The Cyber Toolchain — issue 024, July 24, 2026

Promptfoo is an open-source tool for testing, evaluating, and red-teaming LLM applications to detect vulnerabilities, improve reliability, and compare model outputs.

$ promptfoo logs

Portkey is an AI gateway and observability platform that helps developers manage, monitor, and optimize LLM API calls with routing, caching, and reliability features.

Portkey adds vault-backed Secret References, weekly rate limits, cross-cloud GCS log delivery, and four new guardrail integrations.

Add Zscaler AI Guard as a guardrail with your policyId:

{
  "guardrails": {
    "beforeRequestHook": {
      "provider": "zscaler",
      "policyId": "<your-zscaler-policy-id>",
      "timeout": 10000
    },
    "afterRequestHook": {
      "provider": "zscaler",
      "policyId": "<your-zscaler-policy-id>",
      "timeout": 10000
    }
  }
}

16 details in Everything

Veracode is a cloud-based application security platform that helps developers identify and remediate vulnerabilities in their code through static, dynamic, and software composition analysis.

Veracode SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. gains malicious package detection, Poetry support, SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation, new agent flags, and Unified Policy for workspaces.

$ srcclr scan . --json=results.json --show-cli

19 details in Everything

Cloudsmith is a cloud-native, universal package management platform that enables teams to securely host, manage, and distribute software artifacts across multiple formats.

Cloudsmith CLI v1.19.0 adds automatic OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. credential discovery for CI/CD and a Docker credential helper for registry auth.

2 details in Everything

GitGuardian Self-Hosted is an on-premise security tool that detects and prevents secrets leakage in Git repositories.

GitGuardian Self-Hosted 2026.7 adds Public Monitoring, native Gerrit scanning, Smart Notifiers, Gateway API routing, and 9 new secret detectors.

celeryWorkers:
  public-monitoring:
    enabled: true

mcpServer:
  enabled: true

10 details in Everything

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

Prowler 5.36.0 adds SageMaker secrets detection, grouped Jira dispatch, cleaner Attack Paths UI, and regionless OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. onboarding.

$ git clone --branch 5.36.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.36.0

⤢ ⤢

6 details in Everything

Docker Sandboxes isolates AI model execution environments to safely test and run untrusted code with controlled resource access.

Docker Sandboxes v0.37.0 adds SSH access to sandboxes, shared agent skills, port publishing, and richer audit records.

$ git clone --branch v0.37.0 https://github.com/docker/sbx-releases.git
# already have the repo? check out this version:
$ git checkout v0.37.0

$ sbx setup ssh

$ ssh my-sandbox.sbx

$ sbx skills import --dry-run && sbx skills import --force

$ sbx run -p 8080:8080 --no-share-skills my-image

6 details in Everything

Instant, Concurrent, Secure & Lightweight Sandbox for AI Agents.

CubeSandbox v0.6.0 adds Kubernetes deployment, E2B-compatible volumes, template aliases, configurable Host headers, and node isolation.

$ git clone --branch v0.6.0 https://github.com/TencentCloud/CubeSandbox.git
# already have the repo? check out this version:
$ git checkout v0.6.0

$ cubemastercli node isolate <node-id>

$ cubemastercli node unisolate <node-id>

14 details in Everything

Corellium is a virtualization platform enabling security researchers and developers to run iOS, Android, and Linux systems virtually for testing and analysis.

Corellium 7.12 adds Metal graphics support, KASAN/HWASAN kernel debugging, PongoOS pre-boot, MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. integration, and folder downloads.

7 details in Everything

Detection Rules are automated security patterns that identify suspicious activities and threats by analyzing event data in real-time.

Elastic Detection Rules dev-v2.0.0 adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v19 support and 80+ new rules across AWS, Azure, Linux, GCP, and network protocols.

$ git clone --branch dev-v2.0.0 https://github.com/elastic/detection-rules.git
# already have the repo? check out this version:
$ git checkout dev-v2.0.0

11 details in Everything

runZero is a continuous asset intelligence platform that discovers, inventories, and monitors all connected devices and software across networks in real-time.

runZero 5.0.260723.0 adds Purdue level visibility for Dragos-enriched OT/ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. assets.

1 detail in Everything

DNSFilter is a cloud-based DNS security platform that blocks malicious websites, filters unwanted content, and protects networks from cyber threats in real time.

DNSFilter redesigns the Query Log with multi-select filters, cross-org switching, and URL-persistent views, plus live local domain sync in the macOS client.

8 details in Everything

Zscaler Private Access provides zero-trust network access to internal applications without exposing them to the public internet.

ZPA gains Autonomous App Shield and Autonomous User-to-App Segmentation to continuously protect and isolate private apps.

3 details in Everything

A scalable overlay networking tool with a focus on performance, simplicity and security

Nebula v1.11.0 adds macOS network-change rebinding, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. rejects, stdin/stdout cert I/O, and six breaking config changes.

$ git clone --branch v1.11.0 https://github.com/slackhq/nebula.git
# already have the repo? check out this version:
$ git checkout v1.11.0

# In config.yml — omit or set to true to enable (the default)
listen:
  rebind_on_network_change: true

13 details in Everything

iDenfy is an identity verification platform that uses AI-powered document scanning and biometric facial recognition to verify user identities and prevent fraud.

Clerk is a user authentication and identity management platform that provides developers with pre-built UI components, APIs, and SDKs for sign-up, sign-in, and user management.

Clerk CLI gains a clerk mcp command group for one-command MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server registration across 10 AI clients, plus configurable default OAuth scopes.

$ clerk mcp install --all

$ clerk mcp install --client claude --client cursor

$ clerk doctor

6 details in Everything

Ping Identity is an identity security platform that provides authentication, single sign-on, multi-factor authentication, and access management solutions for enterprises.

Ping Identity AIC adds email scripting, secrets in nodes, Rich Authorization Requests, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. metadata import options, and a new validate-secrets endpoint.

17 details in Everything

Immuta is a data security platform that automates access control, privacy policy enforcement, and compliance monitoring across cloud data environments.

CISO Assistant is a one-stop-shop GRC platform for Risk Management, AppSec, Compliance & Audit, TPRM, BIA, Privacy, and Reporting. It supports 150+ global frameworks with automatic control mapping, including ISO 27001, NIST CSF, SOC 2, CIS, PCI DSS, NIS2, DORA, GDPR, HIPAA, CMMC, and more.

CISO Assistant gains a native Power BI connector for direct BI integration.

$ git clone --branch powerbi-v1.0.1 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:
$ git checkout powerbi-v1.0.1

Kiro is an AI-powered IDE by AWS that uses "specs" to translate requirements into structured plans, then automatically generates and implements code.

Kiro V3 adds /upgrade-agent command to migrate V2 custom agent configs to the universal format

$ /upgrade-agent

2 details in Everything

AI agent toolkit: unified LLM API, agent loop, TUI, coding agent CLI

Pi v0.82.0 adds constrained tool sampling, OAuth login for OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code./Kimi Code, and streaming bash RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. events.

$ git clone --branch v0.82.0 https://github.com/earendil-works/pi.git
# already have the repo? check out this version:
$ git checkout v0.82.0

$ /login

$ echo "Session: $PI_SESSION_ID | Provider: $PI_PROVIDER | Model: $PI_MODEL | Reasoning: $PI_REASONING_LEVEL"

6 details in Everything

Lightweight coding agent that runs in your terminal

Codex CLI alpha.6 adds remote code-mode host support, nonblocking TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. interrupts, and skill-catalog context warnings.

$ git clone --branch rust-v0.146.0-alpha.6 https://github.com/openai/codex.git
# already have the repo? check out this version:
$ git checkout rust-v0.146.0-alpha.6

$ codex-app-server --code-mode-host wss://example.com/code-mode --listen ws://127.0.0.1:9000

12 details in Everything

$ git clone --branch rust-v0.146.0-alpha.3.1 https://github.com/openai/codex.git
# already have the repo? check out this version:
$ git checkout rust-v0.146.0-alpha.3.1

$ git clone --branch rust-v0.146.0-alpha.5 https://github.com/openai/codex.git
# already have the repo? check out this version:
$ git checkout rust-v0.146.0-alpha.5

Autonomous coding agent as an SDK, IDE extension, or CLI assistant.

Cline desktop v0.0.4 adds workspace-free chat, file drag-and-drop, one-time routines, and agentic compaction by default.

$ git clone --branch desktop-v0.0.4 https://github.com/cline/cline.git
# already have the repo? check out this version:
$ git checkout desktop-v0.0.4

$ cline schedule create "Nightly dependency audit" --cron "0 2 * * *" --prompt "Check for outdated dependencies and open a PR if any are found" --workspace /path/to/repo --mode yolo

11 details in Everything

an open source, extensible AI agent that goes beyond code suggestions - install, execute, edit, and test with any LLM

Goose v1.44.0 adds new model support (GPT-5.6, Gemini, Muse Spark 1.1), new providers, --edit session flag, per-message usage stats, and OllamaCloud integration.

$ git clone --branch v1.44.0 https://github.com/aaif-goose/goose.git
# already have the repo? check out this version:
$ git checkout v1.44.0

$ goose session --edit

15 details in Everything

Get up and running with Kimi-K2.6, GLM-5.2, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models.

Ollama v0.32.3 adds CUDACUDANVIDIA's platform and programming interface for running general computation on its GPUs. Nearly every AI training and inference stack is built on it first. on Windows ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead., B200/CUDA 12 support, Laguna 2.1 model capabilities, and lower iGPU memory use.

$ git clone --branch v0.32.3 https://github.com/ollama/ollama.git
# already have the repo? check out this version:
$ git checkout v0.32.3

5 details in Everything