proxy mode will lose connectivity unless a new WARP mode or the MASQUE protocol is selected.
Linux WARP client 2025.8.779.0 GA introduces MASQUE-only Proxy mode with doubled throughput
Proxy mode utilizes an L4 tunnel with custom congestion control optimizations, doubling throughput over L3 tunnels
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!Devices using Proxy mode configured with WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. will lose connectivity; the profile must be updated to select a new WARP mode or switch to the MASQUE protocol
Windows WARP client goes GA with MASQUE-only Proxy mode and doubled throughput.
Proxy mode now uses the MASQUE protocol exclusively over an L4 tunnel, replacing the previous L3 WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. configuration
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!If a device profile configured Proxy mode with WireGuard and you do not switch to a new WARP mode or the MASQUE protocol, devices matching that profile will lose connectivity.
New emergency WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. rule for Oracle E-Business Suite RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. (CVE-2025-61882) and four Chaos Mesh command injectioncommand injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. detections.
Adds Rule ID 100882 to detect missing authentication on Chaos Mesh controller endpoints.
Adds Rule ID 100883 to block command injection via Chaos Mesh mutations.
Adds Rule ID 100884 and 100888 to block additional Chaos Mesh command injection vectors (CVE-2025-59361, CVE-2025-59360).
Adds Rule ID 100886 to block HTTP parameter pollution via form-data multipart boundaries.
Adds Rule ID 100917 for generic SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. inline comment injection detection.
+1 moreshow less
Adds Rule ID 100918 for generic SQLi information disclosure detection.
Cloudflare Radar adds browser detection for Post-quantumPost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. (PQ) encryption support
The Post-quantum encryption card now checks whether a user’s browser supports post-quantum encryption and displays the key agreement in use if supported.
R2 Data Catalog adds wrangler r2 bucket catalog compaction enable subcommand for per-table Apache IcebergApache IcebergAn open table format for large analytic datasets, maintained by the Apache Software Foundation, that gives cyber tools reliable schema evolution, time-travel queries, and atomic commits on object storage or HDFS. table-level compaction.
Cloudflare Access adds fine-grained RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. in public beta, allowing permissions scoped to individual Apps, IdPs, and Targets.
Adds the ability to grant admin permissions to specific Access Applications.
Adds the ability to grant admin permissions to individual Identity Providers.
Adds the ability to grant admin rights to specific Targets.
Arcade 2025-10-31 adds seven new starter toolkits and the arcade deploy CLI command.
arcade deploy subcommand available for platform deployment
New HubSpot Marketing & CRM starter toolkit
New Exa.ai Starter MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. integration
New Asana starter toolkit
New Github starter toolkit
+3 moreshow less
New Pylon Starter Toolkit
New Posthog Starter Toolkit
New Clickup Starter Toolkit
8 details in Everything
4 more releases in this issue
· 2025-10-03 → 2025-10-31
Arcade adds five new Starter Toolkits and OAuth/config controls for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Servers in the Dashboard.
Dashboard now accepts redirect_uri configuration for MCP Servers
Dashboard exposes OAuth fields configuration for MCP Servers
Arcade 2025-10-17 adds Projects, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Gateways GA, arcade-mcp GA, BrightData/Figma/AirTable/Miro/PagerDuty/Cursor agents toolkits, and OAuth support for MCP Servers.
Adds Projects as a first-class resource to organize MCP Servers, tools, and secrets
MCP Gateways are now generally available for federating multiple MCP Servers
arcade-mcp toolkit is now generally available, superseding Arcade TDK
Adds BrightData Starter MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. integration
Adds Figma Starter MCP Server integration
+7 moreshow less
Adds Freshservice Starter MCP Server integration
Adds Cursor Agents Starter MCP Server integration
Adds AirTable starter MCP Server integration
Adds Miro Starter MCP Server integration
Adds PagerDuty Starter MCP Server integration
Enables arcade deploy for MCP Servers built with arcade-mcp
Dashboard now allows configuring OAuth on MCP Servers
Arcade adds Trello, Calendly, SquareUp, Xero toolkits; reference area for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. docs
Trello toolkit now available in Arcade
Calendly starter toolkit added
SquareUp toolkit added
Xero API Starter MCP server included
Reference area added to arcade-mcp documentation (PR #488)
Arcade adds Box.com and Stripe Starter MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Servers
Adds Box.com Starter MCP Server for cloud storage automation.
Adds Stripe Starter MCP Server for payment processing integration.
THE CYBER TOOLCHAIN