PAGES
Subscribe Get it delivered — five to ten releases we picked each morning from the tools you run, with every release in the issue on the web. Compare plans →

The Cyber Toolchain — issue 019, July 18, 2026

THE CYBER TOOLCHAIN NO. 019
Tail
THE DAILY RELEASE FIREHOSE
PUBLISHED JULY 18, 2026 · EVERY DAY
EDITIONS tail grep head ls diff uniq

The daily firehose — everything the toolchain shipped today, already filtered.

We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.

VIEW
ISSUE VIEW scroll
ISSUE WIDTH reading width
Do you prefer scroll?
ADDITIONAL FILTERS 
$ tct list   # 10 tools matched
Application Security
◆  SAST / SCA / Code Security

Capital One VulnHunter

Sources Release notes → v0.1.0 Notes

Agentic AI security tool that applies proactive, attacker-first analysis directly to source code.

Capital One open-sources VulnHunter: agentic AI SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. with attacker-first analysis, falsification engine, and automated fix-verify loop.

└──▷ GET THIS VERSION 
$ git clone --branch v0.1.0 https://github.com/capitalone/VulnHunter.git
# already have the repo? check out this version:
$ git checkout v0.1.0
└──▷ TRY IT
Run the full attacker-first vulnerability scan against a codebase inside a Claude Code session.
$ claude --model opus --add-dir ~/.claude/skills/vulnhunt --add-dir ~/.claude/skills/vulnhunt/phases
# Then inside the Claude Code session:
/vulnhunt
Independently verify that a prior fix actually blocked the exploit before merging, using the read-only verifier agent.
$ claude --model opus --add-dir ~/.claude/skills/vulnhunt-fix-verify \
       --add-dir ~/.claude/skills/vulnhunt-fix-verify/phases
# Then inside the Claude Code session:
/vulnhunt-fix-verify repo=<abs_path> report=<abs_path> fixed=VULN-001,... out=<abs_path>
Batch-scan a list of repositories and collect all findings for centralized review, skipping repos already processed.
$ cd harness
python -m local_harness.batch.run scan --resume
python -m local_harness.batch.run collect
  • Adds /vulnhunt Claude Code skill: entry-point-forward scanner that maps attacker paths to dangerous sinks and filters findings through a multi-stage falsification pipeline (Recon → Parallel Hunt → Adversarial Disprove → Capability Filter).
  • Adds /vulnhunter-fix skill: test-driven remediation loop that writes an exploit demo, creates a failing security test (RED), implements the fix (GREEN), verifies the exploit is blocked, and opens a reviewable PR.
  • Adds /vulnhunt-fix-verify skill: independent, read-only agent that validates whether a finding was successfully remediated and emits a per-finding verdict.
  • Adds vulnhunter-agent/ headless runtime: clones targets, runs /vulnhunt, publishes results, and opens GitHub issues for confirmed vulnerabilities — suitable for CI/CD pipelines.
  • Adds harness/ batch-scanning and benchmarking tooling: manage a repo list, resume interrupted scans, collect findings centrally, and evaluate detection accuracy against a known-vulnerable corpus with LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-judge scoring.

5 details in Everything

Was this useful?
◆  Web Application Security

Cloudflare

Sources Blog / feed → Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities (2026-07-17) 2 releases · 2026-07-17 Blog LatestStable

Cloudflare is a cloud-based platform that provides website security, performance optimization, DDoS protection, CDN services, and DNS management for businesses and developers.

Cloudflare WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. deploys two new managed rules blocking critical WordPress RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. (CVE-2026-63030) and SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. (CVE-2026-60137) for all plan tiers.

└──▷ HOW TO FIND IT
Verify Managed Rules are enabled on a Pro/Business/Enterprise zone so the new WordPress rules are active with the Block action rather than Log.
📍In the Cloudflare dashboard, go to Security › WAF › Managed Rules, confirm the Cloudflare Managed Ruleset is enabled, then check Security Events and filter by the two new rule IDs to monitor matching traffic while you patch WordPress.
  • New WAF managed rule detects and blocks SQL injection attempts targeting WordPress 6.8+ (CVE-2026-60137) before crafted parameter values reach the application.
  • New WAF managed rule detects and blocks unauthenticated RCE attempts via the WordPress REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. batch endpoint (CVE-2026-63030) affecting WordPress 6.9+.
  • Both rules are automatically active for free-plan customers via the Free Ruleset and deployed with the default Block action for Pro, Business, and Enterprise Managed Ruleset customers.

3 details in Everything

1 more release in this issue · 2026-07-17
WAF - WAF Release - 2026-07-17 - Emergency (2026-07-17) Blog Stable

Emergency WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. release adds new managed rules blocking unauthenticated RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. and SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. exploits in popular web frameworks.

  • New detection rule (7dfb2bd4708d4b88b9911dc0550664b6) added to Cloudflare Managed Ruleset to block unauthenticated RCE via malicious path sequences at Block action.
  • New detection rule (1c060d3a371549219ee290d7ed933fcc) added to Cloudflare Managed Ruleset to block SQLi via unsanitized request parameters at Block action.
  • New detection rule (ebd3f2df15c74ddcbf6220c9b5ec246a) added to Cloudflare Free Ruleset to block unauthenticated RCE at Block action.
  • New detection rule (db003b39b7774859a8d588ce33697a1a) added to Cloudflare Free Ruleset to block SQLi at Block action.

4 details in Everything

Was this useful?
Cloud & Container Security
◆  Container & Image Security

Sigstore cosign

Sources Release notes → v3.1.2 Notes

Code signing and transparency for containers and binaries

cosign v3.1.2 adds a bundle inspect command and a --base-config flag for signing-config overrides.

└──▷ GET THIS VERSION 
$ git clone --branch v3.1.2 https://github.com/sigstore/cosign.git
# already have the repo? check out this version:
$ git checkout v3.1.2
└──▷ TRY IT
Inspect a local cosign bundle file to examine its contents and structure.
$ cosign bundle inspect <bundle-file>
Override specific services from a base signing config when configuring cosign for a custom environment.
$ cosign signing-config --base-config <base-config-file>
  • Adds cosign bundle inspect command to examine cosign bundle files.
  • Adds --base-config flag to the signing-config command to override services from a base config.

2 details in Everything

Was this useful?
Detection & Response
◆  Endpoint Security (EDR/XDR)

Microsoft Defender

Sources Blog / feed → changelog · Jul 17, 2026 Blog

Microsoft Defender is a built-in security tool that protects Windows devices from malware, viruses, ransomware, and other cyber threats in real time.

  • New Microsoft Defender Experts Threat Intelligence service delivers continuous, curated, expert-led intelligence tailored to an organization.
  • Microsoft Defender Experts MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. extended with third-party and multicloud coverage.
Was this useful?
Identity, Access & Data Protection
◆  Data Security & DLP

Immuta

Sources Release page → updated · Jul 18, 2026 Notes

Immuta is a data security platform that automates access control, privacy policy enforcement, and data governance across cloud data environments.

└──▷ HOW TO FIND IT
Access in-product documentation and ask questions in natural language without leaving Immuta.
📍In the Immuta UI, click the Documentation icon in the top menu, then type your question into the AI-powered documentation chatbot.
Switch the Alation integration to OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. to eliminate recurring 90-day API key rotation.
📍In the Immuta console, go to App Settings › Integrations › Alation, select OAuth 2.0 as the authentication method, and enter your OAuth credentials.
  • Supports automated sensitive data discovery (regex, dictionary, and column-name regex identifiers) for the Amazon Redshift viewless integration.
  • Embeds Immuta documentation and an AI-powered chatbot directly in the Immuta UI for in-product search.
└──▷ BREAKING ON UPGRADE
  • !When a data source is disabled, Immuta will revoke data owners' Immuta-managed grants in the data platform (opt-in 6/30–7/31, on by default 8/1, enforced for all 9/1) — workflows that depend on owners retaining access after disabling a source will break.
Was this useful?
◆  Secure Access (VPN / SASE / ZTNA)

Zscaler

Sources Blog / feed → changelog · Jul 17, 2026 Blog

Zscaler is a cloud-based security platform that protects users, devices, and applications by routing traffic through its global network to enforce security policies.

Zscaler launches Zero Trust Enterprise Browser and Browser Detection and Response (BDR) extension to bring Zero Trust into the browser itself.

  • Introduces Zero Trust Enterprise Browser: a purpose-built, fully managed Chromium browser with Zero Trust security integrated directly into the browsing experience.
  • Adds Browser Detection and Response (BDR) via the Zero Trust Browser Extension, delivering browser-native threat detection and response inside existing browsers for threats that evade upstream network and endpoint controls.
  • Delivers three Zero Trust Browser deployment form factors — Cloud Browser Isolation, Browser Extension, and Enterprise Browser — allowing organizations to mix and match based on user, device, and workflow requirements.

3 details in Everything

Was this useful?
Governance, Risk & Compliance
◆  Compliance Automation & Trust Management

Vanta

Sources Release page → July 2026 Notes

Vanta is a trust management platform that automates security compliance, monitors risks, and helps companies achieve certifications like SOC 2, ISO 27001, and HIPAA.

Vanta July 2026 adds internal auditor roles, control assessments, Dropbox deprovisioning, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support, and 8 more capabilities.

└──▷ TRY IT
Use the Vanta Agent's /triage-issues shortcut to immediately surface the highest-priority compliance gaps without manually scanning every control.
$ In the Vanta Agent chat, type: /triage-issues
  • Adds version-specific policy selection when attaching policies as evidence to information requests, giving auditors precise control over which policy version is submitted.
  • Enables auditors to formally assess controls directly in Vanta for internal and external IRL audits, with framework-specific statuses (Conforming/Non-conformity for ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability.; Satisfied/Not Satisfied for FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one.) and required justification comments.
  • Introduces an Internal Auditor Role, allowing an internal employee to be designated as auditor on an internal audit engagement with a scoped IRL, request tracker, and population views without requiring an external audit firm.
  • Adds Custom Commitment Types for Customer Commitments, letting users define their own contract commitment types with a name, definition, and example clauses — Vanta automatically extracts them from future and previously uploaded contracts.
  • Enables the Vanta Agent to assign control owners inline during agentic Control Program Onboarding, with validation of missing descriptions, ineligible owners, and ambiguous entries before bulk-review commit.
+7 more show less
  • Adds GA support for automatic Dropbox account deprovisioning during personnel offboarding, removing departing employees from their Dropbox team account, synced devices, and Paper documents.
  • Supports duplicating existing IRL audits to carry forward request lists, control mappings, and configuration into the next audit cycle, with automatic fresh evidence attachment.
  • Adds the official SIG Lite questionnaire as a fifth out-of-the-box TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. template, licensed by Vanta, with AI answer generation, vendor Exchange flow, and standing-answer reuse.
  • Introduces MCP support for Customer Commitments, enabling natural-language queries from Claude, Copilot, Airtable, and other MCP-compatible AI tools, and programmatic access to commitments data.
  • Adds '/' skill shortcuts in the Vanta Agent (Proof of Concept), with preset commands /triage-issues, /evaluate-evidence, and /explore-capabilities to steer the Agent toward specific compliance tasks.
  • Supports uploading multiple audit reports per audit engagement, removing the previous single-report limitation for multi-framework scenarios.
  • Enables bulk auditor assignment for audit engagements, allowing multiple auditors to be added at once instead of one at a time.

12 details in Everything

Was this useful?
Build
◆  AI Coding Agents

Cursor

Sources Release page → Improvements to Cursor in Slack Notes

Cursor is an AI-powered code editor that helps developers write, edit, and understand code faster using built-in AI assistance.

Cursor in Slack adds upfront planning, multi-repo environment support, and cross-channel read/write workflows.

└──▷ HOW TO FIND IT
Kick off a task that spans multiple repos so Cursor automatically targets the right multi-repo environment instead of a single default repo.
📍In Slack, mention @Cursor with your request (e.g., '@Cursor update the API contract in the backend and reflect it in the frontend'). Cursor reads the request and selects the named multi-repo environment that covers both repos. If it needs an additional repo mid-task, click the Switch repository button it surfaces, choose the repo or environment, and it resumes.
Leverage cross-channel context so Cursor can pull information from a separate channel and post results back without manual copy-paste.
📍In Slack, mention @Cursor in your thread (e.g., '@Cursor summarize the decisions from #architecture-review and draft an implementation plan here'). Cursor reads the target channel and posts the output back in your original thread.
  • Cursor now shares a plan before starting a task in Slack, letting you redirect it before work begins.
  • Live status updates show each step as Cursor works through a task in Slack.
  • Supports named multi-repo environments from Slack, letting Cursor access frontend, backend, and shared code across separate repos in a single session.
  • Mid-task repo switching via a Switch repository button lets Cursor resume work after changing to a different repo or environment.
  • Cross-channel workflows enable Cursor to read context from other Slack channels and threads and post updates back to the relevant channel or thread.

5 details in Everything

└──▷ BREAKING ON UPGRADE
  • !In-message buttons are removed and replaced by compact footer links, which will change existing interaction patterns for users who relied on those buttons.
Was this useful?

Claude Code

Sources Release notes →Source code → v2.1.214 Notes Code

Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.

Claude Code v2.1.214 adds EndConversation tool, OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. message correlation attributes, docker daemon-redirect permission prompts, and more.

└──▷ GET THIS VERSION 
$ git clone --branch v2.1.214 https://github.com/anthropics/claude-code.git
# already have the repo? check out this version:
$ git checkout v2.1.214
└──▷ TRY IT
Cap OTel content attribute size below the default 60 KB to stay within your observability backend's event-size limits.
$ CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH=16384 claude
  • Adds the EndConversation tool so Claude can autonomously terminate sessions involving highly abusive users or jailbreak attempts.
  • Adds a periodic progress heartbeat for long-running tool calls that previously went silent.
  • Adds an ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. modified timestamp to memory file frontmatter.
  • Adds message.uuid, client_request_id, and tool_source attributes to OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. log events for message-level correlation and tool provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build..
  • Adds CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH environment variable to configure the 60 KB truncation limit on OpenTelemetry content attributes.
+2 more show less
  • Adds reasoning effort to the subagentStatusLine payload so custom agent rows can render model and effort.
  • Adds permission prompts for docker commands (including the Podman docker shim) carrying daemon-redirect flags (--url, --connection, --identity, and Podman's remote mode).

7 details in Everything

└──▷ BREAKING ON UPGRADE
  • !Single-segment dir/** hook if: conditions now match only <cwd>/dir; write **/dir/** to match at any depth.
  • !file commands using -m/--magic-file or -f/--files-from now require permission instead of being auto-allowed as read-only.
  • !SessionStart hooks now report source "fork" when a session begins as a fork instead of "resume".
Was this useful?

OpenAI Codex CLI

Sources Release notes →Source code → rust-v0.145.0-alpha.22 Notes Code Pre-release

Lightweight coding agent that runs in your terminal

Codex CLI alpha.22 stabilizes the memories feature, adds managed Bedrock login, and imports plugins from known marketplaces.

└──▷ GET THIS VERSION 
$ git clone --branch rust-v0.145.0-alpha.22 https://github.com/openai/codex.git
# already have the repo? check out this version:
$ git checkout rust-v0.145.0-alpha.22
  • Stabilizes the memories feature flag, making it generally available in the CLI.
  • Adds a managed Bedrock login API for authenticating with AWS Bedrock as a provider.
  • Imports enabled plugins automatically from known marketplaces.
  • Makes GPT-5.6 Sol the default model for Bedrock sessions.
  • Adds dedicated storage for paginated thread history, enabling larger conversation histories.
+7 more show less
  • Exposes scheduled tasks in plugin details.
  • Supports personality = "none" in model instructions to suppress default personality prompts.
  • Supports pending remote environment registration.
  • Adds a skill invocation extension contributor for extensible skill execution.
  • Updates bundled OpenAI Docs skill with GPT-5.6 content.
  • Reduces startup latency via optimized ancestor discovery.
  • Performance improvement: reuses walk inventory for host skill loading, reducing round trips on high-latency connections.

12 details in Everything

Was this useful?
// END OF TRANSMISSION

The Cyber Toolchain · curated daily · July 18, 2026
Releases & features from the open-source and commercial cyber tools that practitioners actually run.

▷ Subscribe
cyber-toolchain / feedback

Feedback on

compare.md

    Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

    my-toolchain — 0 tools

      Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
      browse all tools → score card for your toolchain →
      cyber-toolchain / feedback

      Send us feedback