The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
An advanced, yet simple, tunneling/pivoting tool that uses a TUN interface.
Ligolo-ng v0.9 adds faster UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. scanning via ICMP, configurable paths, in-flight TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. tuning, cert fingerprint verification, and ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. builds.
└──▷ GET THIS VERSION
$ git clone --branch v0.9 https://github.com/nicocha30/ligolo-ng.git
# already have the repo? check out this version:$ git checkout v0.9
Speeds up UDP port scanning by processing ICMP port-unreachable messages to immediately mark closed ports.
Adds configurable paths for the config file, session history, and self-signed certificates.
Supports configurable in-flight TCP connection limits for tuning tunnel throughput.
Enables bind certificate fingerprint verification to authenticate relay/proxy identity.
This is a multi-use bash script for Linux systems to audit wireless networks.
airgeddon v12.01 adds WPA3WPA3The third generation of the Wi-Fi Protected Access authentication and encryption standard, maintained by the Wi-Fi Alliance, offering stronger handshake protection and per-session encryption compared to WPA2. MFP analysis, dynamic WPA3 plugin menus, and band-aware WPS/Evil Twin controls.
└──▷ GET THIS VERSION
$ git clone --branch v12.01 https://github.com/v1s1t0r1sh3r3/airgeddon.git
# already have the repo? check out this version:$ git checkout v12.01
Adds WPA3 MFP (Management Frame Protection) status analysis feature for targeted WPA3 assessments.
Adds dynamic WPA3 plugin menu options without fixed slots, enabling flexible plugin-driven WPA3 attack workflows.
Displays band data (2.4 GHz / 5 GHz / 6 GHz) in Evil Twin and WEP control windows, WPS attack screens, and trophy files for clearer session context.
Improves interrupt handling so Ctrl+C or closing a worker window aborts immediately without waiting for timeouts.
Promptfoo is an open-source tool for testing, evaluating, and red-teaming LLM applications to detect vulnerabilities, compare outputs, and ensure AI reliability.
└──▷ TRY IT
Run a red team scan with a description and capped test cases per strategy to keep CI runtimes predictable.
Lakera Guard is an AI security platform that protects LLM-powered applications from prompt injections, jailbreaks, and other malicious inputs in real time.
Lakera adds AI Agent Security (Early Access), Policy Impact Simulator, per-detector confidence levels, and a self-harm subcategory to content moderation.
└──▷ HOW TO FIND IT
Before tightening a policy, use the Policy Impact Simulator to preview how many historical requests would have been flagged at each sensitivity level.
📍In the dashboard, navigate to Policies › select a policy › Policy Impact Simulator. Adjust the sensitivity slider across L1–L4 and review the flagging-rate and category-level breakdown charts before saving.
Cover agentic pipelines by sending tool-role messages so Lakera evaluates content produced by tool calls, not just end-user turns.
New result field in Guard API breakdown responses exposes per-detector confidence levels (l1_confident through l5_unlikely), matching the granularity already available in /guard/results.
New self-harm sub-category added to the content moderator detector.
New product: AI Agent Security (Early Access) — discovers and inventories agents, their tools, and connected MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers across Amazon Bedrock, Amazon Bedrock AgentCore, Google Cloud, Microsoft Copilot Studio, Salesforce Agentforce, n8n, and Relevance AI.
AI Agent Security provides per-agent risk ratings (Critical / High / Medium / Low) with contributing factors, plus a risk-types view mapped to OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. and MITRE ATLASMITRE ATLASA MITRE-maintained knowledge base of adversarial tactics and techniques targeting AI and machine learning systems, modelled on ATT&CK, giving cyber tools a structured taxonomy for AI-specific threat modelling..
New Policy Impact Simulator on the dashboard shows how different sensitivity levels and guardrail configurations would have affected historical traffic, with flagging-rate comparisons across L1–L4 and category-level breakdowns.
+8 moreshow less
Audio requests now expose an audio_payload flag in the Guard API request for access to debugging information of the audio sample.
Gateway now logs requests to v2/guard/audio for monitoring purposes.
TensorRT-LLMTensorRT-LLMNVIDIA's inference optimizer and runtime, which compiles a model into a version tuned for a specific GPU. TensorRT-LLM is its library for serving large language models. audio processing gains denoising support.
Added support for developer and tool roles in API messages to cover agentic and tool-using use cases.
Guardrails overview table gains filtering functionality and a new Policies column; guardrail detail pages now show creator, last edited by/at, and Policies assigned fields.
Logs page adds a Link button for shareable navigation with or without current filters.
Misclassification submissions now support bulk operations across multiple logs.
Policy advanced settings redesigned with dedicated sections for Content Moderation, Data Leakage Prevention, Prompt Defense, and Unknown Links.
Veracode is a cloud-based application security platform that scans code for vulnerabilities, helping developers identify and fix security flaws across the software development lifecycle.
Veracode adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. credentials UI, new Reporting API filters, CMEK encryption, and Firewall Analytics in this release cycle.
└──▷ HOW TO FIND IT
Create and manage OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 Client credentials for automated integrations without using API key pairs.
📍In the Veracode Platform, go to your account menu › API Credentials, then select Create OAuth 2.0 Client Credentials and copy the generated client ID and secret for use in your integration.
Adds custom_severity filter to the Reporting API Findings report for targeted severity-based querying.
Adds six new built-in security policies to the Veracode Platform.
Policy Settings page now supports light and dark mode.
Reporting REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. now available in the European Region (Early Access).
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The /healthcheck/status endpoint has been removed and now returns a 404 error; use the v2/principal endpoint in the Identity REST API instead.
!Success events have been removed from the Firewall dataset in Veracode Analytics.
Snyk Open Source is a developer security tool that automatically finds, prioritizes, and fixes vulnerabilities in open source dependencies within your projects.
Snyk Open Source adds uv SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integration for Python and GA support for Go private dependency scanning.
└──▷ HOW TO FIND IT
Enable uv SCM support so Python teams can import uv projects and trigger PR Checks without needing the CLI.
📍In the Snyk console, go to Settings › Snyk Preview for your Group or Organization and enable the uv SCM integration feature.
Supports uv package manager in SCM integrations, enabling import of uv projects and workspaces, PR Checks, and monitoring directly from connected Git repositories — no CLI required.
Enables Go scanning for private dependencies via private module proxies (Artifactory, Nexus) and private repositories via Broker, now generally available across all SCM integrations.
Cloudflare is a cloud platform that provides website security, performance optimization, and DDoS protection by routing traffic through its global network.
1.1.1.1 now emits EDE 33 (Negative Trust Anchor) on responses served under an NTA, making DNSSECDNSSECA set of DNS extensions, maintained by the IETF, that add cryptographic signatures to DNS records so resolvers can verify responses have not been tampered with in transit. bypass visible to clients.
└──▷ TRY IT
Detect whether a response from 1.1.1.1 was served under a Negative Trust Anchor — useful in monitoring scripts or incident triage when a TLDTLDThe rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type.-level DNSSEC rollover is suspected.
$ kdig @1.1.1.1 google.al
Adds EDE code 33 (Negative Trust Anchor) to all responses served while an NTA is active, signalling that DNSSEC validation was bypassed rather than silently returning an unverified answer.
Surfaces EDE 9 (DNSKEY Missing) alongside EDE 33 during NTA incidents, giving operators and monitoring tools full visibility into both the underlying DNSSEC failure and the resolver's mitigation.
2 details in Everything
4 more releases in this issue
· 2026-07-13 → 2026-07-14
Cloudflare WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. adds new managed rules blocking critical RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. and memory disclosure CVEs in Citrix NetScaler and Progress Kemp LoadMaster.
New managed rule blocks unauthenticated memory disclosure (CVE-2026-8451) targeting Citrix NetScaler ADC and Gateway appliances configured as SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. IdPs.
New managed rule blocks unauthenticated remote code executionremote code executionRemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. (CVE-2026-8037) via OS command injectionOS command injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. in Progress Kemp LoadMaster load balancers.
Cloudflare WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. adds 8 new detections covering SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly., LFI, Adobe ColdFusion CVEs, and JS bracket-concat XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. obfuscation.
New detection: SSRF - Restricted Protocol (rule 7fbdc9407bdb4a4eae2b3d91215e7d31), deploying in Log mode on 2026-07-20.
New detection: SSRF - Obfuscated Host (rule 6ca512d240d848d6a0c7ef42a935ee5d), deploying in Log mode on 2026-07-20.
New detection: LFI - Path Traversal (rule a3fb0870c38440d8a9a0eba81b0230ac), deploying in Log mode on 2026-07-20.
New detection: Adobe ColdFusion File Upload Path Traversal (CVE-2026-48276, rule 452a04be3f73458c863d8dae61349c8b), deploying in Log mode on 2026-07-20.
New detection: Adobe ColdFusion Path Traversal (CVE-2026-48282, rule a53a3fb491c64d74908081ee9cb61eac), deploying in Log mode on 2026-07-20.
+1 moreshow less
New detections for XSS via JavaScript bracket-concatenation obfuscation across three inspection surfaces: request body (rule d8b63828c2344d919b94d2594ac5e21f), headers (rule 264a83a764be428ca41d516ff31f5559), and URI (rule 4ba21a60837244029183b782987984fd), all deploying in Log mode on 2026-07-20.
Cloudflare launches Precursor: continuous client-side behavioral signals that extend bot detection across entire user sessions.
└──▷ HOW TO FIND IT
Enable Precursor on a zone to start collecting continuous session-level behavioral signals and feeding them into your existing bot defenses.
📍In the Cloudflare dashboard, go to your zone › Security › Bots, find the Precursor section, toggle Precursor on, and select a verification mode (low-friction background observation or enforced Challenge for unverified sessions).
After enabling Precursor, investigate sessions showing signs of sustained automation — especially behavior occurring between individual requests.
📍In the Cloudflare dashboard, go to Security › Security Analytics, then switch to the session-based view to filter bot management traffic by session-level signals and identify divergent visitor journeys.
Introduces Precursor, a session-based client-side verification system that dynamically injects JavaScript into HTML responses to continuously collect behavioral signals (pointer movement, keyboard timing/rhythm, focus changes, visibility) across the full user journey — no application changes required.
Adds session-scoped behavioral evaluation that accumulates signal throughout a session, preventing bots from resetting their behavioral signature via page refresh or new challenge.
Detects automation patterns (linear mouse interpolation, inhuman click precision, missing physiological tremor, atypical timing) by cross-referencing multiple interaction streams in an edge-side evaluation layer with a roster of modular evaluators.
Feeds session-level behavioral signals directly into existing bot score, challenge decisions, and security rules — improving detection precision without adding friction for legitimate users.
Introduces session-based views in Security Analytics, enabling practitioners to analyze full visitor journeys, identify where sessions diverge from expected human behavior, and surface sessions showing sustained signs of automation.
+1 moreshow less
Privacy-preserving by design: keyboard activity is captured as timing and rhythm only (not keystrokes), signals are evaluated as aggregate patterns, and behavioral data is not exposed to customer dashboards or tied to user identities.
Invicti is an automated web application security scanner that identifies vulnerabilities like SQL injection and XSS to help organizations secure their web assets.
Invicti adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. sync, HashiCorp Vault integration, a new API scan profile, custom scan speed, and expanded API discovery.
└──▷ HOW TO FIND IT
Tune scan throughput for a sensitive target without triggering rate-limiting or WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. blocks.
📍In the scan configuration, open Scan Speed and select Custom, then set the number of concurrent requests and the request send frequency to values appropriate for your target environment.
New LDAP user synchronization: automates user provisioning from OpenLDAPOpenLDAPAn open-source implementation of the Lightweight Directory Access Protocol, maintained by the OpenLDAP Project, used to store and query structured identity data like users and groups over a network. or Microsoft Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. into Invicti Platform.
New HashiCorp Vault integration: Secrets Manager can now retrieve credentials directly from HashiCorp Vault for scan authentication.
New dedicated API scan profile applied by default to all new API targets for comprehensive API vulnerability coverage.
New Custom scan speed option lets you set the number of concurrent requests and send frequency for precise scan throughput control.
Sensorless API Discovery now reports APIs found on out-of-scope sites, expanding visibility of your full API surface.
+5 moreshow less
All scan profiles are now selectable for API targets — no longer locked to OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 API.
Client certificates can now be stored in Secrets Manager in base64 format.
Secrets configured for a target are now accessible inside the Login Sequence Recorder during session recording.
Vulnerability states (Ignored, False Positive) are now persisted and carried forward into subsequent DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans.
Severity filter in the Vulnerabilities page expanded view is now available when browsing by individual vulnerability.
Sublime Security is an email security platform that detects and blocks phishing, malware, and other email-based threats using customizable, rules-driven detection logic.
Sublime Security adds CrowdStrike Falcon Sandbox detonation for suspicious emails directly from the message detail view.
└──▷ HOW TO FIND IT
Connect your existing CrowdStrike Falcon Sandbox subscription so analysts can detonate suspicious emails without leaving Sublime.
📍In the Sublime console, go to Account → Sandbox Integrations and enter your CrowdStrike Falcon Sandbox API key to enable the integration.
Detonate a suspicious message and review the full Falcon verdict without downloading or manually handling the email file.
📍Open the suspicious message in the Message Detail View, click Send to CrowdStrike Sandbox, then view the verdict and behavioral report in the Sandbox Analysis section once detonation completes.
Adds one-click email detonation via CrowdStrike Falcon Sandbox from the message detail view — no manual file handling required.
New in-platform Sandbox Analysis section displays verdict (Malicious / Suspicious / Benign) and detonation environment, updating live without a page refresh.
One-click pivot opens the full Falcon detonation report — including behavioral indicators, network activity, dropped files, and IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. — in a new tab.
Smart deduplication returns existing Falcon analysis results instantly for previously seen samples, preserving sandbox quota.
Supports bring-your-own CrowdStrike Falcon Sandbox subscription; admins connect it once under Account → Sandbox Integrations.
Aikido Security is an all-in-one developer-focused security platform that scans code, dependencies, containers, and cloud infrastructure for vulnerabilities and misconfigurations.
Aikido #51 adds repository-wide code quality scans, an ignore approval inbox, AI-powered noise reduction for secrets & CVEs, and a wave of new integrations and APIs.
└──▷ HOW TO FIND IT
Trigger a full repository code quality scan to find hotspots across the entire codebase, not just open PRs.
📍In the Aikido console, go to Code Quality › Repository Scan (early access) and initiate a full codebase scan to view quality trends and refactoring hotspots.
Review and approve or reject team ignore requests before they take effect, maintaining admin control over noise suppression.
📍In the Aikido console, go to the Approval Inbox and review pending ignore requests submitted by team members before approving or rejecting each.
New Code Quality Repository Scan (early access): scan entire codebases for quality issues, monitor trends, and identify refactoring hotspots — not just PR-level checks.
New Approval Inbox for Ignores: routes every ignore request through a central inbox requiring admin sign-off before issues leave the feed.
New AI-powered Noise Reduction for Secrets & CVEs: analyzes each secret and CVE against actual code to surface only truly exploitable findings and suppress irrelevant ones.
New Dashboard available to all users.
Adds Azure DevOps Self-Managed Server support for source code scanning.
+14 moreshow less
Adds ticket integration support for GitHub Server and Azure DevOps Cloud.
Adds Render cloud misconfiguration scanning.
Adds Kubernetes namespace labels to container metadata.
Adds Terraform module for GCP project/organization onboarding.
Device Protection can now be temporarily disabled for up to 1 hour.
Adds Google Cloud Artifact Registry Proxy support.
Zen Firewall Node agent adds ElysiaJS framework support.
IDE extensions updated for VSCode and JetBrains, including new JetBrains CLion support.
New API endpoint to list snoozed and ignored issues from PRs.
New API endpoint to retrieve Device Protection SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
New API endpoint to get SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. settings.
New API endpoint for GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. reports.
New API endpoints to get, add, update, and remove container labels.
New API endpoint to list repository PR configuration.
Wiz is a cloud security platform that scans and protects cloud environments by identifying vulnerabilities, misconfigurations, and risks across an organization's entire cloud infrastructure.
Wiz adds detection and IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. for the @asyncapi npm supply chain compromise (M-RED-TEAM v6.4 malware).
Adds detection for five malicious @asyncapi npm package versions (@asyncapi/generator 3.3.1, @asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, @asyncapi/specs 6.11.2 and 6.11.2-alpha.1) tied to the July 14, 2026 supply chain attack.
Surfaces IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. coverage as a three-stage funnel metric (IaC-supportable → Tracked by IaC → Mapped to a declaration in code) within the Wiz platform to quantify how much cloud infrastructure is governed, traceable, and remediable via pull request.
Sysdig Secure is a cloud-native security platform that detects threats, enforces compliance, and protects containers, Kubernetes, and cloud infrastructure at runtime.
Sysdig Secure adds column customization for Vulnerability Management Findings reports.
└──▷ HOW TO FIND IT
Tailor a new Vulnerability Management Findings report to surface only the columns your team cares about, in the order that fits your workflow.
📍In the console, go to Vulnerabilities › Reporting, create a new report, and use the Column Customization option to select and reorder the columns to include.
Enables selection and reordering of columns in newly created Vulnerability Management Findings reports.
CLI to install, manage & troubleshoot Kubernetes clusters running Cilium
cilium-cli v0.19.6 adds table-json BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. output, hybrid routing mode support, Gateway API listenersets in sysdump, and TCPRoute/UDPRoute v1.
└──▷ GET THIS VERSION
$ git clone --branch v0.19.6 https://github.com/cilium/cilium-cli.git
# already have the repo? check out this version:$ git checkout v0.19.6
Adds table-json output format to cilium-dbg bgp peers and cilium-dbg bgp routes for machine-readable BGP state.
Includes Gateway API listenersets in cilium sysdump captures.
Supports hybrid routing mode (routing-mode: hybrid), dynamically choosing native routing for same-subnet traffic and tunnel encapsulation for cross-subnet traffic.
Upgrades TCPRoute and UDPRoute Gateway API resources to v1.
Bumps minimum supported Cilium version to v1.16.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The minimum compatible Cilium version is now v1.16; clusters running Cilium v1.15 or older are no longer supported by this CLI version.
Adds --max-processes flag to cap the number of processes a sandbox may spawn (enforced via cgroup v2 pids.max).
Adds port range support to sandbox profiles, enabling network rules that span a range of ports rather than individual ports.
Adds platform_overrides field to profiles for per-OS patch sets, letting a single profile express different rules on macOS vs Linux.
Adds deny_domain proxy configuration to explicitly block specific domains through the proxy.
Adds exec_paths per-command tool-sandbox setting to support multi-call binaries (e.g. busybox-style) that need access to multiple executable paths.
+3 moreshow less
Supports plain HTTP forward-proxying via the HTTP_PROXY environment variable.
Adds built-in bun runtime policy preset for sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls. Bun-based agents.
Adds built-in mise policy preset for sandboxing mise-based tool workflows.
Wiz Cloud is a cloud security platform that identifies risks, misconfigurations, vulnerabilities, and threats across multi-cloud environments through agentless scanning.
Wiz IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. Inventory reaches GA, linking every IaC module to its live cloud deployments and managed resources.
└──▷ HOW TO FIND IT
Navigate to the IaC Inventory in the Wiz console to trace a live cloud resource back to the IaC module that provisioned it.
📍In the Wiz console, go to Code › IaC Inventory, select a module to view its linked deployments and the live cloud resources it manages.
IaC Inventory is now Generally Available, connecting every IaC module to the deployments it created and the live cloud resources it manages.
Reconciles Wiz Code IaC scan results with Wiz Cloud runtime visibility, bridging infrastructure-as-code definitions to what is actually running.
Huntress is a managed security platform that detects, investigates, and remediates cyber threats for small and mid-sized businesses through 24/7 expert-backed monitoring.
New Partner Investigations View (Early Access) exposes full Huntress SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. activity — including Closed-Benign outcomes — across EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device., ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions., and SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
└──▷ HOW TO FIND IT
Opt in to the new Investigations View to review all SOC investigations — including benign closures — from the past 90 days.
📍In the Huntress portal, go to the top nav and select Investigations, then click the Try the new investigations view banner to opt in.
Adds Partner Investigations View (Early Access) showing all completed SOC investigations — both Reported and Closed-Benign — across Managed EDR, ITDR, and SIEM, not just those that became incident reports.
Each investigation includes a chronological timeline of signals reviewed, actions taken, remediations applied, and final outcome.
Automatically surfaces completed investigations from the last 90 days upon opt-in.
Trend Vision One is a unified cybersecurity platform that provides extended detection and response (XDR) across endpoints, networks, email, and cloud environments.
Trend Vision One adds a self-service Credit Transaction view with balance history, drawdown details, and downloadable usage reports.
└──▷ HOW TO FIND IT
Review which solution packages drove credit consumption last month and download a full-month report for record-keeping.
📍In the console, go to TrendAI Flex Licensing → Platform Usage and Credits › Credit transaction view, set the time period filter to Last month, expand the relevant drawdown entry to see the per-package breakdown, then select the package and click Download to export the full-month spreadsheet bundle.
New Credit transaction view in Platform Usage and Credits provides a chronological ledger of every credit-affecting event: purchases, monthly drawdowns, expirations, adjustments, license transfers, and licensing-model transitions.
Balance history ledger shows transaction date, event type, credit amount, and running balance, filterable by time period (current month, last 3/6/12 months, or custom date range) and by transaction type.
Drawdown entries expand to reveal per-package credit breakdowns with direct navigation into detailed monthly views.
Monthly drawdown view distinguishes live in-progress estimates for the current month from finalized past-month usage, with day-by-day breakdowns per solution package.
Supports downloading individual day usage reports for the current month or full-month spreadsheet bundles covering all packages.
Tines adds find-and-replace across entire stories for faster bulk edits.
└──▷ HOW TO FIND IT
Bulk-update a hostname, credential name, or URL that appears across many actions in a story without editing each one individually.
📍In the story editor, open Find and Replace, enter the text to find and the replacement text, then apply to update all matching instances across the story.
Adds find-and-replace functionality to search and update text throughout an entire story at once.
Splunk Security Content v6.2.0 adds 10 new detections spanning Linux Dirty Frag, Phantom Stealer, AWS Bedrock Claude AI abuse, and browser process injection.
└──▷ GET THIS VERSION
$ git clone --branch v6.2.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v6.2.0
New detection: Linux Dirty Frag Kernel Privilege Escalation (CVE-2026-43284 & CVE-2026-43500) — identifies high-frequency splice() syscall activity followed by setuid binary execution within the same audit session.
New analytic story: Phantom Stealer — expands Windows infostealer coverage with a new detection for unauthorized WinSCP security configuration folder access, plus enhanced tagging of existing analytics for credential theft, PowerShell abuse, process injection, and data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..
New detection: Windows Uncommon Remote Thread Creation In Browser Process — strengthens visibility into CreateRemoteThread-based process injection targeting browser processes using native Sysmon Event ID 8 field mappings.
New analytic story: Suspicious AWS Bedrock Claude Activities — introduces 7 new detections covering cross-region inference abuse, excessive token consumption, high-risk filesystem/exec tool invocation, hostile prompt sentiment, prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools., sensitive data in prompts, and unusually large prompt submissions.
Updated PowerShell ScriptBlock analytics to omit oversized ScriptBlockText fields from finding messages and convert detections to Anomaly type for clearer triage.
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
MISP 2.5.43 adds collection sync between instances, environment-variable settings, Pivotick pivot explorer, and TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. Bearer auth.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.43 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.43
└──▷ HOW TO FIND IT
Enable collection push to a remote peer so newly created collections are automatically synchronised to that instance.
📍In the MISP UI, go to Sync Actions › List Servers, edit the target server, and enable the push_collections and pull_collections toggles under the synchronisation options.
Adds collection synchronisation between MISP instances in both pull and push directions, with per-server pull_collections / push_collections toggles, feature negotiation with pagination, and a collections.locked origin-protection flag.
Supports environment variables as a third settings source alongside config file and database, enabling cleaner containerised and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. deployments.
Introduces Pivotick as an initial drop-in replacement for the legacy event graph, including a draft drag-and-drop reference editor.
Adds Bearer authentication for TAXII servers and a streamlined add flow for basic auth; the TAXII API key field is renamed to Token and obfuscated in the server view.
Extends the Overmind (Bootstrap 5) UI to user index, categories & types, application/audit/access logs, galaxies/galaxy clusters/galaxy relationships, and proposals screens, plus inline tag/galaxy addition from event view.
+2 moreshow less
Adds HoneyLabs default feeds covering active exploiters and malware infrastructure.
Edgescan is a cloud-based vulnerability management platform that continuously discovers, assesses, and prioritizes security vulnerabilities across an organization's entire digital attack surface.
Edgescan adds custom policy compliance insights, split retest permissions, self-service domain management, and a Credential Vault across this release.
New Custom Policy Compliance insight: upload company policy documents and see how vulnerabilities align with those policies.
New manage-retests permission lets admins delegate retest execution without granting access to start new assessments.
Self-service creation, renaming, and removal of internal domain suffixes directly on the Organizations Scanning tab.
Hostname validation on asset location entry prompts for a fully qualified domain name when a bare machine name is entered.
Super-user email alert when a new user is created via SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., enabling prompt permission review.
+11 moreshow less
Reports now list assets assessed during the report period with zero findings, confirming coverage rather than omitting them.
Scheduled export and report file names now include the scheduled task title for easier identification.
Vulnerability risk rating is now visible inside the retest window to aid prioritisation.
URLs in remediation advice are now rendered as clickable hyperlinks.
Vulnerability severity/risk/threat filters now support in / not in operators for multi-value inclusion and exclusion.
Licence Dashboard now includes a tooltip and link to a KB article explaining utilisation and forecast figures.
Duplicate base-URL detection warns users when a new asset location shares scheme and host with an existing asset.
Swagger API documentation page now links directly to token-creation instructions.
Shared Credentials feature is renamed to Credential Vault across the application and API.
Scheduled reports now support intuitive day-specific scheduling (e.g. 1st of every month, every Monday).
New 'clear extracted tokens on re-authentication' toggle in token mappings prevents stale tokens from breaking fresh authenticated scan sessions.
16 details in Everything
└──▷ BREAKING ON UPGRADE
!The Shared Credentials feature is renamed to Credential Vault across the application and API; any integrations, scripts, or documentation referencing the old name will need to be updated.
DefectDojo 3.1.100 adds FTS+trigram global search indexes, Jira close/reopen transition fields, and exposes dedupe policy on the Test API.
└──▷ GET THIS VERSION
$ git clone --branch 3.1.100 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 3.1.100
Adds full-text search (FTS) and trigram GIN indexes for global search, requiring a settings and database migration update.
Supports custom fields on Jira close/reopen transitions via a new database migration.
Exposes the effective dedupe matching policy on the Test API endpoint.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The FTS + trigram GIN indexes for global search require changes to settings.dist.py / local_settings.py and a database migration — existing deployments must apply both before upgrading.
Rapid7 InsightVM is a vulnerability management platform that continuously scans networks to identify, prioritize, and help remediate security risks across an organization's infrastructure.
InsightVM 8.52.0 adds fingerprinting for AI tools, Microsoft Intune-managed apps, and Splunk Enterprise.
New fingerprinting coverage for AI tools enables detection and inventory of AI software on scanned assets.
New fingerprinting support for Microsoft Intune-managed applications expands visibility into managed endpoint software.
New fingerprinting capability for Splunk Enterprise improves detection of Splunk deployments during scans.
Qualys CyberSecurity Asset Management continuously discovers, inventories, and assesses all IT assets across hybrid environments to eliminate security blind spots and reduce cyber risk.
Qualys ETM Identity unifies identity risk, attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis, and automated remediation into CSAM's risk model.
New Qualys ETM Identity module discovers risky identities and correlates identity and asset risk into a unified risk model.
Supports attack path analysis and domain trust mapping to visualize lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. exposure across Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. environments.
Introduces Identity TruRisk scoring to quantify identity risk based on criticality and associated misconfiguration severity.
Detects Pass-the-Hash (PtH) risk conditions including legacy NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. authentication, cached credentials, weak authentication settings, and excessive admin privileges.
Maps DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers. exposure in identity graphs, surfacing identities with replication rights before they can be exploited.
+2 moreshow less
Identifies accounts with disabled KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. pre-authentication and other risky identity configurations.
Enables automated remediation workflows driven by correlated identity posture, exploitability, and asset context.
runZero is a network discovery and asset inventory platform that scans environments to identify and catalog all connected devices, systems, and services.
runZero 5.0.260714.0 adds crown jewel status and Purdue level to the Dragos integration.
Adds crown jewel status and Purdue level fields to assets surfaced via the Dragos integration.
Vulnerability groups inventory now displays a meaningful error message when a search contains unsupported terms.
Censys is an internet intelligence platform that continuously scans and indexes internet-facing assets, helping security teams discover and monitor exposed infrastructure and vulnerabilities.
Censys Assistant gains page-aware context and 8 new fingerprints added to the Platform.
└──▷ HOW TO FIND IT
Investigate an unfamiliar service on a host without copy-pasting asset details — open the Assistant directly from a host page and ask about exposed services in context.
📍In the Platform, navigate to a host detail page, open the Censys Assistant panel, and ask 'What services on this host are unusual or potentially exposed?' — the Assistant automatically uses the current host as context.
Censys Assistant now automatically reads the current page (host, certificate, web property, search result, or collection) as context when opened, enabling deeper questions about specific assets without manually specifying them.
Adds 8 new fingerprints to the Platform: Chatto, RedHat Cockpit, D-Link DAP Series Access Point, BigBlueButton, Monospace Directus, Google Mod PageSpeed, Hugo, and Streamlit.
Tenable One is an exposure management platform that provides unified visibility across attack surfaces to help organizations identify, prioritize, and remediate cybersecurity risks.
Tenable One Cloud Exposure earns FedRAMP HighFedRAMP HighA US federal authorization tier for cloud services, managed by GSA, certifying that a provider meets the strictest NIST 800-53 controls required to handle the most sensitive unclassified government data. and IL5 authorization, enabling use in highly sensitive federal and intelligence environments.
Achieves FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. High authorization, expanding support beyond the existing FedRAMP ModerateFedRAMP ModerateA US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts. status to highly sensitive federal environments.
Achieves IL5 authorization, enabling use by intelligence agencies and mission-critical use cases that previously required separate tooling.
Delivers unified CNAPPCNAPPA cloud-native application protection platform that combines checks across cloud configuration, workloads and development. It helps teams connect risks that separate tools might report apart. capabilities within strictly regulated federal cloud ecosystems with strict data isolation requirements.
Immuta is a data security platform that automates access control, privacy protection, and policy enforcement across cloud data environments.
Adds automated sensitive data discovery for the Amazon Redshift viewless integration, supporting regex, dictionary, and column name regex identifier types with automatic tag application.
Adds Slack and Microsoft Teams event-driven notifications for the Request app (approvals, access changes, requests), now generally available.
Expands Teradata integration masking support to include constant and hash masking in addition to existing null masking.
Revokes data owner grants when a data source is disabled (behavior change rolling out via opt-in period starting June 30).
Review Assist now incorporates request form responses as additional context in its AI-powered access request recommendations.
└──▷ BREAKING ON UPGRADE
!When a data source is disabled in Immuta, Immuta now revokes data owners' Immuta-managed grants in the data platform — previously, disabling a data source did not remove those grants. This change follows the behavior change release process (on by default: 8/1; enabled for all: 9/1).
!Starburst (Trino) principal name matching is now case-insensitive; previously, Trino principals had to match the exact capitalization of the corresponding user or service account in Immuta. This is on by default starting 7/1 and enabled for all accounts on 8/1.
Ubiq Security is a developer platform providing APIs and SDKs that enable applications to encrypt and decrypt sensitive data using structured, format-preserving encryption.
Ubiq overhauls dataset access controls with Access Groups and tagging, adds advanced structured encryption config, and expands library support.
└──▷ HOW TO FIND IT
Enable automatic IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. role-based dataset access by creating an Access Group whose name matches an IDP role — members gain dataset access without manual assignment.
📍In the Ubiq Dashboard, go to Identities › Access Groups › Create Access Group, name the group to match your IDP role, assign the target Datasets, and save. IDP users with that role will be granted access automatically.
Pre-warm the key cache on startup to eliminate first-use latency in latency-sensitive Java services before any encrypt/decrypt calls.
java
ubiqSession.loadCache();
Introduces Access Groups to replace the Dataset Group → Identity model, granting dataset access to API Keys or IDP users independently of dataset organization.
Advanced Dataset Configuration for Structured Encryption now lets operators define encryption behavior for dates, numerics, short fields, and large character sets at the dataset policy level — no custom code required.
Unified Identities section consolidates API Keys and IDP-managed users, with a new per-identity access graph for at-a-glance visibility into access groups and datasets.
Platform resiliency upgrade enables zero-downtime deployment of core system changes to APIs and encryption services.
DigiCert CertCentral is a certificate management platform that allows organizations to issue, manage, renew, and automate SSL/TLS and other digital certificates.
CertCentral adds Persistent DNS TXT Record DCVDNS TXT Record DCVA domain control validation method where a certificate authority asks you to publish a specific value in a DNS TXT record, proving you control the domain before issuing a TLS certificate., enabling one-time DNS setup for repeated domain revalidations.
└──▷ HOW TO FIND IT
Enable the Persistent DNS TXTDNS TXTA DNS record type that stores arbitrary text strings in a domain's zone data, often used by cyber tools to exfiltrate data, verify domain ownership, or publish policy information like SPF and DMARC. Record DCVDCVDomain Control Validation, a certificate-authority process that proves an applicant controls a domain before issuing a TLS certificate; cyber tools use it to automate certificate provisioning workflows. method for your account so it appears in all DCV method menus.
📍In the CertCentral menu, go to Settings › Preferences. Expand Advanced Settings. Under Domain Control Validation (DCV) › DCV methods, select Persistent DNS TXT Record. Click Save Settings.
Adds Persistent DNS TXT Record as a new domain control validation (DCV) method, allowing a single DNS TXT record to satisfy repeated revalidations without creating new records each cycle.
Supports an Account URI option — one shared persistent URI to validate any domain across the entire CertCentral account, simplifying multi-domain DNS management.
Supports a Unique URI option — a domain-specific persistent URI to avoid publicly linking domains through shared DNS records.
Enables Persistent DNS TXT Record DCV on certificate request forms, the Domains page (add/validate/revalidate), and pending OV, EV, and DV TLS certificate orders once activated in account preferences.
Cyera is a cloud data security platform that discovers, classifies, and protects sensitive data across cloud environments to reduce risk and ensure compliance.
Cyera expands Access Trail to Google Workspace with audit visibility, event enrichment, saved filters, and access revocation.
Adds Access Trail coverage for Google Workspace, including My Drive and Shared Drives audit visibility.
Enriches access events with data classification and identity context for deeper investigation.
Introduces saved high-risk filters to quickly surface and revisit critical access patterns.
Enables optional access revocation directly from Access Trail findings in Google Workspace.
Cyera Browser Shield adds policy creation and a template catalog to enforce data controls on browser-based AI workflows.
└──▷ HOW TO FIND IT
When a new shadow AI destination is flagged in alerts, use the Browser Shield policy editor to select a provider, apply a template, configure rules, and deploy — without building from scratch.
📍In the Cyera console, go to Browser Shield › Policies, select Create Policy, choose a provider, pick a template from the Policy Catalog, configure your data classification rules, and click Deploy.
New Policy Creation editor for Browser Shield lets security teams configure and deploy data-leak policies for browser-based AI tools in a single workflow.
New Policy Catalog provides pre-built templates so teams can start from a baseline rather than a blank editor for each new AI surface.
Policies distinguish managed AI tools from shadow AI destinations, enabling enforcement aligned to how employees actually use AI.
Cyera adds eight new ecosystem integrations and extends Claude Enterprise support in its June release.
Extends Claude Enterprise integration for AI-driven data security workflows.
Adds integration with Abnormal Security for email and collaboration threat response.
Adds integration with Cohesity for data protection and backup coverage.
Adds integration with Cato Networks for network security enforcement.
Adds integration with Island Enterprise Browser for browser-level data policy enforcement.
+5 moreshow less
Adds integration with Delinea for privileged access managementprivileged access managementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. workflows.
Adds integration with Mave Security for expanded ecosystem coverage.
Adds integration with Mate Security for expanded ecosystem coverage.
Adds integration with Shift Security for expanded ecosystem coverage.
Introduces CyBridge improvements for faster, more reliable on-premises connectivity.
Cyera Omni DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Memories retains investigation context across alerts so analysts build on prior decisions instead of starting from scratch.
Adds persistent investigation context across DLP alerts, retaining history for users, destinations, organizations, and departments to eliminate repeated triage of recurring patterns.
New dedicated Memories view lets analysts review and delete stored entries to keep automation predictable and auditable.
Cyera launches Remediation Center: a dedicated workspace for data owners to triage and resolve assigned data exposures.
└──▷ HOW TO FIND IT
Route a data exposure issue to a data owner so they can act on it directly in the Remediation Center without security team involvement.
📍In the Cyera console, open a finding and assign it to a data owner. The owner receives a consolidated notification and can log in via SSO or OTP to access their Remediation Center, where the issue appears in their To Do queue.
New Remediation Center workspace gives data owners a dedicated interface to triage and resolve data security issues assigned to them.
Adds a To Do vs. Completed workflow so remediation progress is clearly tracked and measurable.
Consolidated notifications keep data owners informed of new assignments without manual coordination from security teams.
Event logs provide an audit trail of remediation activity, including what was closed and when.
Supports secure data owner access via SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. or OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets., enabling participation without requiring full platform credentials.
Varonis is a data security platform that automatically discovers, classifies, and protects sensitive data while detecting and responding to insider threats and cyberattacks.
Varonis Atlas adds native coverage for Claude Code and Claude Cowork with runtime guardrails and AI activity monitoring.
Adds direct integration with Claude Code and Claude Cowork, extending Atlas coverage across the full Anthropic enterprise Claude suite.
Enables runtime guardrails that can block, modify, or alert on risky AI behavior in real time.
New AI activity monitoring detects exposure of sensitive data, credentials, API keys, and regulated information with user, project, resource, and token-usage context.
Provides visibility into agent artifacts — skills, memory files, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. configurations — to surface persistent instructions and detect manipulation attempts.
Delivers a complete inventory of agents, tools, and supporting resources across Claude Code, Claude Cowork, Claude Enterprise, and Claude Platform.
SailPoint is an identity security platform that helps organizations manage and govern user access, permissions, and credentials across enterprise systems and applications.
NERM Users connector gains real-time ISC sync toggle and UI-based role assignment for non-employee accounts.
└──▷ HOW TO FIND IT
Enable real-time ISC sync so that every NERM user or role change immediately triggers an aggregation in Identity Security Cloud, eliminating propagation delay.
📍In the NERM Admin UI, go to Admin › System › Identity Security Cloud Connection Settings › USERS tab, set the Sync with Identity Security Cloud toggle to ON, confirm or enter the Source ID, then click Save.
Assign a role to a non-employee user directly in the UI during implementation, without needing API access.
📍In the NERM Admin UI, go to Admin › Lifecycle › User Roles, select the target user, and assign or unassign the desired role.
Adds a new Sync with Identity Security Cloud toggle in Admin > System > Identity Security Cloud Connection Settings > USERS tab, triggering immediate account or entitlement aggregation on any NERM user/role change instead of waiting for periodic aggregation.
Adds a Source ID field to the USERS tab, allowing NERM to auto-detect an existing NERM Users connector source or optionally create one automatically when the sync toggle is first enabled.
Enables NERM admins to assign and unassign roles directly to users from Admin > Lifecycle > User Roles in the Non-Employee Risk Management Admin UI, a capability previously limited to the API.
1Password is a password manager that securely stores, generates, and autofills passwords, passkeys, and sensitive information across devices and browsers.
1Password 8.12.28 adds exact-phrase search, Universal Autofill for HTTP auth prompts, and a unified Developer settings section.
└──▷ HOW TO FIND IT
Look up an item by exact IP address or dotted string without partial-match noise.
📍In the 1Password search bar, type 10.1.2.3 (with double quotes) to retrieve items matching that exact phrase.
Access all developer integrations (CLI, SDKs, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) from one place instead of hunting across multiple settings screens.
📍In the 1Password app, go to Settings › Developer to find 1Password CLI, SDKs, and MCP client configuration grouped together.
2 more releases in this issue
· 2026-07-13 → 2026-07-14
1Password for Windows adds exact-phrase search with special characters and consolidates Developer settings into one section.
└──▷ HOW TO FIND IT
Find a vault item by exact IP address or dotted string without partial-match noise.
📍In the 1Password search bar, type 10.1.2.3 (with double quotes) to retrieve items matching that exact string.
Access all developer integrations (CLI, SDKs, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. clients) from one place instead of hunting across multiple settings pages.
📍In the 1Password app, go to Settings › Developer to find CLI, SDKs, and MCP client integrations consolidated in a single section.
Adds Shell Plugin support for Cline CLI, CrateDB CLI, Cursor CLI, Descope CLI, Exercism CLI, Expo and EAS CLIs, GitHub Copilot CLI, Google Gemini AI API CLI, JetBrains Junie CLI, Kiro CLI, OpenCode CLI, OpenTofu CLI, PyPI (twine, flit, hatch), and UpCloud CLI — enabling Touch ID and other unlock options for each.
GitHub shell plugin now provisions GH_ENTERPRISE_TOKEN for GitHub Enterprise Server hosts and supports authenticating to both github.com and Enterprise simultaneously when separate credentials are configured.
Redis CLI shell plugin now supports environment variable-based credential provisioning.
Oh Dear shell plugin now checks for ~/.ohdear/config.json and imports credentials automatically.
└──▷ BREAKING ON UPGRADE
!The deprecated zsh.initExtra option in the nix shell plugin has been replaced with zsh.initContent.
!The awslogs CLI function has been renamed to capitalize CLI for consistency.
Auth0 is a cloud-based identity platform that provides authentication and authorization services, enabling developers to securely manage user logins for applications.
Auth0 Dashboard now supports real-time Role search by ID and name, available in Public Beta.
└──▷ HOW TO FIND IT
Quickly locate a specific Role without scrolling through paginated lists — useful when managing large numbers of roles.
📍In the Auth0 Dashboard, go to User Management › Roles and type a Role name or ID into the search bar to filter results in real time.
JumpCloud is a cloud-based directory platform that manages user identities, devices, and access to IT resources across organizations securely.
JumpCloud Agent 2.147.2 adds AWS Client VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. authentication and a Windows App Catalog in the system tray.
Supports AWS Client VPN authentication, enabling managed devices to verify posture and connect to AWS VPN gateways using JumpCloud identity (macOS and Windows).
Adds App Catalog to the Windows tray app, letting users browse, search, and manage software applications directly from the system tray.
Requires users to supply a reason when submitting Device Admin approval requests, aligning the workflow with security best practices.
Microsoft Entra is a cloud-based identity and access management platform that secures user authentication, manages permissions, and controls access to applications and resources.
Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. makes passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. the default MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. method and retires native SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels./voice auth by February 2027.
└──▷ HOW TO FIND IT
Identify which users are still enabled for SMS or voice so you can prioritize them for passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. rollout before the September 1, 2026 auto-enrollment deadline.
📍In the Entra admin center, go to Protection › Authentication methods › Policies, review which users or groups have SMS or Voice enabled, then navigate to Protection › Authentication methods › Registration campaign to enable passkey nudging for those users.
Starting September 1, 2026, users enabled for SMS or voice MFA are automatically enabled for passkeys and prompted to register one during their next MFA sign-in.
Supports synced passkeys (iCloud Keychain, Google Password Manager) and device-bound passkeys (Microsoft Authenticator, Entra passkey on Windows, FIDO2FIDO2The open standard behind passkeys and hardware security keys, where a website checks a signature from the user's device instead of a password. Because the key is bound to the site, phishing pages cannot use it. security keys) as first-class authentication options.
New Microsoft Security Store partner marketplace enables organizations that still require SMS or voice to select, configure, and manage third-party telecom providers starting October 30, 2026.
Registration campaigns now available to prompt users to register a passkey at scale during MFA sign-in flows.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!On February 1, 2027, Microsoft-provided SMS and voice authentication is retired; users relying on these methods will be required to register a passkey before they can sign in, with no opt-out option.
!After February 1, 2027, automatic passkey registration prompts will be enforced for all users in all tenants with no opt-out option.
DNSFilter is a cloud-based DNS security tool that blocks malicious websites, filters harmful content, and protects networks from cyber threats in real time.
iOS Roaming Client v1.4.4 adds automatic MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. site reassignment, stronger admin PIN protection, and refreshed branding.
Supports syncing user name, hostname, and device tag changes from MDM configuration profiles to the Dashboard without requiring a Site Secret Key change.
Enables automatic site reassignment when a Site Secret Key changes in the MDM configuration profile, allowing fleet migrations without reinstalls or policy gaps.
Adds progressive delays between incorrect admin PIN attempts to make automated guessing impractical while keeping legitimate retries fast.
Refreshes app icons, visuals, and UI elements to match current DNSFilter branding.
Enables diagnostic logging by default on new installs so Support can diagnose early issues from first run.
DNSFilter adds CyberSight Data Export for SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integration and clearer Mobile Roaming Client auto-registration status display.
└──▷ HOW TO FIND IT
Route CyberSight threat data into your SIEM alongside DNS logs by enabling CyberSight Data Export in the DNSFilter dashboard.
📍In the console, go to Settings › Data Export and enable CyberSight Data Export to begin forwarding CyberSight data to your configured SIEM destination.
Adds CyberSight Data Export to all Data Export customers, enabling SIEM ingestion of CyberSight data alongside existing DNS log exports.
Automatic Registration setting now surfaces its 7-day duration and an explicit Ends on [date] status for Mobile Roaming Client, replacing the previous helper text.
Kiro is an AI-powered IDE by AWS that uses "specs" to translate requirements into structured plans, hooks, and code for building production-ready software.
Kiro 1.0.138 adds full PowerShell trust support on Windows and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool recovery from transient network failures.
Adds full PowerShell trust support on Windows for Kiro sessions.
MCP tools now recover from transient network failures instead of failing silently.
OpenAI GPT-5.6 Sol, Terra, and Luna are now available in Kiro across IDE, CLI, and Web.
└──▷ HOW TO FIND IT
Use Sol for complex, multi-step spec-driven implementation or long-horizon refactors where maximum coding capability is needed.
📍In the Kiro IDE, CLI, or Web, open the model selector and choose GPT-5.6 Sol for your agent or chat session.
Use Luna for high-frequency, low-latency tasks (e.g., autocomplete, quick edits) to minimize Kiro credit consumption at 0.6x multiplier.
📍In the Kiro IDE, CLI, or Web, open the model selector and choose GPT-5.6 Luna for your agent or chat session.
Adds OpenAI GPT-5.6 Sol (flagship), Terra (balanced), and Luna (fast/low-cost) model tiers to Kiro's IDE, CLI, and Web interfaces.
Supports 272K context windowcontext windowThe maximum amount of text, counted in tokens, a model can take in and produce in one request. Everything the model knows about the task has to fit inside it. across all three GPT-5.6 tiers.
Enables longer autonomous runs with tool-coordinating mini-programs that reduce round-trips, available across all three tiers.
Supports cross-region inference across us-east-1 and eu-central-1 for Pro, Pro+, Pro Max, and Power customers.
Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.
Claude Code v2.1.210 adds a live tool timer, memory overflow errors, screen-reader mode announcements, and agent input-waiting counts.
└──▷ GET THIS VERSION
$ git clone --branch v2.1.210 https://github.com/anthropics/claude-code.git
# already have the repo? check out this version:$ git checkout v2.1.210
Adds a live elapsed-time counter to the collapsed tool summary line so long-running tool calls visibly tick instead of appearing frozen.
Adds a startup warning when permission rules use Write(path), NotebookEdit(path), or Glob(path) — directing users to Edit(path) or Read(path) instead.
Memory writes that would push a MEMORY.md index over its read limit now surface an explicit error instead of silently truncating content.
Screen reader mode now announces permission mode changes aloud when cycling through modes with Shift+Tab.
The agents footer hint now displays how many background agents are waiting on user input, with brief color emphasis when the count changes.
+3 moreshow less
Hardens the Agent tool against indirect prompt injectionindirect prompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. via content read by a subagent.
Improves auto mode: the permission classifier now defaults to Sonnet 5 for external sessions, validated on the first request and pinned for the session.
Improves Bash/PowerShell timeout messaging so the model can distinguish a hung command from an intentional background request.
Claude Code v2.1.208 adds screen reader mode, vim insert remaps, corporate process wrapper, and fullscreen mouse support.
└──▷ GET THIS VERSION
$ git clone --branch v2.1.208 https://github.com/anthropics/claude-code.git
# already have the repo? check out this version:$ git checkout v2.1.208
└──▷ TRY IT
Enable screen reader-compatible plain-text output for assistive technology users in a one-off session.
$ claude --ax-screen-reader
Persist screen reader mode across all sessions via settings instead of passing the flag every time.
json
# In your Claude Code settings (JSON)
{ "axScreenReader": true }
Route all Claude Code subprocess spawns through a corporate launcher in a managed enterprise environment.
$ export CLAUDE_CODE_PROCESS_WRAPPER=/usr/local/bin/corp-launcher
claude
Adds --ax-screen-reader flag (also CLAUDE_AX_SCREEN_READER=1 env var or "axScreenReader": true in settings) for opt-in plain-text rendering compatible with screen readers.
Adds vimInsertModeRemaps setting to map two-key vim insert-mode sequences (e.g. jj → Escape) without leaving the editor.
Adds CLAUDE_CODE_PROCESS_WRAPPER env var so every Claude Code self-spawn routes through a corporate launcher executable, enabling enterprise wrapper enforcement.
Adds mouse-click support for multi-select menus and Other input rows in fullscreen mode.
Up to 7x faster tool rounds in print/SDK sessions with many MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools via cached tool-pool assembly.
+3 moreshow less
Completed background agents now remain listed in /tasks until cleanup instead of disappearing immediately upon finishing.
Catastrophic removals (e.g. rm -rf ~) inside command substitutions ($(…), backticks, <(…)) now prompt for confirmation in --dangerously-skip-permissions and auto mode.
/usage now displays last-known usage bars with an as of timestamp when the usage endpoint is rate-limited, instead of an error screen.
Pi v0.80.7 adds cache-friendly dynamic tool loading, toolChoice for OpenAI/Codex Responses, Fable 5 xhigh/max thinking, and a Ctrl+X message copy shortcut.
└──▷ GET THIS VERSION
$ git clone --branch v0.80.7 https://github.com/earendil-works/pi.git
# already have the repo? check out this version:$ git checkout v0.80.7
Adds cache-friendly dynamic tool loading: extensions can inject tools during execution while Anthropic and OpenAI Responses models preserve prompt-cache prefixes.
Adds toolChoice support for OpenAI and Codex Responses, including required and named tool selection.
Adds native xhigh and max thinking levels for Claude Fable 5 across all generated provider catalogs.
Adds Ctrl+X shortcut to copy the last assistant message in the transcript, or the selected message in /tree.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The compat.sendSessionIdHeader flag has been removed from models.json for openai-responses models. Replace sendSessionIdHeader: false with sessionAffinityFormat: "openai-nosession" in your models.json; the new field also accepts "openai" and "openrouter".
an open source, extensible AI agent that goes beyond code suggestions - install, execute, edit, and test with any LLM
Goose v1.43.0 adds per-message cost/token stats, OllamaCloud provider, --edit session flag, TLS for ACP serve, and six new model providers.
└──▷ GET THIS VERSION
$ git clone --branch v1.43.0 https://github.com/aaif-goose/goose.git
# already have the repo? check out this version:$ git checkout v1.43.0
└──▷ TRY IT
Review and trim a session's conversation before branching it into a new task, avoiding stale context.
$ goose session --edit
Adds --edit session flag to edit conversation history before forking a session.
New per-message usage stats UI showing tokens, cost, TTFTTTFTTime to first token, the wait between submitting a request and receiving the first generated token. It includes delays such as queuing and processing the prompt., and tok/s for each turn.
New OllamaCloudProvider with dynamic model discovery and automatic context-limit detection.
Adds iFlytek Spark and Astron MaaS as supported providers.
Adds Fireworks AI as a declarative provider.
+12 moreshow less
Adds OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code. request parameters support.
Adds OVHcloud Qwen3.6-27B model with 262K context windowcontext windowThe maximum amount of text, counted in tokens, a model can take in and produce in one request. Everything the model knows about the task has to fit inside it..
Adds GPT-5.6 family support (gpt-5.6-luna, gpt-5.6-sol, gpt-5.6-terra) with 1,050,000-token context and xhigh reasoning effort.
Adds GLM-5.2 model support.
Adds TLS support for goose serve ACP sessions.
Adds streamable HTTP support in the deeplink generator.
Desktop sessions now automatically reconnect after system sleep or connection loss.
Chat sessions are now grouped by project in the navigation panel.
Delete support for custom apps added to the Apps UI.
Desktop localizations added for French, German, Italian, Portuguese, Indonesian, Malay, Vietnamese, and Traditional Chinese.
Provider bindings MVP added to goose-sdk with Python wheel publishing.
Diagnostics output migrated to structured JSON report format.
17 details in Everything
1 more release in this issue
· 2026-07-13 → 2026-07-14
$ git clone --branch v1.42.0 https://github.com/aaif-goose/goose.git
# already have the repo? check out this version:$ git checkout v1.42.0
Adds OllamaCloudProvider with dynamic model discovery and automatic context-limit detection.
Adds per-message usage stats in the desktop UI: token counts, cost, time-to-first-tokentime-to-first-tokenTime to first token, the wait between submitting a request and receiving the first generated token. It includes delays such as queuing and processing the prompt. (TTFTTTFTTime to first token, the wait between submitting a request and receiving the first generated token. It includes delays such as queuing and processing the prompt.), and tokens/sec.
Adds per-message usage and cost tracking with derived session totals.
Groups chat sessions by project in the navigation panel.
Shows project names in the directory-switcher dropdown.
+4 moreshow less
Adds provider bindings MVP to goose-sdk with Python wheel publishing.
Adds AskAI bot hints for follow-up suggestions.
Hardens goose update to fail closed when Sigstore/SLSASLSASupply-chain Levels for Software Artifacts, a framework for assessing how software was built and protecting that process from tampering. Provenance records help verify where a build came from.provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. cannot be verified.
Increases the /mcp-app-guest body limit to support larger single-file MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. apps.
Lightweight coding agent that runs in your terminal
Codex CLI alpha adds managed Bedrock login, stabilized memories, MCP OAuthMCP OAuthAn authentication layer for the Model Context Protocol that lets MCP clients obtain delegated access tokens so cyber tools can call MCP servers on a user's behalf without handling raw credentials. credential pinning, and Windows sandbox level support.
└──▷ GET THIS VERSION
$ git clone --branch rust-v0.145.0-alpha.10 https://github.com/openai/codex.git
# already have the repo? check out this version:$ git checkout rust-v0.145.0-alpha.10
Adds managed Bedrock login API for authenticating with AWS Bedrock-hosted models.
Stabilizes the memories feature flag, making conversation memory generally available.
Supports MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. OAuth credential store resolution and pinning, with serialized credential refreshes.
Adds Windows sandbox level configuration propagated through command execution.
Imports enabled plugins from known marketplaces automatically.
+5 moreshow less
Exposes scheduled tasks in plugin details view.
Adds dedicated storage for paginated thread history.
Makes GPT-5.6 Sol the default model for Bedrock.
Supports pending remote environment registration.
Routes realtime calls and memory summarization through the HTTP client factory, enabling proxy support for those requests.
10 details in Everything
0 more releases in this issue2 more releases in this issue · 2026-07-13 → 2026-07-14
Codex CLI adds environment status inspection API and SQLite-backed paginated thread history for faster local reads.
└──▷ GET THIS VERSION
$ git clone --branch rust-v0.145.0-alpha.9 https://github.com/openai/codex.git
# already have the repo? check out this version:$ git checkout rust-v0.145.0-alpha.9
New experimental environment/status request lets you inspect a configured environment's state (ready, pending, disconnected, or unknown) without starting or reconnecting it.
Adds cursor-based local reads for turn summaries and thread or per-turn items backed by SQLite, enabling paginated thread history with archived-thread and history-mode validation.
Probes ready remote environments over their existing exec-server connection to report live status.
Codex CLI alpha.7 makes GPT-5.6 Sol the default Bedrock model and adds explicit advanced-reasoning selection in the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency..
└──▷ GET THIS VERSION
$ git clone --branch rust-v0.145.0-alpha.7 https://github.com/openai/codex.git
# already have the repo? check out this version:$ git checkout rust-v0.145.0-alpha.7
Sets GPT-5.6 Sol as the default Amazon Bedrock model, prioritizing Sol, Terra, and Luna variants ahead of GPT-5.5 and GPT-5.4.
Adds explicit advanced reasoning selection in the TUI, making reasoning-level choices visible rather than implicit.
Automatically omits unsupported reasoning.summary parameter for models that lack the capability, including spawned agents using a different model.
Persists paginated thread items in the local thread store, enabling canonical ItemCompleted events to survive across sessions.
Trusts hooks from newly installed or updated remote workspace plugins automatically after a successful refresh.
+3 moreshow less
Prefers the Codex home socket (CODEX_HOME/ipc/ipc.sock) for Unix IDE context connections, with fallback to legacy temp-directory paths.
Exposes model overrides for multi-agent v2 spawned agents, restricted to the active backend.
Adds structured diagnostic metadata to file blob upload failures, including upload host, elapsed time, error category, and client request ID.
OpenClaw v2026.7.1 adds openclaw attach for Claude Code, GPT-5.6/Tencent Hy3/Muse Spark 1.1 support, guarded terminals, and a redesigned Control UI.
└──▷ GET THIS VERSION
$ git clone --branch v2026.7.1 https://github.com/openclaw/openclaw.git
# already have the repo? check out this version:$ git checkout v2026.7.1
└──▷ TRY IT
Approve an unknown sender's pairing request so they can interact with the assistant via a connected channel.
$ openclaw pairing approve <channel> <code>
Run the guided onboarding wizard to set up the gateway daemon and verify connections before saving.
$ openclaw onboard --install-daemon
Adds openclaw attach command to give Claude Code temporary access to a selected session, enabling tracked Codex delegation and native subagent workflows.
Supports GPT-5.6 across OpenAI and Codex routes, adds Tencent Hy3 with a complete setup path, and adds Meta Muse Spark 1.1 via the Meta Model API.
Introduces guarded workspace terminals accessible across web, iOS, and Android.
Enables scheduled cron jobs to wake only when something changes (change-triggered wake mode).
Supports pairing remote signed-in browser tabs and safely saving completed downloads from those tabs.
+3 moreshow less
Adds new onboarding flow that checks connections before saving them and preserves earlier choices when setup is interrupted.
Expands Copilot with broader provider choices.
Adds egress-time credential injection with process-local sentinels to keep secrets out of logs.
Get up and running with Kimi-K2.6, GLM-5.1, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models.
Ollama v0.32.0 adds an interactive agent TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency., renames the ChatGPT integration, and warns on deprecated agent models.
└──▷ GET THIS VERSION
$ git clone --branch v0.32.0 https://github.com/ollama/ollama.git
# already have the repo? check out this version:$ git checkout v0.32.0
└──▷ TRY IT
Start the new interactive agent to chat, write code, and delegate work — no model name needed.
$ ollama
Route local model traffic through the ChatGPT desktop app (formerly Codex App) integration.
$ ollama launch chatgpt
Adds an interactive agent experience: running ollama now launches a built-in agent for chat, coding, web search, and delegating real work.
Adds --restore flag to ollama launch chatgpt to return to your usual ChatGPT profile.
Simplifies the ollama launch root menu to a curated short list of popular integrations; all others remain accessible via ollama launch <integration>.
Warns before launching older/weaker agent models (CodeLlama, Qwen2.5, Qwen2.5-Coder, Llama 3.x, Mistral, StarCoder, base DeepSeek-R1 tags); use --yes to bypass in headless workflows.
THE CYBER TOOLCHAIN