The Cyber Toolchain — issue 040, August 9, 2026

A single static Go binary implementing AF_XDP-based traffic generation — no cgo, no libpcap, no DPDK, no kernel modules. Fully scriptable via -i, --dst-ip, --packet-size, --pps, -d, -y, and --no-tui flags for wizard-free packet generation, and delivers measured 100G line-rate performance at all frame sizes, including 138 million packets per second for minimum-size frames from a single process.

$ sudo wireblast --no-tui -i eth1 --dst-ip 192.0.2.10 --packet-size 512 --pps 1M -d 30s -y

--mode receive supports --rx-mode filters including udp-port (paired with --rx-port) for counting arriving packets, and adds a keep-management mode allowing broad packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. on a shared NICNICA network interface card or adapter, the hardware that connects a computer to a network. It sends and receives packets over the link. without disrupting the management connection.

$ sudo wireblast -i eth1 --mode receive --rx-mode keep-management -d 60s

$ sudo wireblast -i eth1 --mode receive --rx-mode udp-port --rx-port 9000 -d 60s

Adds IPv6 support, enabling UDP blasts and multi-flow generation across IPv6 destinations, demonstrated in the 022-ipv6-udp and 023-ipv6-flows examples.

$ sudo wireblast -i eth1 --dst-ip 2001:db8::1 --packet-size 512 --pps 1M -d 30s

Includes an interactive TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. wizard and live dashboard (Bubble Tea) for guided setup, alongside a --no-tui plain-text mode for CI and scripting. The reset action now also clears drop and error counters alongside rate counters, and per-queue drop lines are hidden by default in the live dashboard to reduce noise.

Adds POST /api/v1/fleet/host_name_template to set or clear a naming template for a team or No team (omitting fleet_id or setting it to 0 targets No team; an empty template clears enforcement without renaming hosts), POST /api/v1/fleet/hosts/{id}/name_template/resend to resend the template to a specific host, and a name_template key under controls in GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. (included in fleetctl generate-gitops output). Enforcement is now visible for macOS, iOS, and iPadOS under Controls > OS settings > Host names with statuses (Enforcing, Verifying, Verified, Failed) and an edited_host_name_template audit activity.

$ curl -X POST https://fleet.example.com/api/v1/fleet/host_name_template \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"name_template": "CORP-$FLEET_VAR_HOST_SERIAL", "fleet_id": 0}'

FLEET_MDM_ENABLE_CUSTOM_DISK_ENCRYPTION (mdm.enable_custom_disk_encryption) is a new cross-platform alias for FLEET_MDM_ENABLE_CUSTOM_FILEVAULT, enabling custom Apple MDM profiles for FileVaultFileVaultApple's full-disk encryption feature built into macOS, using XTS-AES-128 to encrypt the startup volume so that data is unreadable without the user's credentials. and custom Windows configuration profiles for BitLockerBitLockerA full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints. from a single setting.

$ FLEET_MDM_ENABLE_CUSTOM_DISK_ENCRYPTION=true fleet serve --config /etc/fleet/config.yaml

$FLEET_VAR_CERTIFICATE_RENEWAL_ID enables automatic renewal for SCEPSCEPSimple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention. and ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. certificates issued by external CAs (Okta Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions., Okta Verify, Hydrant ACME) when added to the certificate's Subject OU. It replaces $FLEET_VAR_SCEP_RENEWAL_ID, which still works but is deprecated in favor of the new canonical name.

Removes the fleetdm/bomutils Docker dependency from fleetctl package --type pkg; Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. and xar archive are now written in pure Go, removing requirements for Docker, mkbom, or xar.

Adds Zorin OS as a recognized Linux platform with platform=zorin, Linux disk-encryption summary support, .deb installs, label platform filter targeting, and CVE matching against Ubuntu LTS OVAL feeds (Zorin 16 → Ubuntu 20.04, 17 → 22.04, 18 → 24.04). Also adds CachyOS (Arch-based Linux) as a recognized Linux platform.

Adds a certificates list to the host details page for Windows hosts (requires osquery 5.23.1+), showing each certificate's scope (System or User), plus a View certificate modal in Controls > OS settings > Certificates. Also surfaces hardware-bound ACME certificates on macOS host vitals by retrieving them via the MDM CertificateList command when an ACME-bearing configuration profile is installed or re-installed.

Adds an optional platform query parameter to GET /api/v1/fleet/policies and GET /api/v1/fleet/fleets/{id}/policies to filter policies by targeted platform, plus a Targeted platforms column and platform filter dropdown on the Policies page in the UI.

PATCH /api/v1/fleet/configuration_profiles/:profile_uuid lets admins edit existing configuration profiles in place, covering Apple .mobileconfig files, Apple DDM declarations, Windows profiles, and Android profiles.

Admins can define custom host vitals fields, set values per host manually or via the API, and reference them as $FLEET_HOST_VITAL_<id> variables in scripts and configuration profiles.

Fleet now supports uploading up to 10 custom packages for the same software title on a team, enabling deployment of different versions or architectures (e.g. Arm vs. Intel) to label-scoped hosts, with first-added-wins conflict resolution.

Windows configuration profiles using a Fleet-proxied SCEP certificate now report Verified only after Fleet observes the issued certificate on the host, and report Failed when the SCEP proxy returns an upstream error or the certificate is missing an hour after delivery.

The asynchronous live query endpoint POST /api/v1/fleet/reports/run is now listed in the API endpoints catalog, making it grantable to API-only users with a restricted allowlist.

Adds support for escrowing disk encryption recovery keys from Linux hosts using TPMTPMA dedicated hardware chip, standardized by the Trusted Computing Group, that stores cryptographic keys and measurements in tamper-resistant silicon, giving cyber tools a root of trust that software alone cannot fake.-backed full-disk encryption (e.g. Ubuntu 26) via a Fleet-owned snapd recovery key, silently and without end-user prompting.

Enables Microsoft Entra conditional access for self-hosted Fleet Premium instances (previously Fleet Cloud only), gated on the Fleet Premium license tier. As part of this change, the microsoft_compliance_partner.proxy_api_key server configuration has been removed since gating now happens via license tier.

Adds vulnerability (CVE) reporting for Android OS versions on the Software > OS page, including the Android security patch level folded into the OS version string (e.g. Android 16 (2026-05-01)).

Adds support for provisioning macOS users during setup and keeping passwords in sync with any OAUTH ROPG-supporting IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. via Fleet Desktop on macOS 26+ hosts, plus a new UI for configuring Apple account provisioning (FPSSO) in the integrations settings.

/api/mdm/microsoft/auth Windows MDM STS endpoint is removed and now returns a 404. No device ever contacted this endpoint in practice; Windows MDM enrollment via Autopilot, Settings app, and fleetd is unaffected.

Adds support for Python (.py) script-only software packages as custom packages on macOS and Linux hosts, available via the UI, REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., and GitOps.

Adds enrollment profile URL to the macOS tab in the Add hosts modal, with enrollment type selection (company-owned or BYODBYODBring Your Own Device: a policy allowing employees to use personal phones, laptops, or tablets for work, creating a network of unmanaged endpoints that cyber tools must monitor or enforce policy on.) for MDM users.

A one-click control in the Query Log scopes results to a specific query's timestamp and deployment context, with selectable ±5s, ±10s, and ±15s time windows.

A preview of Customizable Dashboards lets admins build and rearrange widget layouts, apply dashboard-wide filters, save named views with personal defaults, and share views publicly or across an MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs.'s organizations.

Organizations Search now supports advanced filtering on Name, Display Name, ID, Metadata (custom key-value pairs), third-party client access policy (allow or block), and app entitlement status. Up to 5 organization filters can be combined simultaneously using AND/OR logic, with filter state persisted in the URL for sharing or bookmarking.

⤢ ⤢ ⤢ ⤢

Varonis Atlas adds Agent Intent-Based Access Control (IBAC) to monitor AI agents for intent drift, validating that an agent's reasoning, tool usetool useA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions., and data access align with its original instructions, and alerting on or blocking deviations. It enables automatic identity quarantine when an agent crosses policy boundaries, blocking all subsequent actions for a defined window, and provides a complete cross-session audit trail for every agent interaction so security teams can confirm agent behavior in real time. It works with agents and AI tools already in use, including Claude Code, Cursor, GitHub Copilot, and Microsoft Copilot Studio, with no replacement of existing tooling required.

⤢

⤢

Prompts queued during a turn now survive interruption — preserved across aborts, drained after a turn aborts itself, with edits made inside the abort window applied rather than lost, and failures reported as run.failed instead of completing silently. Session context stays durable across aborts and hub restarts, so an interrupted session resumes with its prior state, and mid-stream network interruptions occurring before any model output are retried instead of failing the turn.

LiteLLM requests now route through Chat Completions instead of the Responses API, enabling calls against LiteLLM proxies, and Vertex ADC token refreshes now use the configured fetch so they work behind proxies and custom transports.

Emisar now shows a real-time advisory warning when a policy override glob cannot match any action ID (e.g. regex-style patterns like cassandra\.drop_*), flagging deny rules that look protective but cover nothing. The warning is non-blocking, so rules targeting not-yet-installed packs are still allowed.

A new indexed-attention prefill kernel, enabled by default, lifts DeepSeek V4 Flash prompt processingprompt processingThe first phase of inference, where the model reads the whole prompt in parallel before producing its first token. It drives time-to-first-token; decode is the token-by-token phase after it. from 347 to ~449 tokens/s at 15k context (+29%) and from 199 to ~316 tokens/s at 40k context (+58%), while sustaining 33+ tokens/s decode at both lengths.

The engine now advertises the true hardware memory ceiling at startup, adaptively shrinks prefill chunks under Metal memory pressure, and returns a clean 413 error on over-ceiling requests instead of crashing with a Metal OOMOOMAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process.; the flat request timeout that previously killed healthy very-long prefills has also been removed.

On abort or retry, the engine rewinds the live KV cache to the shared prefix instead of re-prefilling from scratch, dropping retry time-to-first-token at 15k context from 46s to 2.3s.