The Cyber Toolchain — issue 014, July 13, 2026

Snyk Code adds 6 new C++ rules, broader C++ native detection, expanded Java library coverage, and a JS/TS Insecure Transmission rule.

11 details in Everything

Snyk Learn adds three new AI security lessons on agentic RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., memory poisoning, and inter-agent communication.

4 details in Everything

Snyk now auto-closes stale Open Source Fix PRs by default, with a configurable daily closure limit.

3 details in Everything

Snyk API & Web now supports Bruno collections natively, enabling direct import to create API Targets.

Openlayer adds Snowflake integration, new security role, prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. tests, and expanded LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. tracing for Bedrock, OpenAI Agents, Pydantic AI, and LangGraph.

⤢

17 details in Everything

Openlayer adds custom metrics via openlayer.json, rotating API keys, and 11 new models for direct-to-API evaluation calls.

⤢

{
  "metrics": [
    {
      "name": "toxicity_score",
      "description": "Custom toxicity scorer for our domain",
      "type": "custom",
      "script": "metrics/toxicity.py"
    }
  ]
}

6 details in Everything

Openlayer adds request annotations, human feedback ratings, data export, and Git integration to LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. quality control.

⤢

9 details in Everything

Openlayer adds SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties., Azure OpenAI evaluator, Ragas metrics, and an overhauled test diagnosis page.

⤢

9 details in Everything

Openlayer adds Governance mode, A/B testing, new data backends, CLI data sources, and expanded tracing support.

⤢

17 details in Everything

Openlayer adds a managed AI gateway, customizable dashboards, Salesforce Agentforce GA, Helm on-prem, new guardrails, governance frameworks, and audit trails.

⤢ ⤢ ⤢

$ curl -X DELETE https://api.openlayer.com/v1/monitoring/records \
  -H 'Authorization: Bearer <your-api-key>' \
  -H 'Content-Type: application/json' \
  -d '{"recordIds": ["<record-id-1>", "<record-id-2>"]}'

$ helm install openlayer oci://registry-1.docker.io/openlayer/openlayer \
  --set storage.type=s3 \
  --set database.url=<your-db-url> \
  --set replicaCount=3 \
  --set image.pullSecrets[0]=<pull-secret> \
  --set node.heapSize=4096

35 details in Everything

Openlayer adds Google ADKADKGoogle's Agent Development Kit, an open-source framework for building and orchestrating AI agents; cyber tools use it to compose multi-agent workflows with built-in tool-calling and state management. integration, Snowflake remote execution, pausing tests, duplicate-key checks, and cloud marketplace availability.

⤢

13 details in Everything

Openlayer adds project-level secrets, OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. tracing, Azure OpenAI for evals, and new platform APIs.

⤢

11 details in Everything

Openlayer adds SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. directory sync, Cohere/Vertex AI LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-as-a-judge models, new RAGRAGRetrieval-augmented generation: looking up relevant documents and adding them to the prompt before the model answers. It grounds responses in private or current data without retraining. metrics, Viewer role, and expanded APIs.

⤢

$ curl -X GET 'https://api.openlayer.com/v1/inference-pipelines/<id>?expand=project,workspace' \
  -H 'Authorization: Bearer <token>'

$ curl -X GET 'https://api.openlayer.com/v1/projects/<project-id>/versions/<version-id>' \
  -H 'Authorization: Bearer <token>'

13 details in Everything

Openlayer adds MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., multimodalmultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. traces, directory sync, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. integration, and expanded API/CLI controls for AI governance.

⤢

$ openlayer metrics run -force

22 details in Everything

Openlayer adds user/session tracking, test tags, LiteLLM support, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. redaction guardrails, and multi-agent LangGraph workflows.

⤢

$ export AWS_SIGNATURE_VERSION=v4

13 details in Everything

Openlayer adds test bundles (EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe., OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against., agentic), new LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. tests, and expanded Python runtime support.

⤢

7 details in Everything

Openlayer adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, automatic thresholds, BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. integration, anomaly detection, and project-level access groups.

⤢

26 details in Everything

Openlayer adds Gantt trace timelines, Claude Agent SDK tracing, auto-instrumentation, and Gateway guardrails enforcement.

⤢ ⤢

import openlayer
openlayer.init(api_key="<your-api-key>", project_name="<project-name>")
# All installed supported SDKs (OpenAI, Anthropic, Mistral, Groq, Gemini, LiteLLM, Portkey, Google ADK, Azure) are now patched automatically.

import openlayer
openlayer.init(api_key="<your-api-key>", project_name="<project-name>", auto_instrument=False)

import openlayer
import anthropic

openlayer.init(api_key="<your-api-key>", project_name="<project-name>")
# The Claude Agent SDK is now instrumented: tool calls, MCP tools, subagents,
# session continuity, and cost/tokens will appear in Openlayer traces.

14 details in Everything

Harden Runner adds egress block mode for macOS/Windows, Bitrise support, and Bun HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. monitoring.

- uses: step-security/harden-runner@v2.20.0
  with:
    egress-policy: block
    allowed-endpoints: >
      api.nuget.org:443
      github.com:443

4 details in Everything

Harden-Runner adds Secret Exfiltration Attempt detection to catch toJSON(secrets) supply-chain attacks in real time.

4 details in Everything

StepSecurity Maintained Actions — secure drop-in replacements for 500+ GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. — are now free for public repositories.

ARC Harden Runner v2.18.3 adds broker pod customization fields and Cosign keyless image signing.

$ cosign verify ghcr.io/step-security/arc-harden-runner/arc-harden-runner:v2.18.3 \
  --certificate-identity-regexp 'https://github.com/step-security/arc-harden-runner/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

$ cosign verify ghcr.io/step-security/broker/broker:v1.3.0 \
  --certificate-identity-regexp 'https://github.com/step-security/broker/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

2 details in Everything

Secure Registry gains source attribution, typosquattingtyposquattingUsing a name close to a trusted domain or software package to catch spelling mistakes. Attackers use it to lure people or installers to a malicious lookalike. blocking, and Sonatype Nexus Repository support.

4 details in Everything

StepSecurity adds Maven (Java) ecosystem support to GitHub Checks PR controls and OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. Package Search.

3 details in Everything

GitHub Workflow Integration v2.0.0 adds platform-based install, scan scheduling, and Apex/VB6/Perl autopackaging support.

# In veracode.yml
debug: true

# In veracode.yml
analysis_branch: main-security-baseline

18 details in Everything

Veracode adds six new built-in policies, OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against./CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. 2025 auto-updates, OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. credentials UI, CMEK, and expanded Reporting API filters.

$ curl -s 'https://api.veracode.com/api/authn/v2/principal' \
  -H 'Authorization: Bearer <token>'

22 details in Everything

Veracode DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. adds Directory Restrictions, enhanced scheduling with breaking API changes, and open-port scanning with new detections.

5 details in Everything

Veracode SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. June 2026 engine adds Dart 3.12/Flutter 3.44 and Kotlin 2.4 support, plus new CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. detections across multiple languages.

9 details in Everything

Cloudsmith API keys are now automatically detected by GitHub secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. to prevent unauthorized use.

Cloudsmith now supports PEP-658, letting Python clients fetch package metadata without downloading full wheels.

Cloudsmith cooldown policies now extend supply-chain protection to Go packages.

1 detail in Everything

Cloudsmith now manages Docker Hub and DHI upstream auth automatically, raising rate limits without user-supplied credentials.

3 details in Everything

Cloudsmith now supports attaching custom key-value metadata to packages for CI, provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., compliance, and cost attribution.

Cloudsmith vulnerability detection now matches OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. advisories using ecosystem-native version ranges for Debian, Alpine, PyPI, and more.

Cloudsmith's Terraform provider v0.0.75 adds full lifecycle management of policies and policy actions as code.

Cloudsmith adds two new events that automatically trigger policy evaluations across repositories.

1 detail in Everything

Cloudsmith Terraform provider gains a new resource to define and manage connected repositories as code.

resource "cloudsmith_connected_repository" "example" {
  # configuration fields here
}

1 detail in Everything

Socket adds opt-in AI-generated reachability specs to expand vulnerability reachability coverage beyond human-verified rules.

⤢

2 details in Everything

Socket's organization switcher now surfaces Settings and orgs upfront, with a searchable All Organizations view.

2 details in Everything

Socket CSV exports now include a human-readable Alert Title column and more consistent Upgrade Version values.

2 details in Everything

Socket Firewall now supports exporting event logs to external data sources via the new Data Export integration.

GitGuardian's ServiceNow integration gains Public Monitoring, Honeytoken support, and granular event subscription filters.

$ curl -s -H 'Authorization: Token <your_api_token>' 'https://api.gitguardian.com/v1/incidents/<incident_id>/activity' | jq .

8 details in Everything

Smart Notifiers lets GitGuardian alert only on incidents that match severity, ML risk, validity, or secret type — no middleware needed.

11 details in Everything

Enterprise Bot Management gains BotBase bot directory and Attribution Business Insights crawl-to-referral dashboard.

⤢

4 details in Everything

Cloudflare now lets all plans block AI crawlers by behavior — Search, Agent, or Training — independently per page type.

⤢

4 details in Everything

WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. adds FortiSandbox path traversal detection (CVE-2026-39813) and disables Fake Bing/MSN Bot rule.

2 details in Everything

New managed rule blocks CVE-2026-10520 pre-auth OS command injectionOS command injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. in Ivanti Sentry.

WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. custom rules can now match Cloudforce One threat intelligence fields to block IPs flagged for recent attack activity.

$ any(cf.intel.ip.target_countries[*] == "FR") and any(cf.intel.ip.datasets[*] == "ddos")

5 details in Everything

WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. adds Ghost CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly. blind SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. detection (CVE-2026-26980) and a new generic obfuscated boolean SQLi bypass rule.

2 details in Everything

DataDome iOS SDK for Apollo 4.0.0 adds support for Apollo v2.

1 detail in Everything

Timesketch 20260617 enforces cross-sketch ownership on event fact conclusions via the API.

$ git clone --branch 20260617 https://github.com/google/timesketch.git
# already have the repo? check out this version:
$ git checkout 20260617

Elcomsoft Phone Breaker 11.2 adds support for downloading iCloud backups from iOS/iPadOS 26 and iOS 27 beta.

2 details in Everything

GuardDog v3 adds kernel-level sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls., S3 scanning, risk-based scoring engine, and removes legacy CLI commands.

$ git clone --branch v3.0.0 https://github.com/DataDog/guarddog.git
# already have the repo? check out this version:
$ git checkout v3.0.0

$ guarddog pypi scan requests
guarddog pypi scan /tmp/suspicious.tar.gz --no-sandbox

$ guarddog npm scan s3://my-bucket/path/to/package/
guarddog pypi scan s3://my-bucket/path/to/package.tar.gz

$ guarddog pypi scan /tmp/triage.tar.gz --metadata /tmp/triage-metadata.json --output-format json

6 details in Everything

GuardDog v3.0.0a2 adds encrypted ZIP scanning, S3/remote archive support, and removes legacy top-level commands.

$ git clone --branch v3.0.0a2 https://github.com/DataDog/guarddog.git
# already have the repo? check out this version:
$ git checkout v3.0.0a2

$ guarddog npm scan https://github.com/DataDog/malicious-software-packages-dataset/raw/refs/heads/main/samples/pypi/compromised_lib/mistralai/2.4.6/2026-05-12-mistralai-v2.4.6.zip --zip-password infected

$ echo 'mypassword' | guarddog pypi scan /tmp/suspicious_package.whl --zip-password -

3 details in Everything

CHIPSEC 2.0.5 adds Intel 440FX (QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware.) config, Meteor Lake DIDs, and expanded cfg_checker validation.

$ git clone --branch 2.0.5 https://github.com/chipsec/chipsec.git
# already have the repo? check out this version:
$ git checkout 2.0.5

4 details in Everything

Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. agent 4.80.1 improves CMDEXE, path traversal, and XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. detection with refreshed GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. data.

4 details in Everything

Fastly adds 16 backend Compute error metrics to Historical Stats and Real-Time Analytics APIs for root-cause troubleshooting.

$ curl -s -H 'Fastly-Key: <FASTLY_API_TOKEN>' 'https://rt.fastly.com/v1/channel/<SERVICE_ID>/ts/h'

Fastly adds Event Mappings API to control which audit events trigger notifications per service or workspace.

$ curl -X GET https://api.fastly.com/notifications/event-types \
  -H 'Fastly-Key: <FASTLY_API_TOKEN>' \
  -H 'Accept: application/json'

$ curl -X GET https://api.fastly.com/notifications/scope-types \
  -H 'Fastly-Key: <FASTLY_API_TOKEN>' \
  -H 'Accept: application/json'

4 details in Everything

Fastly adds Routing Configurations API to route traffic by URL path/condition, with Domain API support for multi-domain rule binding.

2 details in Everything

Fastly accounts can now be linked to an existing Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. corp for unified control panel and API access.

2 details in Everything

Fastly Notifications API adds Datadog, Jira, OpsGenie, and Splunk On-Call as integration targets.

2 details in Everything

Fastly CLI v15.3.0 adds prefix-based bulk KV store deletion and contentguard bot management support.

$ fastly kvstore-entry delete --store-id <store-id> --key-prefix <prefix>

2 details in Everything

Fastly control panel now shows account-level request visibility across all workspaces on the Requests page.

Fastly Go SDK 1.8.0 adds bot detection, VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection./proxy detection, stale-if-error caching, and richer KV store controls.

6 details in Everything

Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. adds account-level requests endpoint to search across all workspaces in one call.

$ curl -X GET 'https://api.fastly.com/ngwaf/v1/requests?q=ip:203.0.113.42' \
  -H 'Fastly-Key: <your-api-token>' \
  -H 'Accept: application/json'

1 detail in Everything

Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. Simulate API gains detector_scope field per signal and doubles request body size limit to 200 KB.

$ curl -s -X POST 'https://dashboard.signalsciences.net/api/v0/corps/<corp_name>/sites/<site_name>/simulate' \
  -H 'x-api-user: <email>' \
  -H 'x-api-token: <token>' \
  -H 'Content-Type: application/json' \
  -d @reconstructed_request.json \
  | jq '.signals[] | {signal: .type, scope: .detector_scope}'

2 details in Everything

Fastly Terraform Provider 9.3.0 adds DNS Zones, TSIGTSIGA DNS authentication mechanism defined in RFC 2845 that uses shared secret keys and HMAC to sign DNS messages, letting resolvers and servers verify that updates or zone transfers come from a trusted peer. Keys, and an immediate-block NGWAFNGWAFA next-generation web application firewall that inspects HTTP traffic at the application layer, using behavioral analysis and contextual rules rather than pure signature matching to block attacks like SQLi and XSS. threshold action.

resource "fastly_ngwaf_threshold" "example" {
  # ... existing threshold config ...
  action = "block_immediately"
}

2 details in Everything

Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. adds block_immediately threshold action to unconditionally block high-risk signals without a rate window.

Fastly JS SDK 3.43.0 adds stale-if-error support for resilient cache serving during origin failures.

1 detail in Everything

Rust SDK 0.13.0 adds stale-if-error guest caching, async request handoff, and modern Rust lock primitives.

request.set_stale_if_error(Duration::from_secs(60));
let response = match request.send("my_backend") {
    Ok(resp) => resp,
    // SDK automatically substitutes cached stale-if-error response here
    Err(e) => return Err(e),
};

request.set_stale_if_error(Duration::ZERO);

let pending = request.send_async("my_backend")?;
pending.send_to_client();

7 details in Everything

FortiCNAPP adds AI-generated incident reports, FortiGuard IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. feeds, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Skills Scanner, EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves./GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. low-latency audit alerting, and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. for Windows across recent releases.

$ curl -X POST 'https://<instance>.lacework.net/api/v2/AiAssistants' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"type": "AlertContext", "alertId": "<alert_id>"}'

43 details in Everything

Aikido adds Kubernetes real-time image scanning, Eclipse IDE plugin, AI pentest preview, and dependency upgrade breaking-change analysis.

24 details in Everything

Aikido adds continuous pentesting, VM reachability diagrams, full IDE workspace scanning, and expanded integrations.

13 details in Everything

Aikido adds conversational AutoFix refinement, Pentest Threat Model, Alibaba Cloud support, and new APIs in release #44.

14 details in Everything

Aikido adds Lovable pentesting integration, container network reachability, new APIs, and expanded Zen Firewall agent support.

10 details in Everything

Aikido adds AI pentest escalation, AutoTriage custom context, cloud reachability for GCP, and new Zen firewall agents.

14 details in Everything

Aikido adds Device Protection for blocking malicious packages on developer machines, AI Chat in AutoFix, and new API endpoints.

$ # Place a .aikido file at the root of your repository with custom context
echo 'We use our internal wrapper `safe_query()` instead of raw DB calls.' > .aikido

10 details in Everything

Aikido adds AI code auditing, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. integration, ServiceNow ticketing, Oracle/Alibaba cloud support, and Zen Firewall agent expansion.

16 details in Everything

Aikido #49 adds threat model diagrams, Windows device protection, repo/container labels, and a wave of new API endpoints.

12 details in Everything

Aikido adds agentic dependency AutoFix, a registry proxy for malware blocking, and Ruby/Rust device protection.

13 details in Everything

Aikido launches Code Audit: agentic pentest-grade source code reasoning that finds logic flaws without a live environment.

5 details in Everything

Aikido adds LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-powered AutoTriage for secrets and CVEs to cut noise and automate prioritization decisions.

4 details in Everything

Aikido launches Device Protection: real-time malware blocking, extension governance, and group-based policies for developer devices.

5 details in Everything

Registry Scanner v0.12.0 adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. image format and multi-architecture bundle scanning across all supported registries.

5 details in Everything

Host Scanner adds Google COS/GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. node vulnerability coverage and improved Ruby gem file-level attribution.

2 details in Everything

Sysdig CLI Scanner v1.27.2 adds detection support for Google Container-Optimized OS (COS) packages.

Sysdig Secure refreshes the Threats UI with bulk actions and resource focus, and adds Azure Monitor Logs Ingestion API for Sentinel.

4 details in Everything

Sysdig Secure adds end-of-life visibility and policy enforcement for OS and Go runtime components in Vulnerability Management.

$ sysdig-cli-scanner <image> --json-scan-result result.json && jq '.info.resultDetails.packages[] | select(.lifecycle.status == "end-of-life")' result.json

5 details in Everything

Sysdig Secure adds Response Actions directly in the resource drawer for hosts, Kubernetes workloads, and AWS resources.

5 details in Everything

Sysdig CLI Scanner v1.27.0 adds Flashpoint KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. tag and Flashpoint CVSSv3 Temporal score to vulnerability output.

2 details in Everything

Sysdig Secure adds Response History page for auditing all Response Actions across events, automations, and APIs.

2 details in Everything

nono v0.66.0 adds HTTP/2 proxy support, a @git:common-dir dynamic token, and a simplified self-invocation policy for tool sandboxes.

$ git clone --branch v0.66.0 https://github.com/nolabs-ai/nono.git
# already have the repo? check out this version:
$ git checkout v0.66.0

$ nono run --profile always-further/opencode --allow-http2 -- opencode

3 details in Everything

nono v0.65.0 introduces tool sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls., giving delegated tools their own isolated child sandboxes with separate filesystem, network, and credential policies.

$ git clone --branch v0.65.0 https://github.com/nolabs-ai/nono.git
# already have the repo? check out this version:
$ git checkout v0.65.0

$ nono run --profile opencode -- opencode

$ nono why --profile gh --command gh -- issue comment 1052

{
  "command_policies": {
    "credentials": {
      "github-api": {
        "type": "proxy",
        "upstream": "https://api.github.com",
        "credential_key": "keyring://gh:github.com/example?decode=go-keyring",
        "env_var": "GH_TOKEN",
        "inject_header": "Authorization",
        "credential_format": "Bearer {}"
      }
    },
    "commands": {
      "gh": {
        "from": {
          "session": {
            "sandbox": {
              "fs_read": ["."],
              "credentials": [
                {
                  "name": "github-api",
                  "endpoint_policy": {
                    "default": "deny",
                    "allow": [
                      { "method": "GET", "path": "/repos/nolabs-ai/nono/issues/**" }
                    ]
                  }
                }
              ]
            },
            "invocation_policy": {
              "default": "deny",
              "allow": [
                { "argv": { "prefix": ["issue", "list"] } },
                { "argv": { "prefix": ["issue", "view"] } }
              ]
            }
          }
        }
      }
    }
  }
}

3 details in Everything

nono v0.64.0 adds AWS auth config, structured diagnostics JSON output, CI environment detection, and macOS blocked-grants visibility.

$ git clone --branch v0.64.0 https://github.com/nolabs-ai/nono.git
# already have the repo? check out this version:
$ git checkout v0.64.0

$ nono run --profile always-further/opencode --diagnostics-json -- opencode 2>session-diagnostics.json

5 details in Everything

nono v0.63.0 adds static env injection, keyring timeout control, $PACK_DIR in session hooks, and XDGXDGA set of specifications maintained by freedesktop.org that standardise where Linux applications store config, data, and cache files, letting tools respect user-defined paths instead of hardcoding locations. state dir support.

$ git clone --branch v0.63.0 https://github.com/nolabs-ai/nono.git
# already have the repo? check out this version:
$ git checkout v0.63.0

$ nono run --profile always-further/opencode -- opencode

$ NONO_KEYRING_TIMEOUT_SECS=5 nono run --profile always-further/opencode -- opencode

4 details in Everything

OpenShell v0.0.75 adds TLS termination for Envoy Gateway ingress and a new manifest-driven gator agent.

$ git clone --branch v0.0.75 https://github.com/NVIDIA/OpenShell.git
# already have the repo? check out this version:
$ git checkout v0.0.75

2 details in Everything

OpenShell v0.0.74 adds a combined topology config surface for Kubernetes deployments.

$ git clone --branch v0.0.74 https://github.com/NVIDIA/OpenShell.git
# already have the repo? check out this version:
$ git checkout v0.0.74

2 details in Everything

OpenShell v0.0.72 adds AWS SigV4SigV4AWS's request-signing protocol that authenticates HTTP calls by hashing the request body, headers, and credentials into a signature; cyber tools use it to talk to AWS APIs without embedding long-lived secrets. proxy signing, JSON-RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets./MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. policy enforcement, and Kubernetes agent-sandbox v1beta1 support.

$ git clone --branch v0.0.72 https://github.com/NVIDIA/OpenShell.git
# already have the repo? check out this version:
$ git checkout v0.0.72

3 details in Everything

Sumo Logic monitor email notifications can now embed the triggering search query and result set inline.

{
  "notifications": [
    {
      "notification": {
        "connectionType": "Email",
        "recipients": ["soc-team@example.com"],
        "subject": "Monitor Alert: {{Name}}",
        "includeQuery": true,
        "includeResultSet": true
      },
      "runForTriggerTypes": ["Critical", "ResolvedCritical"]
    }
  ]
}

1 detail in Everything

Sumo Logic adds Notification Settings Standards policy to control timestamp format (Legacy or ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability.) in alert payloads.

1 detail in Everything

Sumo Logic Dashboards now lets you copy any panel to another dashboard without rebuilding the query.

1 detail in Everything

Sumo Logic's Go To search bar now surfaces Library content, Monitors, and SLOs alongside navigation pages.

4 details in Everything

Sumo Logic Dashboards now show scan estimates at both dashboard and section levels for clearer cost/data visibility.

2 details in Everything

Sumo Logic Next-Gen apps now support email notifications for future app upgrades, with self-service subscribe/unsubscribe.

3 details in Everything

New Sumo Logic users and orgs now onboard directly into the New UI by default.

1 detail in Everything

Sumo Logic adds Amazon Overview app, Next-Gen app migrations, and hashing support in 14 updated Source Templates.

7 details in Everything

Sumo Logic unifies Threat Intelligence source configuration and indicator uploads into a single Data Management hub.

4 details in Everything

MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions. admins can now opt child orgs in/out of Sumo Logic features directly from the Organizations UI.

Sumo Logic launches a new service region in AWS European Sovereign Cloud for strict EU data residency and compliance.

2 details in Everything

Google SecOps raises event rule limits and launches unified rules interface in public preview.

2 details in Everything

Google SecOps adds 15 new log types including MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., OT, and AI platform sources, plus updates 130+ default parsers.