The Cyber Toolchain — issue 037, August 6, 2026

NodeZero automatically deploys decoy files and credentials — up to two tripwires per asset — along critical attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. during autonomous pentests, placed at points where NodeZero has gained access via a Remote Access Tool (RAT) or direct file write; any interaction triggers an immediate alert. Tripwires are included in NodeZero Elite and Pro license packages and available as an add-on for other tiers. A subsequent update introduced more-flexible Tripwire deployment that reduces reliance on the RAT, cutting Endpoint Detection and Response (EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.) noise during deployments.

Rapid Response exploitability testing now covers Cisco Unified Communications Manager, SonicWall SMA1000, Adobe ColdFusion, and ManageEngine ADAudit Plus, viewable via Rapid Response Details pages showing Asset Breakdown, CVE or H3 IDs, References, and a Relevant Assets table with Action Items and Fix Actions guidance, plus a Take Action menu to run tests, add notes, or create tickets.

⤢ ⤢ ⤢ ⤢

Running subfinder -ls -oJ outputs the available passive sources in JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. format, useful for feeding into automation or auditing which sources subfinder supports.

$ subfinder -ls -oJ

Adds shodanct as a new passive subdomain discovery source, leveraging Shodan's certificate transparency data; can be invoked with subfinder -d example.com -s shodanct.

$ subfinder -d example.com -s shodanct

Snyk API & Web now supports NTLM v2 authentication for Web targets, configurable via Target Settings > Authentication tab in the Basic Auth / NTLM module, with fields for username, password, domain, and workstation. This enables authenticated scans of Windows-protected internal applications without separate tooling.

Adds updatedAfter parameter to support incremental loads of lesson progress data and excludeNotStarted=true to filter out lessons that have not been started. The response now also includes stack and updated_on fields, and surfaces Not Started status when both start_time and end_time are null.

The default Security Labs URL changed from https://securitylabs.veracode.com/ to https://securitylabs.veracode.com/security-labs/; customers using SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. with a stand-alone account must update their configured URL.

Enables export of web applications from EASM directly into DAST Essentials by marking assets as DAST Candidates.

New Security Labs lessons cover all ten OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10:2025 categories, including two new categories: A03 (Software Supply Chain Failures) and A10 (Mishandling of Exceptional Conditions).

New eLearning courses aligned to OWASP Top 10:2025 are available in English, Spanish, French, Portuguese, and Chinese, covering Software Security Awareness and secure coding for .NET, Java, JavaScript, PHP, and Python.

New assessment quiz courses (skills assessments) are available in English, Portuguese, and Spanish for Static Analysis, Dynamic Analysis, SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. agent-based scanning, IDE scanning, and user/application setup.

Adds CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. tagging to Security Labs lessons, enabling admins to search lessons by CWE and learners to see which CWEsCWEsA community-maintained list of software and hardware weakness types, maintained by MITRE, that gives cyber tools a standard taxonomy for classifying and communicating vulnerability root causes. a lesson addresses.

Upgrades OWASP API Security Top 10 coverage in Security Labs from the 2019 list to the 2023 list, adding lessons for three new categories.

The -pcs / -page-content-similar flag (also aliased as -sdd / -similarity-deduplication) enables Layer-2 content similarity filtering to deduplicate near-identical pages during crawls. Mode is set via -pcsm / -page-content-similar-mode (simhash, tfidf, or bm25; default simhash), tuned with -pcsd / -page-content-similar-distance (SimHash max Hamming distance, default 3), -pcst / -page-content-similar-threshold (TF-IDF/BM25BM25The classic keyword-ranking formula behind traditional search engines. Hybrid search combines it with embedding similarity so exact terms and meaning both count. min score 0–1, default 0.85), and -pcsn / -page-content-similar-budget (pages fully processed per similarity cluster, default 1).

$ katana -u https://example.com -pcs -pcsm tfidf -pcst 0.90

The -kb-secrets flag enables a secrets extractor within the knowledge base that automatically detects exposed credentials and tokens during crawls. The -kb-validate-secrets flag validates detected secrets live against their respective providers by sending real API calls.

$ katana -u https://example.com -kb -kb-secrets -kb-validate-secrets

Adds a Context field to the Options struct for external lifecycle control — cancelling the provided context.Context stops the rate limiter, crawl session, queue, known-files requests, and headless browser.

The -kb-endpoints flag enables an endpoints extractor that classifies REST, GraphQL, SOAP, and XHR requests found during crawling.

PostgreSQL credentials detectors now match usernames containing dashes (e.g. workflow-prod-user) and raise the username length bound from 20 to 30 characters.

Seven new detectors were added: Slack Workflow Builder webhook trigger URLs, n8n API keys, Atlassian auth keys (OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. issued by auth.atlassian.com), AWS Cognito User Pool access tokens, OpenAI platform access tokens, Vercel OIDC workload-identity tokens, and OpenCode API keys.

Azure Event Hub and Azure Service Bus checkers now only report a key as valid when the 200 response is a genuine Service Bus Atom feed, blocking false-valid results behind intercepting proxies.

The Next-Gen WAF Rules API and Next-Gen WAF Signals API responses now include a created_by field, identifying the email address of the user who created the rule or signal.

sbx secret set-custom -g --host opencode.ai --env OPENCODE_API_KEY --value stores OpenCode Zen API keys so the real key stays in the host secret store while the sandbox receives a placeholder that the host-side proxy substitutes on requests to opencode.ai. Sandboxes also need sbx policy allow network opencode.ai:443 to reach the OpenCode Zen service.

$ sbx secret set-custom -g \
  --host opencode.ai \
  --env OPENCODE_API_KEY \
  --value "$OPENCODE_API_KEY"

$ sbx policy allow network opencode.ai:443

Requires Docker Sandboxes 0.35.0+ and an AI Governance subscription. The sandbox daemon writes local audit records as .jsonl.jsonlA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. files (JSON Lines) to per-OS paths — ~/Library/Logs/com.docker.sandboxes/sandboxes/auditkit/ (macOS), ${XDG_STATE_HOME:-~/.local/state}/sandboxes/sandboxes/auditkit/ (Linux), %LOCALAPPDATA%\DockerSandboxes\sandboxes\logs\auditkit\ (Windows) — named audit-<utc-timestamp>-<process-uuid>-<seq>.jsonl, finalized by atomic rename at rotation thresholds of 5 minutes, 1000 events, or 50 MiB. Records include evaluation events (resource, action, verdict, deny_reason) and session lifecycle events linked by audit_session_id, with fields like audit_event_id, schema_version, username, org_id, hostname, network_egress. Local delivery supports SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. ingestion via log shippers (Splunk Universal Forwarder, Filebeat, CrowdStrike Falcon LogScale); Docker Cloud delivery (on by default when AI Governance is enabled) additionally powers a hosted audit log view, CSV export, and SIEM streaming from app.docker.com, configurable by org owners or custom-role users. Run sbx policy ls to confirm a Governance: Managed by <org> line, a prerequisite for audit records to be written.

$ sbx policy ls

sbx run --model <name> claude serves a local GGUFGGUFThe single-file model format used by llama.cpp and Ollama, holding the weights, usually quantized, together with the tokenizer and settings needed to run the model locally. model via llmman, or an already-running Ollama install using an ollama/ prefix, routing Claude Code away from api.anthropic.com. Requires enabling sbx settings set platform.allowExperimentalFeatures true and sbx settings set feature.model true first.

$ sbx settings set platform.allowExperimentalFeatures true
sbx settings set feature.model true
sbx run --model llama3.2 claude

Settings-driven upstream-proxy configuration via proxy, proxy.sandbox, proxy.daemon, and matching no_proxy keys defaults to the host OS system proxy and proxies daemon traffic (image pulls, telemetry) too. proxy.integratedAuth enables NTLM/Kerberos/Negotiate proxy authentication on Windows, and tls.allowNegativeSerial supports TLS-inspecting proxies issuing certificates with negative serial numbers. Blocked HTTPS proxy connections now appear in sbx policy log even when the client aborts the TLS handshake.

$ sbx settings set proxy http://proxy.corp.example.com:8080
sbx settings set proxy.integratedAuth true

--deny-network HOST flag on sbx run and sbx create records per-sandbox egress deny rules at creation time, e.g. to block a sandbox from reaching a specific host to prevent exfiltration.

$ sbx run --deny-network api.example.com claude

sbx mcp becomes a first-class, no-longer-hidden subcommand for MCP server management, with sbx mcp add supporting --dir and OAuth override flags; registering a server immediately refreshes the mcp-find/mcp-add index in every running sandbox without recreating them. Dynamic MCP tools mcp-find, mcp-add, and mcp-config-set are now also available in local sandbox mode.

sbx run --gpu (experimental) enables NVIDIA VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space. GPU passthrough on Linux; enable with sbx settings set feature.sandbox-gpu true.

Adds 12 M365 provider checks: admincenter_shared_bookings_disabled (control 1.3.9); defender_priority_account_protection_enabled and defender_strict_preset_security_policy_enabled (controls 2.4.1, 2.4.2); exchange_owa_mailbox_policy_personal_accounts_disabled and exchange_organization_reject_direct_send_enabled (controls 6.3.2, 6.5.5); teams_external_access_trial_tenants_blocked (control 8.2.4); and six device-registration checks — entra_device_registration_join_restricted, entra_device_registration_max_devices_per_user_limited, entra_device_registration_global_admins_not_local_admins, entra_device_registration_registering_user_not_local_admin, entra_device_registration_laps_enabled, and entra_policy_default_user_cannot_read_bitlocker_keys (controls 5.1.4.x), all mapped to CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Microsoft 365 Foundations Benchmark v7.0.0.

Attack Paths adds 20 AWS privilege-escalation detection queries sourced from pathfinding.cloud, covering iam:PassRole escalations across AWS Batch, Braket, Cognito Identity, ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping., EMR, EMR Serverless, GameLift, Glue, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Image Builder, Kinesis Analytics, HealthOmics, EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. Scheduler, SSM, and Step Functions, plus CodeDeploy/Step Functions existing-resource abuse, permissions-boundary removal with role assumption, and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Identity Center permission-set policy injection.

Attack Paths query metadata now exposes an outcome category (Code execution, Privilege escalationPrivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., Public exposure, or Resource inventory) on the queries endpoint, enabling terminal outcome nodes in the graph.

iam_policy_allows_privilege_escalation check gains 22 additional escalation combinations from pathfinding.cloud across AWS Batch, Braket, CodeDeploy, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, and EventBridge Scheduler.

SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. now supports one primary email domain plus up to 19 additional domains under a single Identity Provider configuration and a single stable ACS URL (Prowler Cloud/Private Cloud).

⤢

Wiz adds automated DISA STIG compliance assessment covering Amazon Linux 2023 (AL2023 V1R2 and V1R3 benchmarks) and Windows Server 2025, filling gaps where official SCAP content is not yet available. It delivers continuous hardening validation for federal agencies and defense contractors operating in AWS GovCloud, supporting FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. Rev5, FedRAMP 20xFedRAMP 20xA GSA-led overhaul of the FedRAMP cloud-authorization program aimed at cutting compliance burden through continuous, automated evidence collection rather than point-in-time audits, letting vendors reach federal markets faster., CMMC, and DoD authorization requirements.

Adds DISA STIG Amazon Linux 2023 benchmark support via Host Configuration Rules (HCR), providing continuous agentless assessment across all connected cloud instances without SCAP content or scan credentials. Enable it in the Wiz portal under Compliance Posture > Manage Frameworks by searching for DISA STIG Amazon Linux 2023 — assessment begins automatically for all connected instances.

Adds DISA STIG Microsoft Windows Server 2025 benchmark support via Host Configuration Rules (HCR), with an initial automated rule set and expanding coverage planned in upcoming releases. Enable it via Compliance Posture > Manage Frameworks by searching for DISA STIG Microsoft Windows Server 2025 — new instances are assessed automatically on deployment.

The Software Update Library Item now supports Apple beta program enrollment, allowing end users to opt-in or letting admins enforce a specific beta program without tying it to a specific version.

A new to_iceberg operator writes events directly into Apache Iceberg tables through a REST catalog, with mode (create_append, create, append), partition_by supporting hidden-partition transforms (year, month, day, hour, bucket, truncate), plus max_size, timeout, and buffer_size for file rotation. It writes zstd-compressed Parquet with automatic schema evolution for heterogeneous streams, and connects to S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. stores via aws_iam, s3_endpoint, s3_path_style, bearer-token catalogs via token, AWS Glue/Amazon S3 Tables via catalog_aws_service, and Google BigLake via gcp_service_account_key or gcp_auth.

$ subscribe "ocsf"
ocsf::cast
to_iceberg "security.ocsf", catalog = "https://catalog.example.com", partition_by = [class_uid, day(time)]

$ subscribe "ocsf"
ocsf::cast
to_iceberg "security.ocsf", catalog = "https://catalog.example.com", partition_by = [class_uid, day(time)]

New config keys reduce startup time and memory on nodes with many partitions: tenzir.index.load-concurrency tunes worker threads for concurrent partition synopsis loading (defaults to hardware concurrency); tenzir.index.lazy-sketches defers Bloom-filter sketch loading to query time, bounding warm memory via an LRU cache sized by tenzir.index.sketch-cache-bytes (default 1 GiB); and tenzir.index.skip-synopsis-verification skips recursive FlatBuffers verification of partition synopses at startup, trading corruption robustness for speed on trusted networked storage such as NFS.

tenzir.index.load-concurrency: 16
tenzir.index.lazy-sketches: true
tenzir.index.sketch-cache-bytes: 2147483648
tenzir.index.skip-synopsis-verification: true

tenzir.index.lazy-sketches: true
tenzir.index.skip-synopsis-verification: true
tenzir.index.sketch-cache-bytes: 2147483648  # 2 GiB
tenzir.index.load-concurrency: 16

A new read_netflow operator automatically decodes NetFlow v5, NetFlow v9, and IPFIX from byte streams and UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. envelopes in a single pipeline, learning templates per exporter and preserving unknown elements as blobs, with no manual parser configuration or protocol pre-selection needed.

$ accept_udp "0.0.0.0:2055", binary = true
read_netflow

$ accept_udp "0.0.0.0:2055", binary = true
read_netflow

The tenzir.validate-store-batches config key fully validates every Arrow record batch read from a persisted Feather store, helping diagnose on-disk corruption including malformed UTF-8; disabled by default.

ocsf::cast with encode_variants=true now encodes free-form objects such as unmapped significantly faster, lowering CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage for high-volume streams, and ocsf::cast with null_fill=true now uses significantly less memory and CPU by avoiding per-batch column rebuilds.

Mobot supports playbook creation and editing via natural-language chat: you describe the automation you want, Mobot checks available integrations, asks clarifying questions, proposes a plan, configures each step, and saves the result as a draft for review and publishing.

CVEs can be filtered by attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. — attack vector, privileges required, and user interaction — to isolate unauthenticated, no-interaction reachable vulnerabilities.

⤢

Filtering by patch policy thresholds supports CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. score cutoffs, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. probability cutoffs, or both combined, letting teams isolate CVEs that breach both thresholds simultaneously to match internal patch policies.

⤢

A Latest Atlassian Security Release filter in the Vulnerability Intel Agent always points to the most recent Atlassian advisory, ingested within minutes of publication, eliminating the need for manual updates each cycle.

Filtering supports scoping Atlassian CVEs down to specific products in a team's stack, such as Confluence Data Center, Sourcetree, and Jira, to surface only relevant exposures.

⤢

Intent-driven routines let practitioners define an objective, guardrails (e.g., 'Never launch a credentialed scan against anything tagged OT,' 'Open no more than twenty-five tickets in a run'), and a cadence (on-demand or scheduled) in plain natural language — no scripts required.

Before writing any changes, Hexa presents a plan showing device count, device list, policy, deployment window, and blast radius, and requires explicit approval before proceeding.

New Age Estimation section in the dashboard for browsing, filtering, searching and inspecting sessions, with a New estimation form exposing Minimum age (1–120), Safety margin (0–20 years), ID verification for uncertain results, Retry limit (1–3), Save selfie photo, and Link expiry time across General settings and Verification redirects tabs. Supports a per-session Webhook URL override and per-outcome redirect URLs (Success, Underage, Uncertain); the session list groups results into Results, Needs Attention, In Progress, Expired with filtering by client ID/creation date and search by session ID or client reference; session detail view surfaces a Step-up link to the underlying identity verification. Step-up Document Scans bill from Age Estimation finances rather than counting against document scan usage; viewing requires the View age estimation data permission and creating sessions requires MANAGE_AGE_ESTIMATION.

⤢

Selfie-only minimum-age check that avoids a document scan in the common case; triggers an automatic document step-up to read an exact date of birth from the ID and compare the ID portrait against the capture selfie when the AI model lacks confidence. Session outcomes SUCCESS, UNDERAGE, UNCERTAIN, FACE_MISMATCH, ATTEMPTS_EXCEEDED are delivered via a signed Age Estimation Webhooks HTTP POST with idempotent delivery as soon as a session finishes; lifecycle statuses PENDING, PROCESSING, COMPLETED, FAILED, EXPIRED are returned by the Partner API, which pre-checks finances and rejects requests with 402 when funds are insufficient. Billed from a dedicated Age Estimation finances pool separate from standard KYCKYCKnow Your Customer — a regulatory requirement that financial services verify the identity of their users before granting access, used by cyber tools handling payments or financial data to stay compliant. charges.

⤢

New Email template configuration under Business Verifications → Configurations → Email template lets teams create branded emails for three template types — a new business verification session URL, a renewed session URL requesting an information update, and a completed-company verification result — with an Add verification link action that inserts a session URL placeholder into the email body.

⤢ ⤢ ⤢

New KYB API enables company verification via registry data retrieval, beneficial owner screening, and AML checks, with dashboard-based compliance reviews. A Stakeholder Roles reference documents five roles — CEO, Representative, Shareholder, UBOUBOuBlock Origin, a browser extension maintained by Raymond Hill that blocks ads and trackers using filter lists; cyber tools embed or reference it to strip unwanted content from web traffic or scraped pages., and ABO — including mappings for partnerships, foundations, and holding chains.