The Cyber Toolchain — issue 046, August 15, 2026

A new DNS records (csv) report type under Organization > Reports exports a point-in-time inventory of discovered assets — names, types, and discovery source — filterable by creation date range. Generated reports are emailed when ready and remain accessible to all Owner roles from the Reports page as timestamped snapshots.

A new Vulnerability Detections tab under Organization > AI Analytics lets Owners filter by date range, vulnerability priority, asset group, and asset owner to scope posture views to a specific business unit or asset owner before a leadership review.

⤢ ⤢ ⤢ ⤢

Adds PATCH semantics to scan profile and policy API endpoints, allowing partial updates that preserve existing values without resubmitting the full configuration object.

CSP Builder generates a suggested Content-Security-Policy from hosts c/side has already observed on your site, covering seven directives: script-src, connect-src, img-src, style-src, frame-src, font-src, and media-src. You can review the suggested policy, toggle off unexpected hosts, and add hosts not yet observed before deploying, and the workflow supports deploying a report-only header first, monitoring violations in the dashboard, then switching to enforce mode once the policy is clean.

⤢

Custom regex detectors (beta), wired in via the detectors field of the TruffleHog config YAML with keywords, name, regex, and verify (with endpoint, headers, unsafe) sub-keys, gain a set of tuning parameters: successranges under verify to specify HTTP status codes or inclusive ranges (e.g. '200-202') that mark a secret as live/verified; rotatedranges under verify to specify codes or ranges (e.g. '401', '403') that mark a secret as definitively rotated/unverified; entropy to filter detected strings by randomness score and cut false positives; exclude regexes capture to strip sub-portions of a detected secret from the reported result; exclude regexes match to suppress entire matches from being reported; exclude words to ignore strings containing specified words; and primary regex name to designate which named regex pattern determines the reported line number when multiple regexes are defined under the regex field, with capture groups for extracting specific secret segments and a requirement that all named regexes match for a detection to succeed.

detectors:
  - name: hogtokendetector
    keywords:
      - hog
    regex:
      token: '[^a-zA-Z0-9+\/]{0,1}([a-zA-Z0-9+\/]{40})[^a-zA-Z0-9+\/]{0,1}'
    verify:
      - endpoint: http://localhost:8000/
        unsafe: true
        headers:
          - "authorization: super secret authorization header"
        successranges:
          - "200"
        rotatedranges:
          - "401"
          - "403"

New Activity Log gives a top-level view of scan lifecycle events — scan started, scan completed, scan failed, scan scheduled, and scan anomaly detected — across every source, filterable by date range, event, status, source, and actor, with filters stored in the page URL for shareable views; events are append-only with 90-day retention. Scan events carry one of six statuses — success, partial, failure, in progress, scheduled, or warning — shown as color chips, and anomaly-detection heuristics flag completed scans that scanned no data or finished suspiciously fast. Each row opens a detail drawer with full message text and a direct, shareable URL. A read API is available so scan failures can be routed into external monitoring and alerting tools, with API documentation shipping alongside it; source IDs are exposed via the API only. Archiving a source preserves its Activity Log history, while deleting a source removes its events along with its findings.

Adds --sarif flag for SARIF-format output compatible with GitHub code scanning's github/codeql-action/upload-sarif action, tracking findings as new/fixed across scans.

$ trufflehog git https://github.com/your-org/your-repo --results=verified,unknown --sarif > results.sarif

A source can be archived to stop scanning while retaining all findings with triage history intact, accessible from the three-dot menu on a source row in Integrations; show archived reveals archived sources, and archiving requires admin or editor role. Archived sources are now filtered server-side in the sources list, keeping the integration list responsive for large deployments.

TruffleHog Enterprise adds Slack as a listed app in the Slack Marketplace, scanning messages, threads, and attached files for credentials and verifying each finding as live or not. Continuous scanning covers public channels, private channels the app is invited to, DMs, and group DMs, with edited messages rescanned and the app auto-joining new public channels. Historical scanning covers messages, threads, and attachments including archives, base64-encoded data, binaries, and Microsoft Office documents, with include/exclude lists to scope channel coverage and resumable scans after interruption.

Adds aws analyze for customers on the Analyze SKU — resolves effective permissions, discovers IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role chaining paths, and warns on IAM conditions and policy variables.

Adds 16 new detectors to Enterprise scanning: Braintrust, Cloudflare API Token, Cloudflare Global API Key, Cloudinary, Duffel, Duo, GitLab OAuth, HashiCorp Vault Token, HashiCorp Vault Batch Token, New Relic Insights Insert Key, Octopus Deploy, pganalyze Read Key, Pinecone, Red Hat Pyxis, Shippo, and SonarQube Cloud — the SonarQube Cloud scoped organization token, Duo API secret key, and Cloudflare detectors are new in both Enterprise and open source. Also adds recognition of the new 2026 prefixed Cloudflare credential formats for both the Cloudflare API Token and Global API Key detectors in Enterprise and open source.

Scanning stops immediately when a source is archived, including in-flight scans. Verification only freezes for a finding once every source behind it is archived; frozen findings retain their last verification status and are excluded from MTTR calculations.

A new API endpoint lets practitioners set a custom validity status (valid or invalid) on secrets from internal or private systems, requiring a personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. with the secrets:write scope. The status is displayed as Custom validity with the date it was set on every incident tied to that secret, surfaces in filters, severity and downstream incident workflows, and setting or removing it is recorded in both the incident activity log and the audit log.

Adds stale-allowlist detection and always-on NOT CHECKED reporting to admin/scripts/check_claim_language.py, closing a coverage-audit gap present in ALEAPP but not the other LEAPP cores.

Adds Telegram for Android artifacts covering accounts, chats, peers, group/channel members, VoIP call logs, and service message actions parsed from cache4.db and shared preferences.

Adds Snapchat arroyo.db conversation parsing, including recovery of WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites.-only rows with row-provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. columns.

Adds Signal for Android parsing with full SQLCipher decryption, attachment and thumbnail decryption, and message-linking.

Adds Telegram artifacts for iOS: Accounts (from accounts-metadata/atomic-state and Postbox t0), Contacts & Peers (full t2 peer dump with avatar images and Spotlight cache), Chats (Postbox chat list), Cached Peer Details (Postbox t18), Device Contacts (Postbox t54), Peer Presence, and Message Tags.

Adds parsing of *.PLSQL.gz rotated PowerLog archives, decompressed to a session temp directory and reused across all PowerLog artifacts, alongside the existing CurrentPowerlog.PLSQL, with per-archive time-offset correction that extends recoverable history by weeks on most images.

Adds Wickr artifacts parsed from wickrLocal.sqlite and app logs, plus Wickr account identity recovered from the keychain.

Improves license search so prefix matches appear before substring matches in the Add Licenses and Component license pickers, and updates the License Policy page to source the live license catalog and display a retryable error state when the catalog cannot load.

Adds three libFuzzer targets under test/fuzz/ — fuzz_pcap, fuzz_fragroute, and fuzz_services — built against ASan/UBSan and submitted to OSS-Fuzz for continuous fuzzing of the pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. parser, the fragroute rules engine, and the tcpprep --services parser.

Adds a dependency-free unit test suite under test/unit/, runnable via make check or ctest.

New beta feature lets teams run phishing campaigns prioritized by the attack patterns Sublime is already detecting in the customer's environment. Campaigns support sending multiple templates per campaign with staggered delivery schedules, and a cross-campaign dashboard tracks click rates, report rates, and repeat clickers with recipient-level detail per campaign. Available to all customers during Beta; at GA it will move to a paid Sublime Tailored Phishing Simulations and Training add-on, enabled by contacting Sublime Support.

⤢

Adds a Layers tab in the Resource Details drawer for container images, listing every layer grouped by base image or Application Layers, with the Dockerfile instruction and per-severity vulnerability counts for each layer; selecting a layer filters the Vulnerabilities tab. Adds a Layer filter on the Findings view to slice the CVE list by a specific image layer directly. Adds Layer Number and Layer Command fields to the Findings Details drawer and findings panel showing which layer and Dockerfile instruction (e.g. RUN apt-get install -y curl) introduced the affected component — selecting the Layer Command opens the Layers tab for deeper inspection.

⤢ ⤢ ⤢ ⤢ ⤢ ⤢ ⤢

Adds Base Image Allow List and Base Image Deny List rules under Image Configuration in rule bundles, accepting base image pull strings to approve or block entire registries or namespaces in a single entry.

Adds a Vulnerability Policies tab in the Resource Details drawer, opened from Vulnerability Findings, showing how each resource was evaluated against configured Vulnerability Policies. A details panel per rule surfaces CVEs, affected components, and remediation guidance, and exceptions can be created directly from the drawer.

Cribl Privacy 2.1 introduces a new AI-based telemetry privacy detection model family for Cribl Guard, delivering 64%–163% higher detection throughput and 13%–24% lower average memory use versus Privacy 2.0, with F1 accuracy held steady or improved and CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. utilization unchanged. A new model pruning and distillation pipeline shrinks feed-forward layers by 75% or more and trains a smaller student model against the original frozen teacher to recover near-equivalent detection quality at higher throughput. It introduces a three-tier lineup — Fast (maximum throughput), Base (balanced), and Pro (maximum detection accuracy, coming soon) — so operators can pick an accuracy/throughput/resource tradeoff per pipeline, trained on data enriched with feedback from production Guard customers. It also previews cribl-privacy-3.0-pro, a forthcoming larger, high-accuracy model for lower-volume, accuracy-sensitive workloads, alongside additional personalization controls for tuning detections per environment.

⤢

Extends window operator with processing-time (omit on), count-based (unsigned size), and trailing windows (trailing=true), exposing the triggering event through $window.event; adds a trigger expression to selectively fire subpipelines and tolerance for bounded reordering of late events.

$ window size=5min, trailing=true, on=ts {
  summarize rolling_bytes = sum(bytes)
  this = { ...$window.event, rolling_bytes: rolling_bytes }
}

Adds path= and rules= named arguments to the sigma operator — path= accepts a file, directory, or mixed list (searched recursively) and rules= embeds YAML rule strings directly in a pipeline, with positional path now deprecated — and implements the full Sigma v2.1.0 detection rule surface, including exists, cased, neq, windash, fieldref, UTF-16 encoding modifiers, re sub-modifiers i/m/s, time-part modifiers minute through year, list-form OR conditions, and global filter rules targeting rules by id or name (or rules: any for all compatible sources). Also adds tenzir.metrics.sigma events emitted per batch reporting input event count, rule evaluations, and matches, and Sigma matches now output as OCSF Detection Findings.

Passing a rule path positionally to the sigma operator now emits a deprecation warning (use path= instead); several Sigma modifiers that were previously silently misinterpreted now match correctly, changing results for rules relying on the old behavior; Sigma wildcards now treat all regex metacharacters literally and match across newlines (so a+b no longer accidentally matches ab); field names containing dots now deterministically prefer an exact top-level key before nested traversal; and Sigma rules with custom taxonomies or expand placeholder expansion are now rejected with an explicit diagnostic instead of being silently accepted.

Enables parallel pipeline execution via a // parallelism: <n> leading comment or the --parallelism flag on the tenzir binary, running CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware.-bound operators across multiple cores while preserving per-operator semantics.

Adds output: 'events' option to the summarize operator to attach final aggregate values to every event in a finite input (TQL equivalent of Splunk eventstats), and adds an incremental summarize output for running aggregates on event streams (cumulative event emission for unbounded streamstats-style use cases).

Adds geo_distance(lon1, lat1, lon2, lat2) function returning surface distance in meters, with optional spheroid=true for WGS-84 accuracy.

Adds exp(), log(), and pow() math functions to TQL; log() defaults to the natural base and accepts an optional second argument for arbitrary logarithm bases.

Extends replace function to accept dynamic patterns and replacements (e.g. message.replace(user.name, '<redacted>')); literal calls with an empty pattern leave the subject unchanged.

OpenCVE ships a new REST API v2 with OpenAPI documentation and scoped tokens for integrations. An API Docs link is now visible to all users in the header for easy access to the new documentation.

OpenCVE adds project-level access control with membership roles and enforced ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. across CVE views and dashboard widgets, plus a new project members management UI for administering per-project roles.

The Session API now returns barcode data extracted from scanned ID documents, exposed via id_verifications[].barcodes in the session response returned by GET /v1/sessions/<session_id>.

$ curl -X GET 'https://api.didit.me/v1/sessions/<session_id>' \
  -H 'Authorization: Bearer <token>' \
  | jq '.id_verifications[].barcodes'

A new Risk dashboard at Dashboards > Risk (open beta) shows tiles for apps assessed, business-critical apps, overall residual risk, and apps missing approval, built automatically from Nudge's business criticality tiers and residual risk scores. It includes a risk trend chart that can be filtered to business-critical apps only over time, a business criticality vs. residual risk matrix where clicking any cell reveals the exact apps behind that risk concentration, and a highest-risk apps ranking table ordering apps by risk score so reviewers can see what needs attention first.

Adds dcv_polling_status and dcv_polling_last_checked fields to the Services API responses for certificate requests and DNS name validations, surfacing whether DigiCert's automatic DCV polling is active and when it last ran.

// Example Services API response fragment for a pending order
{
  "dcv_method": "dns-txt-token",
  "dcv_token": {
    "token": "{{dcv_token}}",
    "status": "pending",
    "expiration_date": "2022-02-24T16:25:52+00:00"
  },
  "dcv_polling_status": true,
  "dcv_polling_last_checked": "2026-07-09T22:07:24Z"
}

Adds a Use CN/SANs from CSR option on certificate request forms (DV, OV, EV TLS; QWAC and QWAC PSD2; X9 PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. for TLS; Private TLS) to replace existing Common Name and SANs fields with values from the uploaded CSR, with an Undo option to revert.

⤢ ⤢

Removes CT logging opt out options from CertCentral, enforcing CT logging on all public TLS certificates (DV, OV, EV, QWAC, QWAC PSD2) across all DigiCert brands. Certificates that previously needed to be kept out of CT logs can no longer be issued that way from June 1, 2026 onward.

Moves public TLS certificate maximum validity to 199 days and public code signing certificate maximum validity to 459 days, and reduces domain validation and organization validation reuse periods to one day less than the CA/Browser Forum permitted maximums, per CA/Browser Forum requirements. Orders requesting longer validity periods will be rejected or truncated.

Begins DNSSEC validation during domain control validation and DNS CAA checks, returning DNSSEC-specific error and status messages in CertCentral order details pages and via the Services API when issues are detected. Domains with misconfigured DNSSEC will block certificate issuance until the configuration is resolved.

Updates Multi-Perspective Issuance Corroboration (MPICMPICMulti-Perspective Issuance Corroboration, a CA/Browser Forum requirement that certificate authorities verify domain control from multiple network vantage points to reduce BGP hijack and DNS manipulation risks during certificate issuance.) to require corroboration from at least four remote network locations across at least two different Regional Internet Registry regions. Certificate issuance fails if more than one perspective does not corroborate.

Retires the legacy CertCentral ACME service, with legacy ACME credential warnings shown in the ACME credentials table and requests to legacy ACME URLs failing to issue certificates after the retirement date. Legacy credentials must be replaced with new CertCentral ACME credentials.

Twingate Identity Firewall now supports HTTP web apps, enabling protection of internal web apps, data portals, CI/CD infrastructure, and AI-coded business apps. It authenticates users at the Twingate layer using JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. and custom header injection, supporting MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. access, security policies, and access logging, so users reach internal web apps already authenticated.

⤢

Todo/task-tracking tools (TaskCreate, TaskGet, TaskUpdate, TaskList, TodoWrite) are no longer available by default on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models; set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 to restore them.

$ CLAUDE_CODE_ENABLE_TODO_TOOLS=1 claude

Adds the CLAUDE_CODE_TOOL_MEMORY_LIMIT environment variable (Linux only) to cap memory for Bash tool commands via cgroup support, preventing a runaway build from stalling a session.

$ CLAUDE_CODE_TOOL_MEMORY_LIMIT=2G claude

Adds the CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS environment variable to control the WebFetch session URL cache TTL, defaulting to 15 minutes.

$ CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS=300000 claude

Extends the --worktree flag and the claude agents view to accept GitLab merge request URLs, displaying MRs as !N.

Improves claude plugin validate to inspect a bare .claude/skills directory and report SKILL.md files with unparseable frontmatter.

Adds an opt-in forward_user_identity apps gateway setting on Anthropic upstreams, forwarding the signed-in user's identity as headers so a proxy can attribute spend per user.

Adds a [claude-code:unrecognized_model] diagnostic line to stderr in print mode when a request is sent for an unrecognized model ID; suppress it with modelOverrides.

Improves apps gateway error forwarding so 400/413 responses from Vertex, Foundry, and Claude Platform on AWS upstreams now surface the upstream's own error message.

Guardian V2 introduces risk scoring on threads that flags high-risk actions for automatic review, recording scores as snapshots, initializing per-thread samplers, and preserving transcript boundaries. features.guardianv2 now accepts either a boolean toggle or an object configuring classifier instructions, review threshold, reasoning effort, action and instruction token limits, transcript source inclusion, per-entry and total token budgets, and the number of recent non-user entries.

unified_exec is now enabled by default on all platforms including Windows, exposing exec_command and write_stdin on Windows instead of the previous shell_command.

Adds thread-credits and estimated-thread-cost as configurable terminal title items for monitoring per-thread quota consumption, shows estimated thread usage in the /status command and TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. status surfaces, and adds per-thread usage queries to the backend client.

The app server now supports gRPC code-mode hosts alongside existing WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output.-based hosts, and removes the gRPC code-mode open session limit so a host can register more than MAX_IN_FLIGHT_REQUESTS open sessions simultaneously.

Adds agent_name to Responses API turn metadata, falling back to /root when no canonical agent path is set, with the field reserved from client metadata overrides.

MCP servers gain dynamic HTTP header helpers enabling per-request header customization, and MCP client protocol discovery is now instrumented with a counter and duration metric tagged legacy or auto mode and classified as modern, legacy, or failure outcomes.

Adds a Web Search toggle in Settings (desktop) and Feature Settings (extension/CLI) that lets supported models search the web during a task; search calls and results are recorded in the session transcript/conversation and persist across reopens and reloads.

ModelRuntime.create() now accepts allowModelNetwork and modelRefreshTimeoutMs to opt into a network refresh of the model catalog at creation time and bound how long it may take, plus modelsStorePath to set a custom local catalog store path and a modelsStore injection point for a custom persistence implementation. A new modelRuntime.refresh({ allowNetwork: true, force: true, signal }) method forces an immediate catalog refresh, bypassing the default four-hour per-provider throttle, and the PI_OFFLINE environment variable disables all model network access.

const refreshedRuntime = await ModelRuntime.create({
  allowModelNetwork: true,
  modelRefreshTimeoutMs: 15_000
});

await modelRuntime.refresh({ allowNetwork: true, force: true, signal });

A new defaultTools config key selects which built-in tools are enabled at startup (e.g. ["bash", "edit", "write"], or an empty array for none), while extension and SDK custom tools remain enabled regardless. New CLI flags refine this: --tools acts as a strict allowlist for all tools (replacing defaultTools behavior), --no-tools disables all tools, --no-builtin-tools disables only built-in defaults, and --exclude-tools filters the resulting tool list after other tool flags are applied.

{"defaultTools": ["bash", "edit"]}

{
  "defaultTools": ["read", "bash"]
}

The --use-theme flag starts an interactive run with a specific theme without changing the saved setting, e.g. pi --use-theme light, and supports light/dark syntax such as pi --use-theme light/dark to follow the terminal's appearance for that run.

$ pi --use-theme light

$ pi --use-theme light/dark

$ pi --use-theme dark/compact

$ pi --use-theme dracula interactive

$ pi --use-theme dracula

Fullscreen mode gains transcript search via Ctrl+Shift+F with incremental match highlighting and next/previous navigation using Enter/Ctrl+G and Shift+Enter/Ctrl+Shift+G. Search-match highlight colors are customizable via new searchMatchBg and searchMatchText theme color tokens, with documented fallback behavior when omitted. Fullscreen mode also adds unbound single-line transcript scrolling actions.

"searchMatchBg": "#2d2d30",
"searchMatchText": ""

Under PI_EXPERIMENTAL=1, the default read, bash, edit, and write tools support experimental strict JSON-schema constrained sampling for schema-conformant outputs.

$ PI_EXPERIMENTAL=1 pi interactive

$ PI_EXPERIMENTAL=1 pi