The Cyber Toolchain — issue 124, October 29, 2026

The network-ops capability now installs a full toolchain locally in Docker sandboxes — nmap, smbclient, hashcat, john, impacket, certipy-ad, bloodyAD, and NetExec — and exposes structured findings (hosts, users, credentials, shares, and weaknesses) viewable in Agent Output after enumeration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Hosted inference streams that drop on unstable network paths are now retried automatically up to 3 times with exponential backoff (1 s, 2 s, 4 s).

The ai-red-teaming capability supports selecting a GCG-family white-box attack from the attack catalog, using a local open-weight model as the surrogate for the assessment.

Adding tool_call_attack_landed to the scorer list in an airt SDK study configuration scores agentic red-team runs for exact tool-call landings instead of relying on a judge model.

The Whitebox pentest wizard gains a new Scope step with a checkbox file tree, letting you include or exclude specific folders so the pentest scans only the directories that matter instead of the whole repository.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

A new Attestation Letters page lists Hacktron-issued attestation letters, each with a unique shareable link and a PDF download that auditors can view without logging in.

Pull requests with up to 500 changed files are now accepted for Code Review, up from 200, and OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. organizations now get 50 free PR reviews per month, up from the previous limit.

Organization admins can turn off automated code review comments for the whole organization from Settings.

The final Whitebox review step is rebuilt as a structured summary panel with Source, Target, Access, and Context sections, each with an Edit button and visible verification status.

A new blue5 scanner provides a live results list, device identification from built-in company and service databases, an events-per-second dashboard with audio, and logging to WiGLE and a SQLite blue5.db database tracking up to 25,000 devices in RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ The blue5ctl fetch -r command strips BLE random-address churn so only stable, identifiable devices appear in results.

$ blue5ctl fetch -r

A new Client Access setting under Settings > System > Virtual Pager (off by default) enables SSH and Virtual Pager access over a Client Mode network such as a phone hotspot.

The _pineap CLI commands INTERFACE LIST and SSIDPOOL LIST now support format=json or format=mjson for machine-readable output.

$ _pineap SSIDPOOL LIST format=json

The new Files page under Manage Data > Files lets users browse, preview, edit, upload, rename, move, delete, and download loot, payloads, /mmc/root, and a mounted USB drive, with drag-and-drop upload and whole-folder zip downloads.

Native GPS is now built into PineAP and enabled by default on new installs and upgrades, with plugging in a GPS device auto-configuring it. gpsd settings — service toggle, serial device, baud rate, and restart — can be configured from the new Settings > GPS > Advanced page or via the hak5-commands GPS commands.

The Virtual Pager now scales to any screen size with large touch buttons, keyboard shortcuts (press ? to list them), a pin-to-every-page shell (press ), and side-by-side or stacked Pager and shell panes that can be minimized, maximized, or opened in a new window.

The Recon page now shows an All radios pane with Wi-Fi and Bluetooth totals, a two-minute packets-and-events graph, breakdowns by encryption, band, channel, and Bluetooth device type, and live searchable, filterable, sortable device tables including AP client lists.

The new WiGLE Logs page displays WiGLE logs on an offline map using saved OpenStreetMapOpenStreetMapA free, community-maintained world map database anyone can query or download, giving cyber tools access to geographic and infrastructure data without licensing fees or API rate limits tied to commercial providers., OpenTopoMap, or other tile sets (capped at 500 MB), alongside a searchable device list and a devices-over-time chart.

Adds guided per-AP WiFi attack profiles that walk the user through targeted attacks against a selected access point, rather than broad channel-wide attacks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ On the device this is accessed via WiFi > Attacks by selecting a scanned access point and then choosing an attack profile from the guided per-AP menu.

Mend SAST adds a risk factors column to the Applications and Projects lists, filterable by group or individual risk factor, to help prioritize remediation across projects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ An evidence page lists the code signals behind each risk factor classification, grouped by risk factor and file, and a risk factors widget appears on the project summary page for at-a-glance visibility. The capability is enabled from organization administration, requires AI consent, is off by default, and when enabled shares code snippets and project details with Mend's AI model to produce classifications.

AI agents discover subdomains, open ports, and services from a list of top-level domains, then attempt exploitation using known CVEs, misconfigurations, and exposed secrets, chaining findings across hosts to pivot and produce a full attack-path report from entry point to impact.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ A scoping agent checks ownership of each subdomain and restricts testing to owned portions, routing all agent traffic through a proxy that blocks out-of-scope connections; the Agents tab shows each agent's live thinking, tools in use, and findings. Tests can run in Continuous mode so newly discovered subdomains are tested shortly after going live, with intensity controlled via a maximum requests-per-second per target and optional restriction to inside or outside business hours. The resulting report is auditor-ready, formatted like Aikido's existing web app and mobile pentest reports, and covers the attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. up to the login page.

Install the extension with copilot plugin install github-security@awesome-copilot in the terminal, or search github-security in the Copilot app's Customize panel and click Install.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Run /security-review on local changes to catch new issues before opening a pull request, with the extension flagging when code has changed since the last review; you can also ask Copilot about alerts in chat using the extension's tools, governed by existing tool permission settings. Public preview on github.com and GitHub Enterprise Cloud with data residency; GitHub Enterprise Server is not supported.

⤢

$ copilot plugin install github-security@awesome-copilot

$ /security-review

The new Agent Host isolates Copilot sessions from individual VS Code windows, powering session continuity across VS Code, the Copilot app, GitHub Mobile, github.com, Copilot CLI, Slack, and Microsoft Teams DMs; sessions stay alive after closing a VS Code window or project folder, and extend to remote machines via VS Code's Remote SSH and dev tunnels from the Agents window so agents keep running after disconnect. Start an agent on your dev machine and control it from GitHub Mobile with code agent host --github-environment run from your project folder. An open Agent Host Protocol (AHPAHPAnalytic Hierarchy Process, a structured decision-making method that breaks a complex choice into a weighted hierarchy of criteria and scores alternatives against them, letting cyber tools rank or prioritize options mathematically.) lets you build custom clients that share live sessions with VS Code, with client libraries for TypeScript, Rust, Go, Kotlin, and Swift available via code agent host. Switching between the editor and the Agents window keeps both in sync with the same live session.

⤢ ⤢

$ code agent host --github-environment

GitHub Agentic Workflows lets you define automation in natural language Markdown files that compile to standard Actions YAML and run inside GitHub Actions with existing runner groups and policies, now generally available. Workflows can run on self-hosted Actions Runner Controller runners with Docker-in-Docker support; a model router automatically selects models per workflow optimizing for task type and difficulty, and you can also pick model providers per workflow from a refreshed model inventory. Agents run with read-only permissions by default, execute inside a sandboxed container behind the Agent Workflow Firewall, and have all proposed changes scanned by a dedicated threat detection job before being applied. Use gh aw forecast (no longer experimental) for AI credit spend projections including threat detection credits and monthly ranges, and gh aw add-wizard to add new workflow templates to a repository.

$ gh aw forecast

$ gh aw add-wizard

Create shared automations by choosing Shared under Type when creating an automation on github.com, the Copilot app, or VS Code, making the workflow visible to all readers and editable by anyone with write access. Shared automations are billed to the organization or user owning the repository rather than the creator, attribute actions to Copilot instead of an individual, persist if the creator leaves the team, and keep a change history of tool/trigger/prompt evolution. Organization admins must enable the 'Allow use of Copilot cloud agent billed to the organization' policy for shared automations to run in org-owned repos. Available on Copilot Pro, Pro+, Max, Business, and Enterprise plans.

Copilot Fusion automatically routes and orchestrates models across Single (one model), Cascade (draft-then-escalate), and Critique (draft-review-revise) workflows, selectable from the model picker without manual switching. Choose an effort level — Fusion Standard, Fusion High, or Fusion Max — to control whether Fusion favors versatile, capable, or most-capable models; enterprise admins can set each model's effective policy state per-Fusion via enterprise/organization model policies, set Fusion as the enterprise default via Enterprise managed settings, and paid-plan users get a 30% cost discount for a limited time. Fusion now also routes between on-device and cloud models: enable chat.copilot.localModel.enabled in VS Code and select Standard in Fusion, configure MAI Code 1.1 Flash or Qwen3.8 Flash Next via a local OpenAI-compatible server for Copilot CLI, download MAI Code 1.1 Flash via the Windows ML provider under Settings > Model providers plus Settings > Experiments > Local model auto routing in the Copilot app, or run /model in Copilot CLI with experimental mode enabled on Windows.

⤢ ⤢ ⤢

chat.copilot.localModel.enabled: true

Copilot Dreaming lets Copilot reflect on past sessions to update personal memories, propose changes to repository skills and custom instruction files via pull requests, and turn recurring accepted code-review feedback into standing guidance. It runs three dream types — personal memory curation, repository customization, and code review customization — and is opted into via Copilot settings (individuals) or Copilot policies (organizations and enterprises), e.g. Organization Settings > Copilot > Policies > Dreaming.

Copilot can now interact with desktop apps — reading content, clicking controls, entering text, navigating UI — including apps with no API, CLI, or MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. integration. In the Copilot app (public preview on macOS and Windows), enable it via Settings > Computer Use > Enable Computer Use, granting Accessibility and Screen Recording permissions on macOS. In VS Code, enable chat.agentHost.computerUse.enabled, restart VS Code, then run /computer on in a Copilot session.

$ # 1. In VS Code Settings, enable chat.agentHost.computerUse.enabled and restart VS Code
# 2. In a Copilot session panel, run:
/computer on

Generate and edit images using natural language in any Copilot chat session in VS Code, the Copilot app, or Copilot CLI, powered by GPT Image 2.5 Flare; results preview inline and save directly to your workspace. Organization and enterprise owners can disable image generation via Copilot model policies (Organization Settings > Copilot > Policies > Model policies), and users can opt in to a visible Made with AI watermark on generated/edited images, off by default.

⤢ ▶ Watch video

Use /research in Copilot to search for exact text, symbols, regex patterns, or natural-language descriptions across multiple repositories without a local clone, narrowing results by repository, path, or language.

$ /research How do these components retry failed charges, and where could retries overlap?

$ /research Identify all repositories still calling the old payment API and list the changes each service needs to migrate.

Discover, create, and manage agent customizations — skills, MCP servers, plugins — from the Customizations Marketplace in the Agents window sidebar or via the Chat: Open Customizations command (enabled by default in preview). Register plugin marketplaces and enable default plugins at the repository level via .github/copilot/settings.json.

GitHub Enterprise now includes Copilot access for every licensed user, replacing separate seat and usage tracking with a single enterprise budget metered from the first request; code completion and next edit suggestions keep working after the budget is exhausted, while Copilot Chat, Copilot code review, and Copilot in the cloud require available budget. Users in an enterprise account without a GitHub Enterprise license can get the same features and models via Copilot Standalone at $10 per user per month, with no monthly AI credits per seat.

GitHub Copilot Memory is now generally available on paid Copilot plans, letting Copilot remember personal preferences and repository conventions across sessions in the Copilot app, Copilot CLI, VS Code, Copilot cloud agent, Copilot code review, Slack, Teams, and GitHub Mobile.

A new --background flag (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ ggshield machine report --background) runs machine scans at low priority so they don't slow developer machines; it can also be made the default fleet-wide via scan.resources.background.mode: auto set in a config file such as machine_scan.yaml.

$ ggshield machine report --background

scan:
  resources:
    background:
      mode: auto

Docker Hub incidents now carry publishing account, image, repository, and layer context, and flow through the same notifications, integrations, and agents analysis as GitHub incidents.

⤢

Findings pushed to Wiz now include GitGuardian incident, occurrence, and source IDs in the finding's originalObject field, for use in Wiz workflows and the Wiz API.

The GET /v0/report/view/{id} endpoint is deprecated and will be retired on November 20, 2026; it now returns a Sunset response header advertising the retirement date.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Integrations must migrate to GET /v0/orgs/{org_slug}/full-scans/{full_scan_id} to continue retrieving scan reports.

$ curl -s -H 'Authorization: Bearer <token>' 'https://api.socket.dev/v0/orgs/<org_slug>/full-scans/<full_scan_id>'

$ curl -sI -H 'Authorization: Bearer <token>' 'https://api.socket.dev/v0/report/view/<id>' | grep -i sunset

Starting November 10, 2026, the Obfuscated code alert will be removed from the Balanced and Comprehensive security policy preset defaults. Organizations that want to keep receiving it must open Security Policy and set Obfuscated code to Warn or Monitor instead of Inherit, or add a matching rule on the Policies page.

Build custom runtime guardrails scoped to specific AI models, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, and skills, choosing to flag or block violations at a severity level you set.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Agent governance can start from 100+ built-in out-of-the-box security policies covering runtime agent behavior, configured under Agent Activity > Guardrails.

OX Security now traces each AI agent session step by step via the new Agent Activity feature, covering prompts and responses, MCP server and tool calls, read/write access permissions, and sensitive data touches (PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., secrets, tokens, financial data). It is in early access on OX.VibeSec and OX.Cloud.

The environment command now supports a -E flag that ignores all inherited PYTHON* environment variables during SBOM generation, useful for isolating generation from the host shell (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ in CI where those vars may point to the wrong interpreter). Example: cyclonedx-py environment -E .venv.

$ cyclonedx-py environment -E .venv

Unfurl now parses ETags found in etag query parameters or quoted header values ("..." or W/"..."), decoding layouts from Apache httpd, nginx, and Node.js to extract file size, mtime (in seconds, milliseconds, or microseconds), inode, and compression suffix.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ unfurl "https://example.com/image.jpg?etag=%22f4381-6385a594%22"

Unfurl now converts WebKit, WebKit milliseconds, Windows FileTime, and UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. v1/v6 timestamps using integer math instead of floating-point, preserving source precision (three digits for WebKit milliseconds, six for WebKit, seven for FileTime and UUID times).

The MCP server gains new tools: create_admission_policy_binding, list_configuration_security_scan_summaries, list_sboms, list_sbom_packages, and validate_scan_selection (with shared control resolution).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Existing tools are extended — analyze_vulnerability_exposure gains an include_identity parameter, list_vulnerabilities_in_manifest gains filtering and pagination, get_configuration_security_scan_manifest gains control filtering, list_controls can be filtered by framework and paginated, and diff_reports counts unchanged findings while listing them only on request. Remediation for report items from posture reports can now be applied via MCP.

The image scan command gains a --notify flag that posts a webhook to a given URL after the scan completes, letting downstream systems receive vulnerability results automatically.

$ kubescape scan image nginx:latest --notify https://hooks.example.com/kubescape

The fix command adds an --output-post-renderer flag for Helm, hardens overlay staging and boundaries, and renders Helm charts targeting the newest Kubernetes version allowed by the chart's kubeVersion.

Exposure analysis now evaluates Gateway API ReferenceGrant objects to correctly account for cross-namespace backends when determining exposure.

Registry Scanner v0.13.0 adds standalone binary scanning to identify applications not installed by a package manager, including PHP compiled from source, letting distroless and scratch images surface new findings after upgrade.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Agentless Host Scanning now also identifies PHP in standalone binaries, including PHP compiled from source such as the official Docker Hub php images, with no new deployment steps required. Because this can surface findings on images that previously showed none, Sysdig recommends reviewing results after upgrading Registry Scanner.

⤢ ⤢ ⤢

Adds the tojson search command plus four new JSON eval functions — json_array_to_mv, mv_to_json_array, json_append, and json_extend — to convert, append to, and extend JSON-structured data within a search pipeline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ index=main sourcetype=syslog | tojson

$ index=main | eval tags=json_append(tags, "new_tag") | eval metadata=json_extend(metadata, tag_array)

Splunk Enterprise now uses HTTP compression by default in place of SSL compression, reducing the security vulnerability surface; this does not apply to forwarding, and deployments relying on SSL compression need to review their configuration.

Health report gains new capabilities: monitoring ingestion latency to detect when forwarders have fallen behind, identifying excessive disk I/O wait times via the new IOWait feature with status written to health.log, and capturing feature health status across nodes in distributed environments including search head cluster members.

Clean room notebooks can now run on serverless GPU compute for model inference and training over shared data, using AI Runtime with the same approval flow, data access, and output tables as other clean room notebooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ This is generally available now, and will become the default for accounts where it's off starting November 26, 2026; teams can opt in early by enabling Clean Rooms AI Runtime from the Previews page in the account console.

⤢ ⤢ ⤢ ⤢

A new Usage Dashboard for Unity Gateway tracks coding-agent adoption, harness usage, and estimated session spend, and supports tag-based spend attribution plus expanded model and user spend analysis. Accessible via Unity Gateway > Usage Dashboard in the Databricks console.

New --policy safe (default) and --policy trusted options on both the convert and check commands control how risky rule content is processed: safe mode uses the RE2 regex engine, disables template variable expansion, and blocks external rule sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ The regex engine can be overridden independently of policy with --regex-engine re2 or --regex-engine python; template variable expansion can be re-enabled with --enable-template-vars (emits a security warning); and external rule sources can be explicitly permitted with --allow-external-sources. Because safe is now the default, existing scripts relying on Python-native regex, template variables, or external sources will break unless --policy trusted or the relevant individual flags are added.

$ sigma convert -t splunk -p sysmon --policy safe sigma/rules/windows/process_creation

$ sigma convert -t splunk -p sysmon --policy trusted --enable-template-vars sigma/rules/windows/

$ sigma check --policy safe --allow-external-sources sigma/rules/windows/process_creation/

Self-hosted deployments can cap how many tool calls the LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. makes in a single turn using the RUNZERO_LLM_MAX_TOOL_CALLS_PER_TURN and RUNZERO_LLM_MAX_TOOL_CALLS_PER_DEEP_TURN environment variables (defaults: 8 and 20), and per-account or per-organization limits can also be set through the AI configuration pages or the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ RUNZERO_LLM_MAX_TOOL_CALLS_PER_TURN=4 RUNZERO_LLM_MAX_TOOL_CALLS_PER_DEEP_TURN=10 ./runzero-console

The GET /api/v1.0/account/sites, GET /api/v1.0/account/orgs, and GET /api/v1.0/account/credentials APIs now return a 422 error naming the problem when a search cannot be parsed, rather than returning every record.

The search operator across the asset, service, software, and vulnerability inventories is now case-insensitive; exact-match searches like domain:=corp.example.com now find assets that have that domain among others; and product:= and domain:= now match assets with no products or no domains.

Alert channel searches using settings:, notification_count:, and user_email: now work; settings: matches a channel's email recipients and notification_count: accepts numeric comparisons such as notification_count:>5.

$ notification_count:>5

Search in scan templates and external reports now supports AND, OR, and NOT operators; in scan templates a plain word searches template names and descriptions, and an unsupported keyword is reported as an error.

Adds a BYPASS_END_USER_AUTH property to the Windows MSI built by fleetctl package, letting admins skip end-user authentication at install time with msiexec /i fleetd-base.msi BYPASS_END_USER_AUTH=true instead of baking in --bypass-end-user-auth; requires fleetd v1.60.0 or higher.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds configurable retention and cleanup to keep data from growing unbound: Windows MDM command-history retention via mdm.windows_command_retention (env FLEET_MDM_WINDOWS_COMMAND_RETENTION, default 30 days, 0 disables cleanup), deleted-host certificate retention via server.deleted_host_certificates_retention (default 30 days), and a new hourly cleanup job for completed Apple MDM commands.

mdm:
  windows_command_retention: 720h

Admins can upload a Markdown EULA file up to 512 KB in Settings > Integrations > MDM > End user license agreement, or set windows_eula in GitOps YAML; Fleet renders it as the terms page during Microsoft Entra and Autopilot enrollment.

Adds name and description fields to configuration profiles, settable via the UI, the API, or GitOps YAML, deprecating display_name on the batch configuration profiles endpoint in favor of name. Also adds a dedicated page for adding and editing configuration profiles — replacing the add and edit modals — with support for upload, paste, and inline editing.

New mdm.windows_one_time_enroll_secrets server setting sends each Windows MDM host a per-device, single-use enroll secret instead of the shared global secret; once enabled, a shared enroll secret can no longer enroll fleetd as a host enrolled in Fleet Windows MDM.

mdm:
  windows_one_time_enroll_secrets: true

New experimental websocket.orbit_config_enabled setting (requires websocket.transport_enabled) pushes orbit-config change notifications over WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. instead of polling every 30 seconds, with websocket.orbit_config_poll_interval (default 5 minutes) and websocket.orbit_config_spread (default 30 seconds) controlling fallback polling.

OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. HTTP server metrics for gorilla-routed requests now use stable semantic conventions: http.server.request.duration (seconds) replaces http.server.duration (milliseconds), and http.server.request.body.size / http.server.response.body.size replace http.server.request.size / http.server.response.size; custom dashboards built on the old metric names require updating.

Admins can rotate a macOS host's FileVault recovery key on demand via API without waiting for the next scheduled escrow, e.g. POST /api/v1/fleet/hosts/{id}/encryption_key/rotate.

$ curl -X POST https://fleet.example.com/api/v1/fleet/hosts/42/encryption_key/rotate \
  -H 'Authorization: Bearer <token>'

Adds a Types filter via source and extension_for query parameters to the list software titles, list software versions, get host's software, and get device's software endpoints.

Adds version as a valid order_key for GET /api/v1/fleet/os_versions, sorting by numeric version segment rather than lexical string order.

Adds path/paths file-reference support to software.fleet_maintained_apps and software.app_store_apps in GitOps YAML, matching existing support for policies, labels, reports, and software.packages.

Remote Shell gives a root command line on a managed Mac, reachable directly from a detection or the device record in the Iru console.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ It stays connected while a Mac is in Partial Isolation, allowing a threat to be contained and investigated at the same time.

⤢

The MCP Identity Gateway now exposes its version via the aembit_gateway_version field in the protected resource metadata document, which can be read without an access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

MCP Identity Gateway now applies a new credential on the user's very next request after an MCP User-Based Access Token Credential Provider authorization, instead of returning errors until the cached credential expired.

Aembit adds AEMBIT_NETWORK_ACCESS_POLICY to control which MCP servers a self-hosted MCP Identity Gateway can reach.

MCP Identity Gateway now sends tool-argument request headers to MCP clients on earlier specification revisions when connecting to MCP servers on the 2026-07-28 MCP specification.