The Cyber Toolchain — issue 020, July 20, 2026

Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

Strix v1.1.0 adds 9 new security skills, SARIF 2.1.0SARIF 2.1.0A JSON-based file format, standardized by OASIS, for expressing static analysis results so that cyber tools from different vendors can share findings through a single, machine-readable schema. output, budget controls, and multi-target list scanning.

$ git clone --branch v1.1.0 https://github.com/usestrix/strix.git
# already have the repo? check out this version:
$ git checkout v1.1.0

$ strix --target-list ./targets.txt

15 details in Everything

The recursive internet scanner for hackers.

BBOT 3.0 brings new HTTP/DNS engines, unified findings, 10+ new modules, and pydantic-validated config.

$ git clone --branch v3.0.0 https://github.com/blacklanternsecurity/bbot.git
# already have the repo? check out this version:
$ git checkout v3.0.0

$ bbot --reset-config

19 details in Everything

Portkey is an AI gateway and observability platform that helps developers manage, monitor, and optimize LLM API calls with routing, caching, and reliability features.

In your Portkey config, add the Zscaler AI Guard guardrail with your policyId:
{
  "guardrails": {
    "beforeRequestHook": {
      "provider": "zscaler",
      "policyId": "<your-zscaler-policy-id>",
      "timeout": 10000
    },
    "afterRequestHook": {
      "provider": "zscaler",
      "policyId": "<your-zscaler-policy-id>",
      "timeout": 10000
    }
  }
}

$ Set these environment variables on your gateway deployment:
GCP_WIF_AUDIENCE=<your-wif-audience>
GCP_WIF_SERVICE_ACCOUNT_EMAIL=<your-sa>@<project>.iam.gserviceaccount.com

Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.

Noir v1.2.0 adds CLI app surface detection, 9 stdlib HTTP servers, schema-driven APIs, enterprise legacy stacks, and major perf gains.

$ git clone --branch v1.2.0 https://github.com/owasp-noir/noir.git
# already have the repo? check out this version:
$ git checkout v1.2.0

14 details in Everything

DataDome is a bot protection and fraud prevention platform that detects and blocks malicious traffic, scraping, and cyberattacks in real time.

DataDome Fastly Compute 1.4.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. protocol support with HTTP message signature collection per RFC 9421RFC 9421An IETF standard defining HTTP Message Signatures, a scheme for cryptographically signing HTTP requests and responses so tools can verify message integrity and authenticity end-to-end..

datadome_mcp_endpoint = "/mcp"

3 details in Everything

iOS Logs, Events, And Plist Parser

iLEAPP v2026.2.0 adds Biome, C2PA AI provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., and United Airlines artifacts with full iOS 26 and Python 3.13/3.14 support.

$ git clone --branch v2026.2.0 https://github.com/abrignoni/iLEAPP.git
# already have the repo? check out this version:
$ git checkout v2026.2.0

$ ileapp -t zip -i /path/to/ios26_extraction.zip -o /path/to/output/

$ ileapp -t fs -i /path/to/extraction/ -o /path/to/output/ -m /path/to/biome_c2pa.ilprofile

8 details in Everything

State-of-the-art native debugging tools

HyperDbg v0.22 adds linked-list traversal commands, struct support in the script engine, and a pname filter for !pt.

$ git clone --branch v0.22 https://github.com/HyperDbg/HyperDbg.git
# already have the repo? check out this version:
$ git checkout v0.22

6 details in Everything

$ git clone --branch v0.21 https://github.com/HyperDbg/HyperDbg.git
# already have the repo? check out this version:
$ git checkout v0.21

#supply #chain #attack #detection

malcontent v1.25.0 adds guarddog v3 rules and refreshes third-party YARA rule sets for improved supply-chain threat detection.

$ git clone --branch v1.25.0 https://github.com/chainguard-dev/malcontent.git
# already have the repo? check out this version:
$ git checkout v1.25.0

$ mal scan --third-party <path-to-package-dir>

3 details in Everything

A rewrite of YARA in Rust.

YARA-X v1.19.0 adds missing PE machine types and new compiler warnings for single-byte and duplicate patterns.

$ git clone --branch v1.19.0 https://github.com/VirusTotal/yara-x.git
# already have the repo? check out this version:
$ git checkout v1.19.0

3 details in Everything

Vectra AI is a cybersecurity platform that uses AI-driven threat detection and response to identify and prioritize attacks across hybrid cloud, network, and identity environments.

Sophos Central is a cloud-based management platform that unifies administration of Sophos security products, including endpoint, network, email, and cloud protection.

Sophos Central adds Network Map, Live Discover for AP6, DNS Protection APIs, Protected Browser extension, and a wave of new alerts and email capabilities.

34 details in Everything

Trend Vision One is a unified cybersecurity platform that integrates extended detection and response (XDR) across endpoints, networks, email, and cloud environments.

Trend Vision One extends max inactivity and session timeout limits from 8 hours to 12 hours.

2 details in Everything

Transform Linux Audit logs for SIEM usage

Laurel v0.8.0 adds SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. exec hashing, UNIX socket logging, env-var prefix matching, and unified process spawning tracking.

$ git clone --branch v0.8.0 https://github.com/threathunters-io/laurel.git
# already have the repo? check out this version:
$ git checkout v0.8.0

⤢

4 details in Everything

Open Cyber Threat Intelligence Platform

OpenCTI 7.260715.0 adds connector log TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. and ingestion history in Redis, plus authentication validity policy improvements.

$ git clone --branch 7.260715.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260715.0

2 details in Everything

$ git clone --branch 7.260710.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260710.0

$ git clone --branch 7.260309.0-lts.6 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260309.0-lts.6

$ git clone --branch 7.260706.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260706.0

$ git clone --branch 7.260701.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260701.0

$ git clone --branch 7.260626.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260626.0

$ git clone --branch 7.260624.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260624.0

Your Everyday Threat Intelligence

Yeti 2.5.1 adds structured JSON logging, agentic functionalities, and a new session-retrieval endpoint.

$ git clone --branch 2.5.1 https://github.com/yeti-platform/yeti.git
# already have the repo? check out this version:
$ git checkout 2.5.1

3 details in Everything

Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.

Watcher v3.5.0 adds a Timeline audit trail, UDRP approval workflow, a reworked ThreatsWatcher dashboard, and auto-fit table pagination.

$ git clone --branch v3.5.0 https://github.com/thalesgroup-cert/Watcher.git
# already have the repo? check out this version:
$ git checkout v3.5.0

7 details in Everything

Cortex: a Powerful Observable Analysis and Active Response Engine

Cortex 4.1.0 adds audit logging for user actions in analyzer/responder catalogs.

$ git clone --branch 4.1.0 https://github.com/TheHive-Project/Cortex.git
# already have the repo? check out this version:
$ git checkout 4.1.0

Vulnerability Intelligence Platform

OpenCVE 3.0.0 ships Automations — trigger-driven alert and report workflows with conditions, actions, and webhooks.

$ git clone --branch v3.0.0 https://github.com/opencve/opencve.git
# already have the repo? check out this version:
$ git checkout v3.0.0

ENABLE_REGISTER: false

19 details in Everything

Immuta is a data security platform that automates access control, privacy policy enforcement, and compliance monitoring across cloud data environments.

Immuta adds managed groups for agentic policies, Redshift viewless discovery, Delta Sharing enforcement, and OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. for Alation.

6 details in Everything

The authentication glue you need.

authentik 2026.5.5 adds number and boolean support in AKQL queries on JSON fields and licensing usage totals in the admin UI.

$ git clone --branch version/2026.5.5 https://github.com/goauthentik/authentik.git
# already have the repo? check out this version:
$ git checkout version/2026.5.5

2 details in Everything

$ git clone --branch version/2026.2.5 https://github.com/goauthentik/authentik.git
# already have the repo? check out this version:
$ git checkout version/2026.2.5

RegScale is a compliance operations platform that automates and continuously monitors regulatory compliance, security controls, and risk management for organizations.

RegScale 6.32.2.0 expands AI provider support to Azure OpenAI, AWS Bedrock, and OpenAI-compatible endpoints.

1 detail in Everything

CISO Assistant is a one-stop-shop GRC platform for Risk Management, AppSec, Compliance & Audit, TPRM, BIA, Privacy, and Reporting. It supports 150+ global frameworks with automatic control mapping, including ISO 27001, NIST CSF, SOC 2, CIS, PCI DSS, NIS2, DORA, GDPR, HIPAA, CMMC, and more.

CISO Assistant v3.19.2 adds asset sync for ServiceNow, reworked risk acceptance workflow, expanded documents management, and Slovak localization.

$ git clone --branch v3.19.2 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:
$ git checkout v3.19.2

13 details in Everything

$ git clone --branch v3.19.1 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:
$ git checkout v3.19.1

$ git clone --branch v3.19.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:
$ git checkout v3.19.0

$ git clone --branch v3.18.3 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:
$ git checkout v3.18.3

Windsurf is an AI-powered code editor that combines an intelligent coding assistant with agentic capabilities to help developers write, edit, and debug code faster.

Devin Desktop v3.5.17 adds inline network policy controls, Fast Context in Local sessions, and instant worktree-backed sessions.

In user settings (JSON), add:
{
  "workbench.statusBar.visible": true
}

10 details in Everything

Autonomous coding agent as an SDK, IDE extension, or CLI assistant.

Cline CLI v3.0.45 adds Kimi K3 model, halves install size, and surfaces version numbers in hub/doctor status output.

$ git clone --branch cli-v3.0.45 https://github.com/cline/cline.git
# already have the repo? check out this version:
$ git checkout cli-v3.0.45

4 details in Everything

$ git clone --branch sdk/sdk/v0.0.65 https://github.com/cline/cline.git
# already have the repo? check out this version:
$ git checkout sdk/sdk/v0.0.65

Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.

Claude Code v2.1.215 makes /verify and /code-review user-invoked only — no more automatic runs.

$ git clone --branch v2.1.215 https://github.com/anthropics/claude-code.git
# already have the repo? check out this version:
$ git checkout v2.1.215

$ /code-review

$ /verify

1 detail in Everything

Lightweight coding agent that runs in your terminal

Codex CLI gains audio input support, inline visualization links in TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency., and remembered working directory for resumed sessions.

$ git clone --branch rust-v0.145.0-alpha.24 https://github.com/openai/codex.git
# already have the repo? check out this version:
$ git checkout rust-v0.145.0-alpha.24

7 details in Everything

ToolHive is an enterprise-grade platform for running and managing Model Context Protocol (MCP) servers.

ToolHive v0.40.1 adds per-session prompt serving in vMCP and audit logging for authorization denials on the proxy runner path.

$ git clone --branch v0.40.1 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:
$ git checkout v0.40.1

3 details in Everything

$ git clone --branch v0.39.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:
$ git checkout v0.39.0

$ thv llm setup --bedrock

$ git clone --branch v0.38.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:
$ git checkout v0.38.0

$ git clone --branch v0.37.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:
$ git checkout v0.37.0

spec:
  podTemplateSpec:
    metadata:
      annotations:
        my-org/team: security
    spec:
      nodeSelector:
        kubernetes.io/arch: amd64
      containers:
        - name: proxy
          resources:
            limits:
              memory: 256Mi

$ git clone --branch v0.36.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:
$ git checkout v0.36.0

$ git clone --branch v0.35.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:
$ git checkout v0.35.0

$ git clone --branch v0.34.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:
$ git checkout v0.34.0

$ git clone --branch v0.33.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:
$ git checkout v0.33.0

$ git clone --branch v0.32.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:
$ git checkout v0.32.0

$ thv run --transport sse --allowed-origins https://my-web-app.example.com some/mcp-server

Open-Source Evaluation & Testing library for LLM Agents

Giskard Scan adds LIDAR and DeepTeam third-party integrations for broader AI vulnerability coverage.

$ git clone --branch giskard-scan/v1.0.0b3 https://github.com/Giskard-AI/giskard-oss.git
# already have the repo? check out this version:
$ git checkout giskard-scan/v1.0.0b3

2 details in Everything

$ git clone --branch giskard-checks/v1.0.2b5 https://github.com/Giskard-AI/giskard-oss.git
# already have the repo? check out this version:
$ git checkout giskard-checks/v1.0.2b5

$ git clone --branch giskard-core/v1.0.1b5 https://github.com/Giskard-AI/giskard-oss.git
# already have the repo? check out this version:
$ git checkout giskard-core/v1.0.1b5

import asyncio
from giskard.scan import vulnerability_scan

async def main():
    await vulnerability_scan(
        target=my_agent,
        description="A customer support chatbot for an e-commerce platform.",
        languages=["en"],
    )

asyncio.run(main())

result = await suite.run()
hub_payload = result.to_hub_format()

NeMo Guardrails is an open-source toolkit for easily adding programmable guardrails to LLM-based conversational systems.

NeMo Guardrails v0.23.0 adds tool-call rails, HF classifier rails, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. masking, context bloat detection, and a /v1/checks endpoint.

$ git clone --branch v0.23.0 https://github.com/NVIDIA-NeMo/Guardrails.git
# already have the repo? check out this version:
$ git checkout v0.23.0

rails:
  input:
    flows:
      - polygraf pii detection
      - polygraf pii masking

9 details in Everything

A full-stack AI Red Teaming platform securing AI ecosystems via OpenClaw Security Scan, Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.

AI-Infra-Guard v4.1.15 adds optional model token in scan APIs, 6 new llama.cpp CVE rules, and 3 new MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. threat detection rules.

$ git clone --branch v4.1.15 https://github.com/Tencent/AI-Infra-Guard.git
# already have the repo? check out this version:
$ git checkout v4.1.15

3 details in Everything