PAGES
Subscribe Get it delivered — five to ten releases we picked each morning from the tools you run, with every release in the issue on the web. Compare plans →

The Cyber Toolchain — issue 120, October 25, 2026

THE CYBER TOOLCHAIN NO. 120
Tail
THE DAILY RELEASE FIREHOSE
PUBLISHED OCTOBER 25, 2026 · EVERY DAY
EDITIONS tail grep head ls diff uniq

The daily firehose — everything the toolchain shipped today, already filtered.

We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.

VIEW
ISSUE VIEW scroll
INFORMATION DENSITY everything
ISSUE WIDTH reading width
Do you prefer scroll?
ADDITIONAL FILTERS 
$ tct list   # 31 tools matched

What stands out across today's releases, grouped by what it lets you do. Every tool named links to its entry below.

  • protect

    Find outdated PHP from the outside, without a credentialed scan

    ZAP's new passive rule reads server response headers and maps the disclosed PHP version to PHP2Shell and over 60 known CVEs, refreshed by a weekly feed, with built-in suppression so banner noise doesn't bury the real finding. Vigolium adds HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer.-aware fuzzing and fingerprint/hosts/dns recon subcommands, so the same pass covers QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking.-fronted hosts that HTTP/1.1-only tooling walks past.

    OWASP ZAP · vigolium

  • identify

    See which editor extensions your developers actually run

    Open VSX is where VS Code forks and AI coding clients pull extensions from, and almost nobody has an inventory of it. Manifold risk-rates roughly 17,000 of them nightly and correlates that against AI agents on the same endpoint; Token Security pairs its Grok Build editor integration with EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. data to surface agent credentials and shadow agents living outside the sanctioned workspace.

    Manifold Security · Token Security

  • respond

    Pull evidence from encrypted and volume-managed disk images

    Raw images from Linux and Android devices increasingly sit behind LVM2LVM2The Linux Logical Volume Manager, maintained by the kernel community, that pools physical disks into flexible logical volumes so tools can resize, snapshot, or migrate storage without repartitioning., LUKSLUKSA disk-encryption standard built into the Linux kernel that stores encryption metadata in a header on the volume itself, letting cyber tools unlock encrypted drives portably across distributions and implementations. or RAIDRAIDA storage architecture that combines multiple physical disks into one logical volume using mirroring, striping, or parity to trade capacity for redundancy, speed, or both. layers that examiners had to unwrap manually before parsing could start. iLEAPP now reads those volumes directly, adds SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hashing of staged files via --hash for chain-of-custody, and ships over 30 new app and system artifacts.

    iLEAPP

  • govern

    Give AI agents real identities instead of shared service credentials

    Agents today mostly inherit a human's token or a long-lived API key, which makes attribution and revocation impossible. Auth0's CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows. support lets each agent pre-register or dynamically register as its own client with Application Profiles governing authorization centrally; JumpCloud's End User MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. moves routine identity chores into AI clients with admin and employee session controls over what the agent may do.

    Auth0

Offensive Security
◆  AI-Powered Offensive Security

PurpleAILAB Decepticon

Sources Release notes → v1.6.0 Notes Rank Why this rank top features scored 80/60/40, +6 runnable example — 66 How ranking works →

Decepticon v1.6.0 introduces a versioned update channel, persists per-thread AI and compaction settings, and improves checkpoint diagnostics, SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. recovery, and several smaller CLI, web, and container-level surfaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Autonomous Hacking Agent for Red Team

Decepticon v1.6.0 introduces a versioned update channel, persists per-thread AI and compaction settings, and improves checkpoint diagnostics, SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. recovery, and several smaller CLI, web, and container-level surfaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 7 FEATURES 0 OF 7 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Versioned update channel via `decepticon update` improved 80

decepticon update --channel latest installs or updates to the latest version, pulling the matching launcher, configuration, and all versioned images in one step.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Upgrade an existing Decepticon installation to v1.6.0, fetching the new launcher, configuration, and all eight versioned images at once.
$ decepticon update --channel latest
— Exact runnable command given, but no detail on image count or compatibility checks v1.6.0
02 00
Persistent per-thread AI controls and compaction threshold improved 60

Model, fallback, reasoning effort, and compaction controls now persist per thread across sessions, including a verified 4096-token compaction threshold.

— Names the token threshold but gives no config key or command to set it v1.6.0
thinner coverage below
03 00
Checkpoint diagnostics and SSE recovery improvements improved 40

Improves scoped checkpoint diagnostics, SSE recovery, and transcript navigation across the CLI, web, and server surfaces.

— Names affected surfaces but no mechanism or before/after detail v1.6.0
04 00
Aligned web and server workspace roots improved 40

Aligns web and server workspace roots, preventing stale terminal socket handoffs.

— Explains the bug fixed but not how or where to verify it v1.6.0
05 00
Persisted Plan and Red drafts across container recreation improved 40

Preserves private Plan and Red drafts and history across container recreation.

— States what persists but no mechanism or storage location v1.6.0
06 00
Kali downloads via official CDN improved 35

Switches Kali downloads to the official Kali CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server..

— States the source change with no further technical detail v1.6.0
07 00
Localized slash commands in CLI improved 25

Improves localized slash-command support inside the interactive CLI.

— Very thin description, no commands or languages named v1.6.0
Was this useful?

xalgorix

Sources Release notes → v4.6.163 Notes Rank Why this rank top features scored 85/85/73, +6 runnable example — 87 How ranking works →

xalgorix added opt-in native tool callingtool callingA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions. for llama.cpp, Ollama and vLLM backends, introduced stuck-scan recovery and lean prompt-schema flags, and expanded finding deduplication with new vulnerability classes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.

xalgorix added opt-in native tool callingtool callingA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions. for llama.cpp, Ollama and vLLM backends, introduced stuck-scan recovery and lean prompt-schema flags, and expanded finding deduplication with new vulnerability classes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 4 FEATURES 1 OF 4 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
Native tool calling for local LLM backends new 85

Adds the XALGORIX_NATIVE_TOOL_CALLS environment variable (default off) to enable structured function-callingfunction-callingA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions. instead of fragile XML tag parsing, supporting llama.cpp, Ollama, and vLLM backends so models not trained on XML can drive tools reliably during autonomous scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Enable native tool calling when using an Ollama backend to allow models not trained on XML to drive tools reliably during autonomous scans.
$ XALGORIX_NATIVE_TOOL_CALLS=true xalgorix --web
— Names exact env var, default state, and three supported backends. v4.6.163
02 00
Stuck-scan recovery for autonomous runs new 85

Adds XALGORIX_ADVANCE_PAST_STUCK (default off) to skip un-completable tasks and continue the rest of the scan plan, bounded by XALGORIX_MAX_STUCK_ADVANCES (default 3) consecutive no-progress advances before giving up, preventing an unresponsive endpoint from aborting an entire CI run.

Keep a long autonomous scan alive when one task stalls — useful in CI where an unresponsive endpoint would otherwise abort the entire run.
$ XALGORIX_ADVANCE_PAST_STUCK=true XALGORIX_MAX_STUCK_ADVANCES=5 xalgorix --web
— Two named env vars with defaults and a runnable example. v4.6.160
03 00
Lean tool schema for smaller prompts new 73

Adds XALGORIX_LEAN_TOOL_SCHEMA environment variable (default off) to strip illustrative example spans from tool and parameter descriptions, shrinking the per-request prompt while preserving every tool, parameter and core instruction — useful for models with tighter context windowscontext windowsThe maximum amount of text, counted in tokens, a model can take in and produce in one request. Everything the model knows about the task has to fit inside it..

Reduce per-request prompt size when using a model with a tighter context windowcontext windowThe maximum amount of text, counted in tokens, a model can take in and produce in one request. Everything the model knows about the task has to fit inside it., without losing any tool or parameter coverage.
$ XALGORIX_LEAN_TOOL_SCHEMA=true xalgorix --web
— Named env var and purpose, but no size/token numbers given. v4.6.160
04 00
Finding deduplication classes for recurring issues improved 68

Adds a debug_disclosure finding class (stack-trace, debug-page and verbose-exception keywords; CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-209) and a user_enumeration finding class (CWE-203/204) so these report once per target instead of re-reporting per path. Also collapses server-wide issue classes — debug/stack-trace disclosure, missing security headers, CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. policy, version/technology disclosure, and clickjacking — to a single finding per target instead of one per path.

— Names all classes and CWEs but offers no flag or command to act on. v4.6.160
Was this useful?
◆  Hacking Hardware

RFID Research Group ChameleonUltra

Sources Release notes → v2.3.0 Notes Rank Why this rank top features scored 70/60/45 — 58.33 How ranking works →

ChameleonUltra v2.3.0 adds support for new card types including SEOS, MIFARE Ultralight CMIFARE Ultralight CA low-cost NXP contactless smart card IC using ISO 14443-A at 13.56 MHz, adding 3DES authentication over the original Ultralight; tools use it to read, clone, or audit access-control tokens built on this chip. and Farpointe PyramidFarpointe PyramidA proprietary RFID access-control card and reader platform made by Farpointe Data, offering multi-technology credential support so cyber tools can test or integrate with physical access systems., introduces parity checking during ISO 14443-4ISO 14443-4The ISO standard defining the transmission protocol layer for contactless smart cards operating at 13.56 MHz, covering framing, error handling, and half-duplex block exchange that tools use to communicate with NFC-based cards. sniffing, and improves LF FSKLF FSKA radio modulation scheme where a binary signal is encoded by switching between two frequencies in the low-frequency band, giving cyber tools reliable long-range signal transmission through walls and soil with minimal hardware. demodulation robustness and performance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

The new generation Chameleon, built on the NRF52840, that emulates, reads, writes and decrypts RFID/NFC cards.

ChameleonUltra v2.3.0 adds support for new card types including SEOS, MIFARE Ultralight CMIFARE Ultralight CA low-cost NXP contactless smart card IC using ISO 14443-A at 13.56 MHz, adding 3DES authentication over the original Ultralight; tools use it to read, clone, or audit access-control tokens built on this chip. and Farpointe PyramidFarpointe PyramidA proprietary RFID access-control card and reader platform made by Farpointe Data, offering multi-technology credential support so cyber tools can test or integrate with physical access systems., introduces parity checking during ISO 14443-4ISO 14443-4The ISO standard defining the transmission protocol layer for contactless smart cards operating at 13.56 MHz, covering framing, error handling, and half-duplex block exchange that tools use to communicate with NFC-based cards. sniffing, and improves LF FSKLF FSKA radio modulation scheme where a binary signal is encoded by switching between two frequencies in the low-frequency band, giving cyber tools reliable long-range signal transmission through walls and soil with minimal hardware. demodulation robustness and performance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 6 FEATURES 0 OF 6 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Parity checks in ISO 14443-4 sniffing new 70

Adds hf 14a sniff parity checks to flag malformed frames during ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 14443-4 sniffing sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Names exact command and what it checks for v2.3.0
02 00
FSK demodulation robustness and performance improved 60

Adds DC-block FSKFSKFrequency-shift keying, a modulation scheme where digital data is encoded by switching a carrier signal between discrete frequencies; cyber tools use it to decode or generate signals from radio, modem, or covert-channel communications. demodulation for improved weak-coupling robustness with HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral. and ioProx LF credentials, and removes double-precision sqrt from the FSK demodulation hot path to reduce LF processing overhead.

— Explains mechanism and named protocols but no user-facing action v2.3.0
thinner coverage below
03 00
New card type support: SEOS, Ultralight C, Pyramid new 45

Adds SEOS card emulation support, authentication and emulation for MIFARE Ultralight C, and support for Farpointe Pyramid credentials.

— Names three card types but no mechanism or usage detail given v2.3.0
04 00
Low-level ISO 14443-4 API export new 45

Exports low-level ISO 14443-4 handling for use in client integrations.

— Names the protocol surface but no integration specifics v2.3.0
05 00
Configurable long button press threshold new 30

Adds long button press threshold as a configurable user setting.

— Bare description, no config key or value range given v2.3.0
06 00
Improved battery calibration and health reporting improved 20

Improves battery calibration and health reporting.

— Generic improvement with no detail on mechanism or metrics v2.3.0
Was this useful?
Application Security
◆  SAST / SCA / Code Security

ZeroPath

Sources Changelog → changelog · Oct 25, 2026 Changelog Rank Why this rank top features scored 85/78/75, +15 breaking change, +6 runnable example — 100.33 How ranking works →

ZeroPath is an AI-native SAST platform that finds 2x more real vulnerabilities with 75% fewer false positives.

ZeroPath's sole release this window deepens its Security Compass/SD Elements integration, adding configurable verification-outcome-to-task-status mapping, new push APIs, an on-demand scan re-push action, and automatic verification notes on every push.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 4 FEATURES 0 OF 4 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
On-demand scan re-push and push result stats new 85

Adds a Push latest scan action to re-push a repository's latest finished full scan to SD Elements on demand, for example to apply updated task status mapping rules immediately.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Adds a lastPushStats object with fields countermeasuresMarkedDone, statusChangesRequested, passCount, partialCount, failCount, and notApplicableSkipped to track Security Compass push results.

Re-push a repo's latest full scan to SD Elements after updating the task status mapping, to immediately reflect the new Pass/Partial/Fail→status rules.
$ pushLatestScan
— Names the action, its purpose, and all six tracked stat fields. changelog-20261025-3822bab9
02 00
Security Compass API and MCP methods new 78

Adds securityCompass.listTaskStatuses, updateProjectMapping, and pushLatestScan API and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. methods for the Security Compass integration. securityCompass.listTaskStatuses is restricted to users with the admin role, matching the permissions required for the mapping mutation.

List available SD Elements task statuses (admin only) before configuring a new project mapping.
$ securityCompass.listTaskStatuses
— Names three callable methods and their permission scope. changelog-20261025-3822bab9
03 00
Configurable SD Elements task status mapping breaking 75

Adds per-integration and per-project Task status mapping configuration that controls which SD Elements task status each ZeroPath verification outcome (Pass, Partial, Fail) sets. Integrations created before this change default to Pass→Complete, Partial→Incomplete, Fail→Incomplete, while newly created integrations start with verification notes only and no task status changes by default.

— Explains before/after default behavior but no exact config path. changelog-20261025-3822bab9
thinner coverage below
04 00
Verification notes on SD Elements push new 53

Writes one verification note per countermeasure (Pass, Partial, or Fail) with the finding list and links back to ZeroPath on every full scan push to SD Elements.

— Describes automatic behavior with no user-facing command. changelog-20261025-3822bab9
└──▷ BREAKING ON UPGRADE
  • !
    Integrations created before this change were given a default task status mapping of Pass→Complete, Partial→Incomplete, Fail→Incomplete; new integrations start with verification notes only and no task status changes by default.
Was this useful?

Mend.io Mend Platform

Sources Changelog → changelog · Oct 25, 2026 Changelog Rank Why this rank top features scored 85/75/45, +6 runnable example — 74.33 How ranking works →

Mend Platform's 26.9.3 release adds aggregated SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. exports spanning multiple projects and promotes Custom Roles to general availability, alongside a new setting to exclude proprietary components from license workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Mend platform is a traditional application security misses AI risk. Standalone AI security tools miss your code.

Mend Platform's 26.9.3 release adds aggregated SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. exports spanning multiple projects and promotes Custom Roles to general availability, alongside a new setting to exclude proprietary components from license workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 3 FEATURES 0 OF 3 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Aggregated SBOM export for applications and multi-project scopes new 85

Adds aggregated SBOM export for application and multi-project scopes, consolidating multiple project-level files into one deduplicated document; supports CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. and SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. standards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Projects in a multi-project scope must belong to the same application, and per-project generation remains the default.

Generate a single deduplicated SBOM for an entire application scope to simplify ingestion into downstream tooling.
📍In the Mend Platform UI, navigate to your Application, select Export SBOM, choose Aggregated scope, select CycloneDX or SPDX as the standard, and confirm the export.
— Names exact formats, scope rules and UI steps to use it changelog-20261025-8a74e6eb
02 00
Exclude proprietary libraries from license workflows new 75

Adds a new organizational setting, Include Proprietary Libraries in Workflows, to exclude proprietary (in-house) components from automation workflows that check for Empty License conditions.

Prevent proprietary in-house components from triggering false-positive Empty License workflow violations across the organization.
📍In the Mend Platform UI, navigate to Organization Settings, find the Include Proprietary Libraries in Workflows setting, and toggle it off to exclude proprietary components from license-condition automation.
— Names exact setting and UI path to toggle it changelog-20261025-8a74e6eb
thinner coverage below
03 00
Custom Roles reaches general availability improved 45

Promotes Custom Roles from closed beta to general availability, with an enhanced role breakdown and a Create Role wizard for custom role management.

— States GA status and new wizard but no config detail changelog-20261025-8a74e6eb
Was this useful?

SonarSource SonarQube

Sources Blog post → announced · Oct 22, 2026 Blog

Sonarqube is a enforce consistent quality gates across every pull request and pipeline, from IDE to CI/CD, with automated code review for bugs and security issues.

SonarQube Cloud gains a native sonar-container-scanner CLI (open beta) with --fail-on threshold gating and a new Container images org sidebar view.

  • New vulnerability checkNew supported platformIntroduces sonar-container-scanner <IMAGE> --organization <ORGANIZATION_KEY> --token <TOKEN> CLI to scan container images for known OS-layer vulnerabilities and malicious packages, generating an SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. sent to SonarQube Cloud for analysis.
  • Adds --fail-on flag to sonar-container-scanner to set a minimum severity threshold (default: high) at which the scanner exits with a failing code, enabling CI pipeline gates on container image risk.
  • Adds a Container images section in the SonarQube Cloud organization sidebar, listing every analyzed image with its tag, risk count, most severe risk, and last-analyzed timestamp alongside code and dependency risks.
  • Supports automatic re-checking of previously analyzed images against newly published vulnerabilities without requiring a re-scan, based on organization re-analysis settings.
  • Available at no additional cost for SonarQube Cloud organizations on Team and Enterprise plans with SonarQube Advanced Security.

5 details in Everything

Was this useful?
◆  Software Supply Chain Security

sbomify

Sources Release notes → v26.10.0 Notes Rank Why this rank top features scored 95/90/85, +15 breaking change, +6 runnable example — 111 How ranking works →

sbomify is a product security artifact hub and a trust center.

sbomify v26.10.0 ships a new Vulnerabilities page with an AI-agent VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. approval workflow, an Operator role, a Vanta compliance integration, and live WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. updates, alongside a large set of breaking API, permission, and self-hosted deployment changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 16 FEATURES 8 OF 16 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
API permission and scope tightening breaking 95

Several endpoints now enforce stricter permissions and validation: POST /api/v1/licensing/custom-licenses is removed; creating an access request now requires authentication and takes no request body, with all access-request routes enforcing token scopes; GET /workspaces/ now shows members, invitations, and billing data only to admins; the branding PATCH endpoint now only accepts null for icon and logo fields; PATCH /advisories/{id} now rejects unknown fields with 422; and /releases/{id}/artifacts?mode=available now requires the release:manage scope.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Every affected endpoint and its new behavior is named v26.10.0
02 00
Self-hosted deployment tuning env vars new 90

Adds REDIS_CACHE_MAX_CONNECTIONS and REDIS_CACHE_POOL_TIMEOUT to tune Redis connection pooling, LOG_MAX_SIZE and LOG_MAX_FILE for log rotation control, and KEYCLOAK_PUBLIC_URL for self-hosted Keycloak configuration.

Tune Redis connection pool limits to support higher concurrency in a self-hosted instance.
env 
REDIS_CACHE_MAX_CONNECTIONS=50
REDIS_CACHE_POOL_TIMEOUT=10
— All env vars named with a concrete config example v26.10.0
03 00
History limit on assessments API breaking 85

Adds history_limit query parameter and all_runs_total field to GET /plugins/assessments/{sbom_id}, while capping all_runs at 50 runs in the default response.

— Exact endpoint, params and cap value are specified v26.10.0
04 02
Findings table migration with backfill command breaking 85

The findings migration drops the vulnerability_scanning_findings table, which causes old pods in a rolling deploy to fail; run manage.py backfill_findings --missing-only to rebuild findings.

— Gives the exact table and a runnable remediation command v26.10.0
05 00
Vanta integration for compliance sync new 80

Adds a Vanta integration, enabled via new VANTA_* environment variables, to sync frameworks and controls from Vanta with optional Trust Center publishing.

Enable Vanta integration in a self-hosted deployment to sync compliance frameworks and controls.
env 
VANTA_*=<your-vanta-credentials>
— Exact env vars and a runnable config example are given v26.10.0
06 03
Self-hosted deployment breaking changes breaking 80

Environment variables TEAMS_*_ROLES are renamed to WORKSPACE_*_ROLES (old names still work as aliases for now); KEYCLOAK_WEBHOOK_SECRET is removed; custom DRAMATIQ_BROKER overrides must be updated; custom domains now require outbound HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. from workers; rotating SECRET_KEY requires domains to be re-verified; and the new ws/user/ WebSocket route must be forwarded in reverse proxy configuration.

— Names every affected env var and infra requirement v26.10.0
07 04
VEX approval queue for AI agents new 65

Adds a VEX approval queue where AI agents submit VEX rulings using a new AI-agent token, which a human then approves or rejects on the Review tab.

— Mechanism and UI location (Review tab) are given v26.10.0
thinner coverage below
08 05
Irreversible access token hashing migration breaking 55

Migration access_tokens.0012 changes token hashing and cannot be rolled back — old releases cannot authenticate API tokens after it runs.

— Migration named but no remediation command given v26.10.0
09 06
Pending Owner invitations now grant Admin breaking 55

Pending Owner invitations now grant Admin instead of Owner; affected invitations must be re-sent.

— States the behavior change and the remediation action v26.10.0
10 00
Vulnerabilities page with findings dashboard new 50

Adds a Vulnerabilities page showing a deduplicated list of open findings, with release and SBOM-version filters and Fix/Triage prompts for coding agents.

— Names the page and its filters but no exact UI path or API v26.10.0
11 00
Operator role new 50

Adds an Operator role that grants read access to the entire workspace and the ability to triage findings, without permission to change anything else.

— Scope of the role is clear but no assignment steps given v26.10.0
12 07
Live UI updates over WebSocket new 50

Adds live UI updates over WebSocket via the new ws/user/ route; self-hosted deployments must forward this route in their reverse proxy configuration.

— Route named but no further mechanism or usage detail v26.10.0
13 08
Stripe sync demotes ended paid plans breaking 50

The first Stripe sync moves ended paid plans to the Community plan, making their private products and components public.

— Explains effect but no mitigation steps given v26.10.0
14 00
Advisory management improvements improved 45

Advisories gain per-product status editing after an advisory is created, bulk delete for advisories, custom ID prefix support for advisories, and Markdown support for advisories.

— Lists four additions without endpoints or UI paths v26.10.0
15 00
Invitations API new 25

Adds an Invitations API on both v1 and v2.

— No endpoint paths or fields given v26.10.0
16 00
Assessments requirements matrix view new 20

Adds an assessments requirements matrix view.

— Bare name, no further description v26.10.0
└──▷ BREAKING ON UPGRADE
  • !
    Token hashing migration access_tokens.0012 cannot be rolled back — old releases cannot authenticate API tokens after it runs.
  • !
    The findings migration drops the vulnerability_scanning_findings table; old pods in a rolling deploy will fail. Run manage.py backfill_findings --missing-only to rebuild findings.
  • !
    POST /api/v1/licensing/custom-licenses is removed.
  • !
    Creating an access request now requires authentication and takes no request body; all access-request routes enforce token scopes.
  • !
    GET /plugins/assessments/{sbom_id} caps all_runs at 50; use history_limit and all_runs_total for full history.
  • !
    GET /workspaces/ now shows members, invitations, and billing data only to admins.
  • !
    The branding PATCH endpoint now only accepts null for icon and logo fields.
  • !
    PATCH /advisories/{id} now rejects unknown fields with 422.
  • !
    /releases/{id}/artifacts?mode=available now requires the release:manage scope.
  • !
    Environment variables TEAMS_*_ROLES are renamed to WORKSPACE_*_ROLES; old names work as aliases for now.
  • !
    KEYCLOAK_WEBHOOK_SECRET environment variable is removed.
  • !
    Custom DRAMATIQ_BROKER overrides must be updated.
  • !
    Custom domains now require outbound HTTPS from workers; rotating SECRET_KEY requires domains to be re-verified.
  • !
    The first Stripe sync moves ended paid plans to Community, making their private products and components public.
  • !
    Pending Owner invitations now grant Admin instead of Owner — re-send affected invitations.
  • !
    The new ws/user/ WebSocket route must be forwarded in reverse proxy configuration.
Was this useful?

cyclonedx-core-java

Sources Release notes → cyclonedx-core-java-13.4.0 Notes Rank Why this rank top features scored 60/50, +15 breaking change — 70 How ranking works →

cyclonedx-core-java 13.4.0 moves its full set of deserializers to a streaming architecture for faster, lower-memory SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. parsing, and drops its transitive dependency on packageurl-java.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

CycloneDX SBOM Model and Utils for Creating and Validating BOMs

cyclonedx-core-java 13.4.0 moves its full set of deserializers to a streaming architecture for faster, lower-memory SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. parsing, and drops its transitive dependency on packageurl-java.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 2 FEATURES 0 OF 2 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
packageurl-java dependency dropped breaking 60

The packageurl-java dependency has been dropped from cyclonedx-core-java; any code relying on transitive access to packageurl-java classes via cyclonedx-core-java must now declare that dependency directly.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Names exact dependency and required migration action cyclonedx-core-java-13.4.0
thinner coverage below
02 00
Streaming deserializers across BOM parsing improved 50

Hash and external reference list deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution. now use a unified, streaming path to cut memory overhead, and the remaining simple list, nested component, pedigree, choice, entity, extension, and risk deserializers were converted to the same streaming, low-allocation approach for consistency.

— Explains what changed and lists affected deserializer types, no benchmarks given cyclonedx-core-java-13.4.0
└──▷ BREAKING ON UPGRADE
  • !
    The packageurl-java dependency has been dropped; any code relying on transitive access to packageurl-java classes via cyclonedx-core-java must now declare that dependency directly.
Was this useful?
◆  Web Application Security

OWASP ZAP

Sources Blog post → announced · Oct 22, 2026 Blog Rank Why this rank top features scored 85, +6 runnable example — 91 How ranking works →

The ZAP by Checkmarx Core project

ZAP introduces a passive scan rule that detects PHP2Shell and over 60 known PHP CVEs directly from response headers, with built-in false-positive suppression and an automated weekly vulnerability feed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 1 FEATURE 0 OF 1 FEATURE most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
PHP2Shell and PHP CVE detection passive scan rule new 85

A new passive scan rule inspects response headers (no extra requests sent) to detect PHP2Shell and 60+ known PHP CVEs, raising a PHP Version with Known Vulnerabilities alert scoped to one alert per site/technology/version, risk-rated by the most severe applicable CVE and listing all affected CVEs with severity and links to a new PHP Known Vulnerabilities help page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ False positives (e.g. patched servers) can be suppressed via an Alert Filter matching URL, the PHP Version with Known Vulnerabilities alert name, and the specific version evidence string (e.g. PHP/8.1.2), configurable globally, in a context, or in the Automation Framework for CI/CD pipelines. The vulnerability list is kept current via a weekly automated job pulling from official php-src GitHub security advisories, which raises a pull request to update the add-on; the same rule is designed to support additional server-side technologies beyond PHP in future releases.

Suppress a false-positive alert on a host where you know PHP security backports have been applied, without silencing future version changes.
📍In the ZAP UI, go to Analyse › Alert Filters › Add, set the URL regex to the target site (e.g. https://www.example.com/.*), select alert name PHP Version with Known Vulnerabilities, set Evidence to the exact reported version string (e.g. PHP/8.1.2), and set New Risk to False Positive.
— Names exact alert, config fields, and UI steps for suppression launch-20261022-e571b26a
Was this useful?
Reverse Engineering, Malware & Forensics
◆  Digital Forensics & Incident Response

ALEAPP

Sources Release notes →Source code → v2026.4.4 Notes Code

Android Logs Events And Protobuf Parser

Adds --hash for SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. file staging with container timestamps, WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites.-mode SQLite immutable=1 fallback, and single-file portable Windows releases.

└──▷ GET THIS VERSION 
$ git clone --branch v2026.4.4 https://github.com/abrignoni/ALEAPP.git
# already have the repo? check out this version:
$ git checkout v2026.4.4
  • Adds --hash flag (and a matching GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. checkbox) to record SHA-256 hashes for staged files, capturing container-recorded timestamps from ZIP NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT./extended timestamp fields, tar headers (GNU, PAX), L01/AD1 entries, FAT/exFAT entries, and ext/APFSAPFSApple's proprietary filesystem introduced in 2017, replacing HFS+, designed for SSDs with native encryption, snapshots, and space sharing — giving cyber tools reliable forensic primitives on modern Apple devices./HFS+ times.
  • Reads Cellebrite CLBX ZIP times from metadata.msgpack (adding msgpack as a dependency), and extracts creation time from the fourth value of four-value extended timestamp blocks.
  • A WAL-mode SQLite database staged without its -wal file is now opened read-only with immutable=1.
  • Tar links are now read as the member they point to; corrupt ZIP members are skipped rather than halting the run.
  • Windows releases ship as a single portable file per architecture (-windows-x64-portable.zip, -windows-arm64-portable.zip) with no installer required.

5 details in Everything

└──▷ BREAKING ON UPGRADE
  • !Python 3.11 or newer is now required to run ALEAPP from source (previously Python 3.10 was sufficient).
  • !There is no aleappGUI executable any more — aleapp without arguments now opens the window.
  • !Windows releases no longer ship an installer; the distribution is a single portable file (aleapp.exe) that must be placed wherever a calling tool expects it.
Was this useful?

iLEAPP

Sources Release notes →Source code → v2026.4.5 Notes Code Rank Why this rank top features scored 90/80/75, +15 breaking change — 96.67 How ranking works →

iOS Logs, Events, And Plist Parser

iLEAPP v2026.4.5 extends raw-disk image parsing to LVM2LVM2The Linux Logical Volume Manager, maintained by the kernel community, that pools physical disks into flexible logical volumes so tools can resize, snapshot, or migrate storage without repartitioning., LUKSLUKSA disk-encryption standard built into the Linux kernel that stores encryption metadata in a header on the volume itself, letting cyber tools unlock encrypted drives portably across distributions and implementations. and RAIDRAIDA storage architecture that combines multiple physical disks into one logical volume using mirroring, striping, or parity to trade capacity for redundancy, speed, or both. volumes, adds SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hashing of staged files via a new --hash flag, and ships over 30 new app and system artifacts, while also moving to Python 3.11+ and retiring the separate GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. executable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 8 FEATURES 2 OF 8 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Raw image support for LVM2, LUKS, RAID, FAT improved 90

Extends -t raw support to LVM2 logical volumes (split, striped and RAID1), LUKS containers opened with a passphrase (via --image_password_file, --image_password_env, a prompt, or the GUI), RAID member images read together, and FAT12/FAT16 filesystems; also exposes free space, flash-filesystem deleted files, and NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. directory indexes to artifact modules that request them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Names exact flags and volume types but no worked example v2026.4.5
02 00
SHA-256 staging hashes via --hash new 80

Adds --hash flag (and a matching GUI checkbox) to record a SHA-256 digest for each staged file, covering zip NTFS and extended timestamp fields, tar headers (GNU and PAX), L01 and AD1 entries, FAT/exFAT entries, and ext/APFSAPFSApple's proprietary filesystem introduced in 2017, replacing HFS+, designed for SSDs with native encryption, snapshots, and space sharing — giving cyber tools reliable forensic primitives on modern Apple devices./HFS+ times.

— Concrete flag and coverage list, but no sample output shown v2026.4.5
03 00
Python 3.15 support and portable Windows builds improved 75

Supports Python 3.15 (including Windows wheels for Python 3.15 and ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead.) and packages Windows releases as a single portable file per architecture (-windows-x64-portable.zip and -windows-arm64-portable.zip) with no installer.

— Exact artifact filenames named, straightforward to use v2026.4.5
04 00
30+ new app and system artifacts new 70

Adds new artifacts: logarchive entries from sysdiagnose for unlock, buttons, orientation, gestures, USB host, wake source, AirDrop, calls, weather, family hotspot, charging state, app snapshots, container entries, and data usage; logarchive entries for URL and link opens, camera and microphone capture sessions, TCC authorization cache, location manager state, Screen Time (ManagedSettings), BatteryUI per-app runtime, and Container Manager State for iOS 27; 32 new Life360 artifacts (including crash-detection diagnostics and recovered history) plus generic Mixpanel and Crashlytics artifacts; and Apple Watch photo collections, registry history, Mail registry, Weather Cities, Photos Graph Moment Locations, routined visits and vehicle events, Cache Locations (course, altitude and accuracy), KeepSafe photo vault, Reddit post and subreddit history, Anonymous Chat, Emoji Recents/Usage/Preferences, an account-wide encryption key hash artifact, offline DJI TXT flight records, Discord Servers, Battery Center, Alarms sleep alarms, Apple Music search, Media Experience, Media Remote, Photos Recent Searches, Hashtag Images, and supplementary WebKit cache parsers.

— Exhaustive artifact list but no extraction command shown v2026.4.5
05 00
Cellebrite and GrayKey timestamp parsing new 70

Reads Cellebrite CLBX zip timestamps from metadata.msgpack (adding msgpack as a dependency), and reads the creation time from the fourth value of four-value extended timestamp blocks (GrayKey-style files_full.zip).

— Names exact source files and mechanism, no usage walkthrough v2026.4.5
thinner coverage below
06 01
GUI executable removed, unified entry point breaking 55

There is no ileappGUI executable any more; ileapp without arguments opens the window instead.

— Exact replacement command given for the removed binary v2026.4.5
07 02
Python 3.11 minimum requirement breaking 40

Python 3.11 or newer is now required to run iLEAPP from source; Python 3.10 is no longer supported.

— Clear version requirement, no migration detail beyond that v2026.4.5
08 00
Logarchive extraction from within sysdiagnose new 25

Reads logarchive from within a sysdiagnose archive.

— One-line description with no mechanism or path given v2026.4.5
└──▷ BREAKING ON UPGRADE
  • !
    Python 3.11 or newer is now required to run iLEAPP from source (previously Python 3.10 was supported).
  • !
    There is no ileappGUI executable any more; ileapp without arguments opens the window instead.
Was this useful?
Network Security
◆  Email Security

Material Security

Sources Blog post → announced · Oct 25, 2026 Blog Rank Why this rank top features scored 75 — 75 How ranking works →

Material Security launched a Google Drive Management Agent that automatically investigates sensitive files and remediates over-permissioned sharing based on configurable verdicts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Material Security is a SaaS platform that protects enterprise email and cloud file collaboration by detecting and remediating data exfiltration, phishing, and account takeover threats.

Material Security launched a Google Drive Management Agent that automatically investigates sensitive files and remediates over-permissioned sharing based on configurable verdicts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 1 FEATURE 1 OF 1 FEATURE most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
Google Drive Management Agent with verdict-based remediation new 75

The new Drive Management Agent investigates sensitive Google Drive files across content summary, sensitivity, and collaborator exposure, then assigns one of four verdicts — Cleared, Contained, Exposed, or Overexposed — to determine automated remediation actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Remediations are configurable per verdict: for example, Exposed files can trigger an owner notification followed by a grace period before access revocation, while Overexposed files can trigger immediate access revocation. Manual search, sort, and filter remain available across the full set of flagged Drive documents for investigations requiring human review.

— Clear mechanism and verdict logic, but no UI path or config key named. launch-20261025-555e430c
Was this useful?
◆  Network Analysis & Monitoring

ecapture

Sources Release notes → v2.9.0 Notes Rank Why this rank top features scored 87, +15 breaking change, +6 runnable example — 108 How ranking works →

Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64 and arm64.

eCapture v2.9.0 adds a pcapngpcapngA file format for storing captured network packets, succeeding the older libpcap (.pcap) format; it supports multiple interfaces, metadata annotations, and timestamps with nanosecond precision in a single capture file.-based data source for text mode, letting the openssl/tls, gotls, and gnutls modules reconstruct full HTTP/1.1 and HTTP/2 traffic without switching to pcap mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 1 FEATURE 0 OF 1 FEATURE most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
pcapng text source for TLS modules new 87

The openssl/tls, gotls, and gnutls modules gain a --text-source pcapng flag that reconstructs HTTP/1.1 and HTTP/2 request/response pairs with network metadata in text mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Packet timestamps are converted from TC monotonic time to Unix time before pcapng serialization, and a raw pcapng copy is saved alongside text output only when --pcapfile is also specified together with --text-source pcapng. hook remains the default source; existing scripts relying on prior text-mode behaviour should be validated against this new code path.

Reconstruct full HTTP/1.1 and HTTP/2 request/response pairs with network metadata in text mode — without switching to pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. mode — by feeding pcapng DSB blocks through the decrypt SDK.
$ sudo ecapture tls -m text --text-source pcapng
Reconstruct HTTP/2 traffic in text mode AND save a raw pcapng copy for later Wireshark analysis in the same run.
$ sudo ecapture tls -m text --text-source pcapng --pcapfile=ecapture.pcapng
— Names exact flags and modules with runnable commands and mechanism. v2.9.0
└──▷ BREAKING ON UPGRADE
  • !
    The openssl/tls, gotls, and gnutls modules now accept --text-source pcapng as a data source in text mode; hook remains the default, but existing scripts that relied on text-mode behaviour should be validated against the new pcapng code path.
Was this useful?
◆  Firewalls & Network Defense

Palo Alto Networks

Sources Blog post → changelog · Oct 21, 2026 Blog Rank Why this rank top features scored 65/65/55 — 61.67 How ranking works →

Palo Alto Networks launched Unit 42 Managed Agentic Endpoint Security, a 24/7 managed service built on Cortex AES, and extended AI Runtime Security to run natively on NVIDIA BlueField DPUsDPUsData Processing Units are purpose-built network processors that offload packet parsing, encryption, and telemetry from the host CPU, letting cyber tools run inspection pipelines at wire speed without taxing application cores., alongside new deployment, reporting, and identity-governance capabilities for agentic AI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Palo Alto Networks is a cybersecurity company offering firewalls, cloud security, and threat-prevention products that protect networks, endpoints, and cloud environments from attacks.

Palo Alto Networks launched Unit 42 Managed Agentic Endpoint Security, a 24/7 managed service built on Cortex AES, and extended AI Runtime Security to run natively on NVIDIA BlueField DPUsDPUsData Processing Units are purpose-built network processors that offload packet parsing, encryption, and telemetry from the host CPU, letting cyber tools run inspection pipelines at wire speed without taxing application cores., alongside new deployment, reporting, and identity-governance capabilities for agentic AI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 5 FEATURES 3 OF 5 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
AI Runtime Security on NVIDIA BlueField DPUs (GA) new 65

AI Runtime Security on NVIDIA BlueField DPUs is now generally available, isolating security processing in dedicated infrastructure silicon so policies are enforced independently of a potentially compromised host, across AI factory and industrial edge deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Clear mechanism and scope, but no actionable config or command. 2026-10-21-900cd124
02 00
Managed AES with Standalone Cortex AES deployment option new 65

A Managed AES with Standalone Cortex AES deployment option allows organisations to run Cortex AES alongside an existing endpoint security solution to gain AI-native visibility and governance without replacing incumbent tooling.

— Named deployment option gives a concrete starting point. 2026-10-21-900cd124
thinner coverage below
03 02
Unit 42 Managed Agentic Endpoint Security service new 55

Introduces Unit 42 Managed Agentic Endpoint Security (Managed AES), a 24/7 managed service built on Cortex AES that adds Unit 42 threat hunting, investigation, response, and AI governance expertise to the existing Cortex AES platform.

— Names the service and platform but no setup steps given. 2026-10-21-900cd124
04 03
Agentic identity governance with NVIDIA Sentry on BlueField DPUs new 50

An integration between agentic identity governance and NVIDIA Sentry on BlueField DPUs moves identity and delegated authority controls to silicon, separate from the host OS, to provide zero-trust protection and tamper-resistant auditing for agents; availability is pending.

— Mechanism described but feature availability is not yet live. 2026-10-21-900cd124
05 00
AI Security Posture and Threat Impact Reports new 45

Managed AES adds AI Security Posture Reports and Threat Impact Reports as deliverables, providing periodic policy and control improvement recommendations and threat response summaries.

— Report names given but no detail on access or format. 2026-10-21-900cd124
Was this useful?
Cloud & Container Security
◆  Runtime Security

cicd-sensor

Sources Release notes → releases/v0.0.49 Notes

Open-source eBPF runtime security sensor for GitHub Actions and GitLab CI/CD.

Agents can now authenticate to the Manager via GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user., removing the need to store long-lived Manager tokens.

└──▷ GET THIS VERSION 
$ git clone --branch releases/v0.0.49 https://github.com/cicd-sensor/cicd-sensor.git
# already have the repo? check out this version:
$ git checkout releases/v0.0.49
Was this useful?
Detection & Response
◆  Endpoint Security (EDR/XDR)

Trend Vision One

Sources Blog / feed → File Security Storage template version 2.6.0 for Azure (2026-10-26) Blog Rank Why this rank top features scored 40 — 40 How ranking works →

Trend Vision One's File Security Storage Azure deployment template now supports deploying into a customer-managed Azure VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Trend Vision One is Trend Micro's unified cybersecurity platform that consolidates threat detection, response, and risk management across endpoints, cloud, email, and networks.

Trend Vision One's File Security Storage Azure deployment template now supports deploying into a customer-managed Azure VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 1 FEATURE 0 OF 1 FEATURE most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Customer-managed VNet support in File Security Storage new 40

The File Security Storage Azure deployment template (version 2.6.0) adds optional customer-managed Azure VNet support, letting the storage deployment run inside a customer-controlled virtual network.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Names the exact template and feature but no setup steps or parameters. File Security Storage template version 2.6.0…
Runtime Malware Scanning for Amazon ECS (2026-10-21) Blog Stable

Terminate mitigation for ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. stops affected tasks and blocks further launches of flagged images, using the same filter rules and log/terminate options as Kubernetes.

Was this useful?

osctrl

Sources Release notes → v0.6.1 Notes Rank Why this rank top features scored 70/70/60 — 66.67 How ranking works →

osctrl v0.6.1 adds per-node osquery config/flag overrides, osquery version management with gradual rollout and per-host pinning, and new osctrld operational monitoring, extension delivery and flag serving, plus a default AWS credential chain for the S3 logger.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Fast and efficient osquery management

osctrl v0.6.1 adds per-node osquery config/flag overrides, osquery version management with gradual rollout and per-host pinning, and new osctrld operational monitoring, extension delivery and flag serving, plus a default AWS credential chain for the S3 logger.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 6 FEATURES 1 OF 6 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
osquery version management with per-host pinning new 70

Adds osquery version management including a version library, an environment-level version target, per-host version pins, upgrade reporting, and a pin retry rule.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Mechanism named but no exact UI path or API given v0.6.1
02 00
osctrld operational monitoring and health reporting new 70

Adds rate limiting, audit logging, and metrics for all osctrld endpoints, plus osctrld health reports surfaced via a node-page banner and alertable metrics.

— Names endpoints and banner but no exact metric names or alert config v0.6.1
03 00
Per-node osquery config and flag overrides new 60

osctrl now supports per-node overrides for both config and flags, letting operators apply node-specific osquery configuration and flags independently of the environment default.

— Names config and flags surfaces but no exact UI path or endpoint v0.6.1
thinner coverage below
04 00
Gradual rollout for osquery version targets new 50

Adds gradual rollout for the environment's osquery version target, with cached rollout progress and a node-page stage indicator showing rollout status per host.

— Describes behavior but no config key or command given v0.6.1
05 00
S3 logger default AWS credential chain improved 45

The S3 logger now uses the default AWS credential chain when no static keys are configured, removing the requirement to supply explicit credentials.

— Clear behavior change but no config key named v0.6.1
06 00
osctrld extension delivery and flag serving new 40

osctrld can now push osquery extensions down to enrolled nodes and serves the environment's stored flags to enrolled nodes; the UI now hides osctrld-only elements when osctrld is not enabled.

— Thin one-line additions without further mechanism detail v0.6.1
Was this useful?

Palo Alto Cortex XDR

Sources Blog post → changelog · Oct 19, 2026 Blog Rank Why this rank top features scored 59/53/43, +10 product media — 61.67 How ranking works →

Palo Alto Networks launched Cortex XDR One, merging Cortex XDR with Cortex Agentic Endpoint Security into a single sensor and console to extend detection and response to AI agents alongside traditional endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Palo Alto Networks Cortex XDR is an extended detection and response platform that unifies endpoint, network, and cloud telemetry to detect, investigate, and stop threats.

Palo Alto Networks launched Cortex XDR One, merging Cortex XDR with Cortex Agentic Endpoint Security into a single sensor and console to extend detection and response to AI agents alongside traditional endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 3 FEATURES 2 OF 3 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Real-time AI artifact inventory new 59

Delivers real-time inventory of every AI artifact (agents, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, AI co-pilots, browser tools) the moment it appears on an endpoint, enabling security teams to control which packages, extensions, agents, and AI artifacts are allowed to be installed or used.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Lists concrete artifact types but no UI/API path given 2026-10-19-7ef992b2
02 01
Cortex XDR One unified platform new 53

Cortex XDR One combines Cortex XDR and Cortex Agentic Endpoint Security (AES) under a single sensor and console, giving centralized visibility, management, and investigation across both traditional endpoints and AI agents.

— Names the merged products and console but no setup steps 2026-10-19-7ef992b2
03 02
Managed AES with Unit 42 new 43

Managed AES with Cortex XDR One provides 24/7 Unit 42-staffed governance, threat hunting, investigation, and response across the full endpoint attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. including AI agents.

— Describes the managed service scope but no operational detail 2026-10-19-7ef992b2
Was this useful?
◆  Threat Intelligence

World Monitor

Sources Release notes → v2.11.4 Notes

Real-time global intelligence dashboard. AI-powered news aggregation, geopolitical monitoring, and infrastructure tracking in a unified situational awareness interface

Pins Iran–GCC geopolitical tension pairs with live scoring over a rolling 168-hour window.

└──▷ GET THIS VERSION 
$ git clone --branch v2.11.4 https://github.com/koala73/worldmonitor.git
# already have the repo? check out this version:
$ git checkout v2.11.4
Was this useful?
◆  SOAR

Tines

Sources Blog post → announced · Oct 22, 2026 Blog Rank Why this rank top features scored 60/50/45, +10 product media — 61.67 How ranking works →

Tines' September 2026 release ships a faster v2 Records API, a new MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for AI clients, expanded AI model choice, and several case-management and admin usability upgrades.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Tines lets teams put AI to work across their most sensitive systems, data, and processes, with the security and governance to do it safely.

Tines' September 2026 release ships a faster v2 Records API, a new MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for AI clients, expanded AI model choice, and several case-management and admin usability upgrades.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 8 FEATURES 1 OF 8 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
v2 Records API for cases and child records improved 60

The v2 Records API enables single-call retrieval of related cases and child record data, with record searches running twice as fast as before.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Names the API and performance gain but no endpoint syntax launch-20261022-5eb9a1cc
thinner coverage below
02 00
Expanded AI model selection new 50

Adds AI model selection, supporting OpenAI GPT-6 Astra, Sol, and Luna, and Anthropic Claude Opus 5.5.

— Names exact models but not how selection is configured launch-20261022-5eb9a1cc
03 01
Tines MCP server for AI clients new 45

Adds the Tines Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCP) server, letting compatible AI clients search and summarize records and manage cases.

— Describes capability but no setup or connection details launch-20261022-5eb9a1cc
04 00
Case and Agent Management via API new 45

Adds case field updates and comment-change notifications, and agent skill management—including renaming a skill without reconnecting AI Agent actions that reference it—through the Tines API.

— Names the API surface but no endpoint or payload detail Explains behaviour change but no endpoint syntax given launch-20261022-5eb9a1cc
05 00
Markdown formatting formulas for story data new 35

Adds eight new markdown formulas for formatting story data into headings, lists, and other structures without writing markdown syntax manually.

— Mentions count and purpose but no formula names launch-20261022-5eb9a1cc
06 00
Bulk file download from case blocks new 35

Adds the ability to download all files from a case block together for faster evidence handoff.

— Clear user action but no UI path or limit given launch-20261022-5eb9a1cc
07 00
Case queue column controls and priority labels improved 25

Adds column controls and priority labels to case queues to keep important details visible.

— Brief UI description, no navigation specifics launch-20261022-5eb9a1cc
08 00
Admin controls for audit retention and AI usage improved 20

Gives admins controls over how long audit data is retained and a clearer view of AI usage.

— Generic description, no config keys or thresholds named launch-20261022-5eb9a1cc
Was this useful?
◆  Detection Engineering

Tenzir

Sources Blog post → announced · Oct 22, 2026 Blog Rank Why this rank top features scored 78/59/54 — 63.67 How ranking works →

Tenzir shipped a new isMalicious threat-intelligence integration built on open STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format./TAXII 2.1TAXII 2.1An OASIS-standard HTTP-based protocol for exchanging cyber threat intelligence, letting cyber tools publish and subscribe to structured threat data across organizations without custom integration work. standards, adding Library packages for in-stream indicator enrichment, local lifecycle tracking of indicators, and on-demand reputation lookups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Tenzir is a data pipeline engine for security teams that collects, transforms, enriches, and routes telemetry.

Tenzir shipped a new isMalicious threat-intelligence integration built on open STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format./TAXII 2.1TAXII 2.1An OASIS-standard HTTP-based protocol for exchanging cyber threat intelligence, letting cyber tools publish and subscribe to structured threat data across organizations without custom integration work. standards, adding Library packages for in-stream indicator enrichment, local lifecycle tracking of indicators, and on-demand reputation lookups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 3 FEATURES 0 OF 3 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
isMalicious TAXII enrichment via Tenzir Library new 78

Adds ismalicious, stix, and tenzir packages to the Tenzir Library, enabling TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. collection pulls from isMalicious and local indicator lookup without per-event API calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Fetches TAXII collections (starting with malicious-domains and malicious-ips) and maps each STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. Indicator to OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. Inventory Info for in-stream DNS and network event enrichment, keeping risk and confidence in separate OCSF osint fields per match to preserve the distinction between severity and source certainty; unmatched events are marked unknown, not safe.

— Names packages and OCSF mapping but no exact command or endpoint shown launch-20261022-78b305a2
thinner coverage below
02 00
Local indicator lifecycle tracking for isMalicious feeds new 59

Tracks indicator lifecycle locally: enforces valid_until expiry and removes revoked indicators after incremental polls using added_after between scheduled walks.

— Explains mechanism with named fields but no runnable config shown launch-20261022-78b305a2
03 00
On-demand isMalicious API lookups new 54

Supports optional on-demand API lookups of single indicators against the isMalicious API during investigations, returning the full report as an event; these lookups count against the monthly reputation-check quota.

— Describes behaviour and quota impact but no concrete call syntax launch-20261022-78b305a2
Was this useful?
Identity, Access & Data Protection
◆  Identity & Access Management

Ory

Sources Changelog → changelog · Oct 25, 2026 Changelog Rank Why this rank top features scored 50/48/38, +6 runnable example — 51.33 How ranking works →

Ory shipped configurable one-time code formatting, external-ID event matching, admin API attribution in event logs, and a redesigned Console layout rolled out to all workspaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Discover the latest features, improvements, and updates to Ory.

Ory shipped configurable one-time code formatting, external-ID event matching, admin API attribution in event logs, and a redesigned Console layout rolled out to all workspaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 4 FEATURES 0 OF 4 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Redesigned Ory Console layout and navigation improved 50

Ory introduces a new layout and navigation for the Ory Console, rolled out automatically to all Ory Network workspaces and projects with no migration or opt-in required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Navigate the redesigned Ory Console — no migration or opt-in required, it is live for every workspace.
📍1. Go to https://console.ory.sh 2. Log in to your Ory Network account 3. Select any workspace or project — the new layout and navigation are active automatically
— Clear navigation path given, but no detail on what changed in layout. changelog-20261025-b670a14d
02 00
External-ID matching in event stream new 48

The Ory Network event stream now supports external-ID matching for identity, login, registration, recovery, settings, verification, and session events.

— Names all seven event types but no mechanism or config shown. changelog-20261025-b670a14d
03 00
Admin API attribution in event logs improved 38

Events emitted by Ory Identities, Ory OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs., and Ory Permissions now show who made an admin API request.

— Names three products affected but no field or log format detail. changelog-20261025-b670a14d
04 00
Configurable one-time code length and charset new 32

Ory Kratos Identities via Ory Network now support configurable length and character set for one-time codes (OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets.).

— No config key or exact values given, just prose description. changelog-20261025-b670a14d
Was this useful?

JumpCloud

Sources Blog post → announced · Oct 23, 2026 Blog Rank Why this rank top features scored 85, +10 product media, +6 runnable example — 101 How ranking works →

JumpCloud makes it simple to manage Windows, Apple, Linux, and Android devices and to deliver secure access with SSO, MFA, Zero Trust, RADIUS, and more.

JumpCloud launched an End User MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. that lets employees run self-service identity tasks — profile updates, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. app lookup/launch, access requests, approvals, and password/MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. status checks — from AI clients like ChatGPT, Claude, and Cursor, with admin and employee-level session controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 1 FEATURE 0 OF 1 FEATURE most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
End User MCP Server for AI-client self-service new 85

JumpCloud added an End User MCP Server built on the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., letting employees perform User Portal self-service (profile updates, SSO app lookup and launch, access requests, approval tasks, password/MFA status review) from compatible AI clients such as ChatGPT, Claude, and Cursor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Admins enable it org-wide from Settings > JumpCloud AI in the Admin Portal, configuring session duration and automatic revocation, and can view and bulk-revoke active sessions there (connected client, client ID, redirect URI, employee, creation time, last-used time, expiry); employees can view and individually revoke their own sessions from Security > JumpCloud MCP in the User Portal. Connections authenticate via OAuth only (no API-key auth), each session scoped to the connecting employee's existing JumpCloud permissions, and sensitive credential actions — password reset/change, MFA enrollment/removal, SSH key management, device enrollment — are explicitly excluded from MCP scope and remain User Portal-only.

Enable the End User MCP Server for your org so employees can start connecting AI clients to their User Portal accounts.
📍In the Admin Portal, go to Settings › JumpCloud AI and enable the End User MCP Server. Set the session duration to control how long connections remain active before automatic revocation.
Audit and revoke suspicious or stale end-user AI client connections across the organization.
📍In the Admin Portal, go to Settings › JumpCloud AI. Review the list of active user sessions (client name, client ID, redirect URI, employee, last-used date, expiry). Select one or more sessions and choose Revoke to terminate them immediately.
Let an employee disconnect an AI client they no longer use without involving IT.
📍In the User Portal, go to Security › JumpCloud MCP. Locate the session for the client to disconnect and select Revoke.
— Exact admin/user UI paths and scope limits given, but no API/flag names. launch-20261023-80ebbfb8
Was this useful?

Auth0

Sources Blog post → announced · Oct 22, 2026 Blog Rank Why this rank top features scored 68/63/60 — 63.67 How ranking works →

Auth0 introduced CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows.-based identity management for AI agents, including manual client pre-registration, an Early Access dynamic registration flow, and Application Profiles for centrally managing security and authorization settings across CIMD clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure users, AI agents, and more with Auth0, an easy-to-implement, scalable, and adaptable authentication and authorization platform.

Auth0 introduced CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows.-based identity management for AI agents, including manual client pre-registration, an Early Access dynamic registration flow, and Application Profiles for centrally managing security and authorization settings across CIMD clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 3 FEATURES 3 OF 3 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
Application Profiles for CIMD client management new 68

Adds Application Profiles (Early Access) for centrally managing security and authorization settings — including refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. policies, Demonstrating Proof of Possession (DPoPDPoPAn IETF standard that binds an OAuth access token to a specific client's cryptographic key pair, so a stolen token cannot be replayed by an attacker who lacks the matching private key.), and Organizations — across dynamically registered CIMD clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Names concrete settings covered but no configuration steps given. launch-20261022-1cd42ba9
02 02
CIMD manual pre-registration for clients new 63

Adds CIMD (client ID metadata URL) support with manual pre-registration: an administrator submits a client metadata URL to Auth0, which retrieves and validates the metadata before creating the client after admin approval.

— Names mechanism and approval flow but no exact admin UI/API steps. launch-20261022-1cd42ba9
03 03
CIMD dynamic client registration (Early Access) new 60

Adds CIMD dynamic registration (Early Access), enabling just-in-time client discovery and registration during an OAuth authorization flow using a client ID metadata URL, without requiring admin pre-registration of every client.

— Describes mechanism but lacks concrete setup steps; Early Access. launch-20261022-1cd42ba9
announced · Oct 22, 2026 Blog

New b2b-saas-starter Terraform module provisions a full B2B identity stack — RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., attack protection, enterprise SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., and custom domains — from one module block.

  • Single module block provisions app client, API, RBAC, MFA, attack protection, and branding on Auth0.
  • roles and permissions inputs declare role-permission mappings as plain data with pre-apply validation.
  • organizations input creates per-customer Auth0 Organizations with SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. (samlp) or OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. enterprise SSO connections.
  • custom_domain and enable_custom_domain_verification inputs with dns_verification_record, dns_verification_command, and custom_domain_next_step outputs guide multi-step custom-domain setup.
  • manage_tenant, manage_attack_protection, and manage_mfa flags let multiple module instances share a tenant without ownership conflicts.

5 details in Everything

Was this useful?
◆  Non-Human & Agent Identity

Token Security

Sources Blog post → announced · Oct 22, 2026 Blog Rank Why this rank top features scored 75/55/45, +6 runnable example — 64.33 How ranking works →

Token Security launched a Grok Build integration that lets developers query and remediate agent credential and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. risk directly inside the editor, paired with EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. data to catch shadow agents and endpoint credentials outside the sanctioned workspace.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Token Security accelerates secure adoption of Agentic AI by managing & governing AI agents & non-human identities.

Token Security launched a Grok Build integration that lets developers query and remediate agent credential and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. risk directly inside the editor, paired with EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. data to catch shadow agents and endpoint credentials outside the sanctioned workspace.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 3 FEATURES 0 OF 3 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Grok Build Marketplace plugin for in-editor findings new 75

A Token Security plugin in the Grok Build Marketplace lets developers query Token findings — secrets, MCP server permissions, and credential ownership — without leaving the editor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ It integrates with the Grok Build Admin APIAdmin APIA dedicated HTTP interface that exposes management and configuration operations separately from the data plane, letting cyber tools automate provisioning, policy changes, or monitoring without touching the main user-facing service. to enumerate which users are enabled in a workspace and which MCP servers and tools each team has configured, and the Grok Build agent itself can call these plugin tools during remediation workflows to query secret and credential-ownership metadata directly from the editor.

Ask Token Security which secrets are expiring soon and who owns them, directly from inside Grok Build, so the right developer can rotate credentials before they become a risk.
📍Which secrets expire in the next 30 days, and who owns them?
— Names plugin, Admin API and agent tool-calling with a working example query launch-20261022-dad6e37a
thinner coverage below
02 00
EDR pairing surfaces endpoint credential risk in Grok Build new 55

Pairs EDR integrations (e.g. CrowdStrike) with Grok Build workspace data to surface MCP config files and hardcoded credentials found on developer endpoints, including agents running outside the sanctioned Grok Build workspace.

— Names mechanism and a concrete EDR example but no command or config path launch-20261022-dad6e37a
03 00
Per-finding attribution for Grok Build risks new 45

Each risky Grok Build config item — hardcoded PATsPATsA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it., over-permissioned MCP servers, or unreviewed remote endpoints — is routed to the developer or identity owner responsible for it.

— Describes routing behaviour and named risk types but no interface detail launch-20261022-dad6e37a
Was this useful?
Governance, Risk & Compliance
◆  Compliance Automation & Trust Management

Compyl

Sources Release page → Oct 23rd, 2026 Notes Rank Why this rank top features scored 40, +10 product media — 50 How ranking works →

Compyl added custom fields support to the Clients module, allowing administrators to define and manage custom fields on client records.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Compyl is the AI-powered GRC platform that maps one control library to SOC 2, ISO 27001, HIPAA, PCI DSS and 70+ frameworks, so you stay audit-ready year-round.

Compyl added custom fields support to the Clients module, allowing administrators to define and manage custom fields on client records.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 1 FEATURE 0 OF 1 FEATURE most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Custom fields for Clients module new 40

Administrators can now define and manage custom fields on client records within the Clients module.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— States the capability but no field types, limits, or config details. Oct 23rd, 2026
Was this useful?
Agent
◆  MCP Servers & Tooling

Runlayer

Sources Blog / feed → 1.36.0 (2026-10-24) Blog Rank Why this rank top features scored 80/50/45, +15 breaking change — 73.33 How ranking works →

Runlayer 1.36.0 lets skill admins detach published skills from their source repo for direct editing, while also sharpening the Go agent's task follow-through and retraining ToolGuard's removal recommendations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Runlayer is an MCP gateway that enforces identity-mapped permissions and detects threats across the agents and MCP servers employees use.

Runlayer 1.36.0 lets skill admins detach published skills from their source repo for direct editing, while also sharpening the Go agent's task follow-through and retraining ToolGuard's removal recommendations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 3 FEATURES 0 OF 3 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Skill detachment from source repository new 80

Skill owners and skill admins can detach a skill published with runlayer skills push from its source repository so it can be edited directly in Runlayer, preserving files, version history, and sharing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Editors can also detach a skill once its owner is deactivated, preventing orphaned skills when a publisher leaves. After detachment, later pushes from the source repository no longer update the skill, automatic updates are turned off, and pushing a skill with the same name fails until one is renamed.

— Names the push command and full detach/rename behavior 1.36.0 (2026-10-24)
thinner coverage below
02 00
Go agent task follow-through improvements improved 50

The Go agent now checks its own work before marking tasks complete, waits on slow results such as CI or deploys, reports the real outcome, and supports timed reminders (e.g. 'ping me in 30 min').

— Describes behavior changes but no config or command 1.36.0 (2026-10-24)
03 00
ToolGuard tool-removal recommendation retraining improved 45

Retrains the ToolGuard tool-removal model so recommendations are scoped to the tools a deployment actually sends and are proportionate to each agent's tool set, rather than occasionally suggesting removing every tool.

— Explains the fix but gives no actionable surface 1.36.0 (2026-10-24)
└──▷ BREAKING ON UPGRADE
  • !
    Pushing a skill with the same name as an already-detached skill fails until one of them is renamed.
Was this useful?
Deploy
◆  Agentic Infrastructure

microsandbox

Sources Release notes → v0.7.11 Notes Rank Why this rank top features scored 35 — 35 How ranking works →

microsandbox v0.7.11 adds support for authenticated HTTP CONNECTHTTP CONNECTAn HTTP method that asks a proxy server to open a raw TCP tunnel to a target host, letting clients relay arbitrary traffic — including TLS — through the proxy without the proxy inspecting it. proxies in its SDK, letting sandboxes reach external services through a proxy requiring credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

easy, fast, programmable and local-first microVM runtime and library

microsandbox v0.7.11 adds support for authenticated HTTP CONNECTHTTP CONNECTAn HTTP method that asks a proxy server to open a raw TCP tunnel to a target host, letting clients relay arbitrary traffic — including TLS — through the proxy without the proxy inspecting it. proxies in its SDK, letting sandboxes reach external services through a proxy requiring credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 1 FEATURE 1 OF 1 FEATURE most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
HTTP CONNECT proxy authentication in SDK new 35

The SDK now supports HTTP CONNECT proxy authentication, enabling sandboxes to reach external services through authenticated proxies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

— Names the capability but no config keys, flags, or usage shown v0.7.11
Was this useful?
Govern
◆  AI Runtime Defense & Guardrails

Manifold Security

Sources Blog post → announced · Oct 22, 2026 Blog Rank Why this rank top features scored 83, +6 runnable example — 89 How ranking works →

Manifold Security is an AI detection and response platform that monitors what autonomous AI agents do at runtime on enterprise endpoints and blocks risky actions.

Manifold Security launched Open VSX editor-extension scanning, inventorying and risk-rating roughly 17,000 extensions nightly and tying that risk directly to AI agents running on the same endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 1 FEATURE 0 OF 1 FEATURE most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Open VSX editor extension scanning and inventory new 83

Manifold adds Open VSX editor-extension scanning to the public Manifest intelligence site, covering ~17,000 extensions refreshed nightly and searchable without a Manifold account under Editor Extensions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Any extension detected on a managed machine by the endpoint collector (version 0.997.2 or newer) appears in the Manifold inventory alongside MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, skills, and plugins, with a Manifest tab showing the rating for the installed version and flagging when the installed version (e.g. 9.0.0) differs from the scanned version. Extensions rated critical, high, or medium automatically raise a supply-chain risk on every AI agent running on the same machine. Tracked editor surfaces are VS Code, VS Code Insiders, Cursor, Windsurf, Kiro, and Antigravity.

Check a Cursor or Windsurf extension for supply-chain risk before anyone on your team installs it.
📍1. Go to the Manifest site 2. Select Editor Extensions 3. Search for the extension by name to view its rating, findings, and whether the publisher owns the claimed code repository
Triage a flagged extension on a developer machine — verify the endpoint collector meets the minimum version, then view the extension's Manifest rating inside the inventory.
📍1. Confirm the endpoint collector is at version 0.997.2 or newer on the developer machine 2. In the Manifold console, open Inventory 3. Locate the editor extension (VS Code, Cursor, Windsurf, Kiro, or Antigravity) 4. Select the extension and open its Manifest tab to see the rating, findings, and scanned-version notice
— Names collector version, editor list, and exact rating/risk mechanism. launch-20261022-fe7b4ea8
Was this useful?
Other / Uncategorized
◆  UNCATEGORIZED

vigolium

Sources Release notes → v0.5.5 Notes Rank Why this rank top features scored 90/90/70, +6 runnable example — 89.33 How ranking works →

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision

Vigolium v0.5.5 adds HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer.-aware fuzzing, three new reconnaissance subcommands (fingerprint, hosts, dns), a self-describing schema/introspection layer, and broad TSVTSVA plain-text format storing tabular data with fields separated by tab characters, making it easy for cyber tools to parse and exchange structured records without a CSV parser's quoting complexity. output and field-filtering support across core commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 9 FEATURES 0 OF 9 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
HTTP/3 fuzzing with protocol fallback new 90

Adds --http-version, --http3, and --http3-only flags to fuzz, multiplexing over HTTP/3 → HTTP/2 → HTTP/1.1 with the negotiated protocol reported as pace.protocol.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Fuzz an endpoint over HTTP/3 first, falling back through HTTP/2 and HTTP/1.1, to test behaviour across protocol versions.
$ vigolium fuzz --http3 -u https://target.example.com/FUZZ -w builtin:default --fields pace.protocol,status,length
— Named flags, fallback mechanism, and a runnable example v0.5.5
02 00
Fingerprint, hosts, and dns subcommands new 90

Adds vigolium fingerprint with --depth light|standard|full to store per-origin host facts, vigolium hosts with --sans and --soft-404 flags to read stored host facts, and vigolium dns to resolve and store DNS records, with dig and host shims routing to the new dns subcommand.

Collect deep per-origin host facts — TLS certs, banners, favicons — for a set of targets before a pen-test engagement.
$ vigolium fingerprint --depth full -u https://target.example.com
Dump all stored hosts with SAN data and soft-404 signatures in TSV for easy import into a spreadsheet or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
$ vigolium hosts --sans --soft-404 --format tsv
— Three named subcommands with flags and two runnable examples v0.5.5
03 00
Schema and self-documentation subcommands new 70

Adds vigolium schema storage [table] to describe tables, columns, and row counts, a --usage flag available on any command, vigolium schema flags <command> -j for machine-readable flag docs, and JSON schemas for fuzz, replay, ingest, traffic body/headers, hosts, dns, fingerprint, and schema storage/flags.

— Exact subcommand and flag syntax but no worked example v0.5.5
04 00
TSV output and shared field-control flags new 70

Adds --format tsv output to traffic, finding, endpoints, params, hosts, and dns commands, and adds --fields, --compact, and --max-output-bytes flags to fuzz, replay, endpoints, params, log ls, hosts, and dns.

— Enumerates every command and flag affected v0.5.5
05 00
Traffic field system additions improved 60

Adds traffic --fields matches_not_found and --exclude-not-found flags, plus new uuid_short and response_headers fields to the shared --fields system, with nearest-name suggestions offered on typos.

— Named fields and flags but no usage shown v0.5.5
thinner coverage below
06 00
Favicon hashing and protocol pinning in discovery improved 55

Adds favicon mmh3 hash output (Shodan/FOFA compatible) alongside existing MD5 and SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hashes, and pins each origin's discovered protocol in discovery.engine.protocol with a dedicated brute_force_concurrency pool.

— Named fields and config key but no usage example v0.5.5
07 00
UUID prefix matching for record flags improved 55

Record UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. flags now accept a unique 8+ character prefix, returning ambiguous_id on collision.

— Concrete behaviour and error name, no example v0.5.5
08 00
Ingest listing and WAF block-page capture new 50

Adds ingest -j to list stored items and failure reasons, plus --keep-blocked to store WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. block pages.

— Named flags with minimal explanation of behaviour v0.5.5
09 00
PHP vulnerable-version passive detection new 45

Adds a php2shell-version passive module flagging vulnerable PHP 8.2–8.5 banners.

— Named module and version range, no usage shown v0.5.5
Was this useful?

Arcade

Sources Blog post → announced · Oct 22, 2026 Blog Rank Why this rank top features scored 75/55/50, +6 runnable example — 66 How ranking works →

Arcade launched the Arcade Plugin, giving agents in popular coding and chat clients access to over 1,000 tools through a single shared gateway, along with built-in tool recommendation and authorization handling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Arcade is the actions runtime for enterprise AI agents — one control point to enforce, execute, and govern every action, every time.

Arcade launched the Arcade Plugin, giving agents in popular coding and chat clients access to over 1,000 tools through a single shared gateway, along with built-in tool recommendation and authorization handling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ WHAT SHIPPED · 3 FEATURES 1 OF 3 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
Arcade Plugin for major agent clients new 75

The Arcade Plugin can be installed in Claude Code, Claude Desktop, Cursor, VS Code, GitHub Copilot CLI, and Codex, connecting agents to a single shared Arcade gateway without requiring any MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gateway configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Install the Arcade Plugin in a supported agent client to start making tool calls without configuring an MCP gateway.
📍In your agent client (Claude Code, Claude Desktop, Cursor, VS Code, GitHub Copilot CLI, or Codex): 1. Install the Arcade Plugin from the client's plugin/extension marketplace. 2. Sign in with your Arcade account. 3. Ask your agent something like 'summarize my unread email' or 'post the release notes to #eng' — the plugin routes the call through the shared Arcade gateway automatically.
— Names clients and install flow but not config internals launch-20261022-d21b34e1
thinner coverage below
02 00
Tool Recommendation catalog new 55

Tool Recommendation keeps a catalog of over 1,000 agent-optimized tools out of the model's context windowcontext windowThe maximum amount of text, counted in tokens, a model can take in and produce in one request. Everything the model knows about the task has to fit inside it., enabling a single Arcade gateway to serve all users dynamically instead of loading the full tool list into context.

— Explains mechanism but no direct usage step given launch-20261022-d21b34e1
03 00
Skills and lifecycle hooks for tool authorization new 50

Skills and lifecycle hooks shipped inside the plugin teach agents when to invoke Arcade tools and how to authorize services like Gmail or Slack directly from within the agent client.

— Names services but no concrete config or command shown launch-20261022-d21b34e1
Was this useful?
// END OF TRANSMISSION

The Cyber Toolchain · curated daily · October 25, 2026
Releases & features from the open-source and commercial cyber tools that practitioners actually run.

▷ Subscribe
cyber-toolchain / feedback

Feedback on

compare.md

    Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

    my-toolchain — 0 tools

      Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
      browse all tools → score card for your toolchain →
      cyber-toolchain / feedback

      Send us feedback