The Cyber Toolchain — issue 049, August 18, 2026

Adds --local flag for fully offline exploit search against a local SQLite FTS5 index of the full exploit corpus (~1.7 GB), stored at ~/.getsploit/getsploit.db (overridable via $GETSPLOIT_HOME). Supports full FTS5 expression syntax — including NEAR(...), boolean operators, column filters, and wildcards — across searchable columns id, title, published, description, and source_data (legacy sourceData: spelling still accepted), e.g. title:eternalblue AND NOT description:metasploit.

$ getsploit --update && getsploit --local 'title:eternalblue AND NOT description:metasploit'

$ getsploit --update
getsploit --local 'title:eternalblue AND NOT description:metasploit'

$ getsploit --update
getsploit --local 'title:eternalblue AND NOT description:metasploit'

Adds --update to download the full exploit corpus archive (~1.7 GB) over eight parallel range connections and build or atomically replace the local FTS5 index at ~/.getsploit/getsploit.db (or $GETSPLOIT_HOME); a search running against the old database finishes undisturbed. The index is versioned with integrity checks, and existing FTS4FTS4A full-text search extension for SQLite, maintained as part of the SQLite project, that lets tools index and query large bodies of text efficiently without a separate search engine. archives from Getsploit 2.x are automatically converted to FTS5. --update reports detailed progress — bytes and throughput for the download, and a bar with totals and time remaining for unpacking and document conversion — keeping the archive on disk rather than buffering it in memory.

Adds --format flag supporting json, jsonl, and tab-separated (TSVTSVA plain-text format storing tabular data with fields separated by tab characters, making it easy for cyber tools to parse and exchange structured records without a CSV parser's quoting complexity.) output, with --json retained as an alias for --format json; output automatically switches to stable tab-separated values with no color or decoration when redirected. Terminal display is rendered through Rich with adaptive table, compact, JSON, and JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. modes.

$ getsploit --format jsonl wordpress | jq -r .id

$ getsploit --format jsonl wordpress | jq -r .id

$ getsploit --local --format jsonl wordpress 4.7 | jq -r .id

Adds --mirror flag to save each exploit body to its own file in a per-query directory, usable with both online (--mirror) and offline (--local --mirror) searches; files are created without following symlinks and never overwrite existing files.

$ getsploit --local --mirror eternalblue

$ getsploit --local --mirror CVE-2024-3094

$ getsploit --local --mirror eternalblue

Adds --set-key to store a Vulners API key via a hidden confirmation prompt into a private file under the Getsploit home directory, with the VULNERS_API_KEY environment variable taking precedence over the stored file. The --api-key VALUE option is removed in v3.0.0, so credentials must now be supplied via --set-key or VULNERS_API_KEY.

Adds --color flag with values always, never, and auto (default) to control terminal color and decoration; wide terminals render a table, narrow terminals render stacked records, and redirected streams receive tab-separated output.

Databases built by Getsploit 2.x (FTS4) are automatically migrated to FTS5 the next time --update runs; existing FTS4 proximity expressions such as one NEAR/5 two must be rewritten in the FTS5 NEAR(...) form to keep working.

Rebuilds --count above 100 to page through results rather than silently returning only the first 100, advancing by rows received; Vulners Lucene syntax (e.g. title:wordpress AND description:"code execution") is supported for online queries with transparent pagination above 100 results, since no single API response exceeds 100 documents.

Online search now runs asynchronously through the official Vulners Python SDK 4.1, replacing direct HTTP access to Vulners endpoints; runtime dependencies on httpx, orjson, and texttable are removed as a result.

Pathseeker can log in with stored credentials and test content behind login pages, including apps that redirect through external identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. such as Okta, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., or Google. To configure it, open the credential step in Autonomous Tests > New Autonomous Test, enter the test account username and password, and save — Pathseeker logs in automatically when it detects a login page and tests everything behind the authentication wall.

A Push to Inbox action promotes validated Pathseeker findings into the Security Inbox in one click; findings are labeled Autonomous Test Vulnerabilities and link back to the originating test run, and duplicate pushes are blocked. From the test Results tab, select one or more findings, click Push to Inbox, and confirm — the finding appears in Security Inbox within seconds, integrated alongside other detections and submissions without manual re-entry.

Practitioners can search an approved asset inventory or add and approve a new asset — name, URL, type, and business criticality — directly from Pathseeker test setup without switching tabs. In the target field, typing an asset name that has no match offers 'Create and approve a new asset?', which creates, approves, and adds the asset as a target in one action.

Savant Pathseeker is a new product that runs autonomous, controlled outside-in penetration tests against approved internet-facing domains, web apps, and APIs, producing validated findings with evidence. It is now available as Early Access (1.0); launching a test requires organization owner permissions and targets must be pre-approved in the asset inventory before testing can begin.

The Code Autofix toggle has been removed from Settings; Supply Chain retains its own separate toggles for Upgrade Guidance and Supply Chain Autofix.

Harden-Runner GitHub Action v2.21.0 adds a denied-endpoints input, used with egress-policy: block, to block specific destinations while leaving all other traffic reachable, avoiding the need to build a full allow list. Self-Hosted VM Harden Runner v1.9.0 adds the equivalent denied_endpoints config key with egress_policy: block for the same capability on self-hosted VMs. Deny lists for both the GitHub Action and Self-Hosted VM runner can now be managed centrally through the Policy Store instead of editing workflow or config files per job.

⤢ ⤢

- uses: step-security/harden-runner@v2.21.0
  with:
    egress-policy: block
    denied-endpoints: |
      malicious.example.com
      *.ads.example.org

Threat Center adds an Affecting You filter that toggles between All incidents and a scoped view of only incidents matching your environment, each with a live count, plus a You are affected badge shown on affected incidents in both views. Affected incidents get a matched-components breakdown listing compromised packages found in your repositories, split by open pull request vs. default branch, down to affected files, head commit, and matched version, and a matched-IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. correlation view mapping incident indicators of compromiseindicators of compromiseAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. (e.g. malicious network endpoints) against Harden-Runner runtime data with a per-run breakdown of repository, workflow, job, and run. New Affected packages and Exact version only notification granularity options let alerts fire only for incidents touching your own dependencies.

Apache module 3.0.0 splits DomeURIRegexExclusion (now holding only custom URL exclusions) from a new DomeStaticAssetExclusion directive (enabled by default) that covers static-asset extensions including avif, gz, json, xml, and zip. It also adds DomeRemoveMatrixParams (default On) to strip matrix parameters (;...) per path segment per RFC 3986 before exclusion regex evaluation, and DomeEncodedCharInclusion (default "%23|%25|%2f|%3b|%3f") to force inspection of static-looking paths containing encoded delimiters %23, %25, %2f, %3b, or %3f. Custom static-asset rules previously in DomeURIRegexExclusion must be migrated to DomeStaticAssetExclusion.

$ # Before (2.x)
DomeURIRegexExclusion="/health|/heartbeat|\.(css|js|png|gif|jpg)$"

# After (3.0)
DomeURIRegexExclusion="/health|/heartbeat"
DomeStaticAssetExclusion="\.(css|js|png|gif|jpg)$"

Cloudflare Worker module 2.7.0 adds DATADOME_GRAPHQL_ENDPOINT (Terraform/Wrangler/dashboard config, defaults to /graphql) and its npm equivalent graphQLEndpoint, letting one or more comma-separated GraphQL endpoints be specified so operation name and type are extracted for analysis. It also adds DATADOME_MCP_ENDPOINT (defaults to /mcp) and npm mcpEndpoint to designate one or more MCP endpoints for MCP-property extraction, and exposes enriched request metadata via ctx.dataDomeEnrichedHeaders after calling dataDomeHandler.fetch() for downstream logging in Worker code.

⤢ ⤢ ⤢ ⤢ ⤢ ⤢

async fetch(
  request: Request,
  env: Env,
  ctx: ExecutionContext,
): Promise<Response> {
  const response = await dataDomeHandler.fetch(request as any, env, ctx);
  console.log(
    Object.entries(ctx.dataDomeEnrichedHeaders)
      .map(([name, value]) => `${name}: ${value}`)
      .join(' - '),
  );
  return response;
}

$ DATADOME_GRAPHQL_ENDPOINT=/api/graphql
DATADOME_MCP_ENDPOINT=/api/mcp

Node.js module 2.6.0 adds a graphQLEndpoint parameter to specify the path(s) for the GraphQL endpoint, defaulting to /graphql, and adds validation of the logger parameter to ensure it contains every required method with the correct signature.

{
  graphQLEndpoint: '/api/graphql'
}

OpenResty module 1.7.0 adds datadome_graphql_endpoint to specify the GraphQL endpoint (defaults to graphql) and datadome_graphql_max_body_size to limit the request body size parsed for GraphQL requests.

compose pull now honors pull_policy refresh windows (daily, weekly, every_N), skipping redundant pulls within the configured window. Set via the pull_policy key in compose.yaml, e.g. pull_policy: weekly under a service to skip re-pulling images pulled within the last 7 days.

services:
  web:
    image: myapp:latest
    pull_policy: weekly

A new Public Skills MCP server is reachable at https://skills.cgr.dev/mcp over Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. with OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms., letting any MCP-capable agent discover and load hardened agent skills without a separate install. It exposes five tools — search_skills, list_skills, read_skill, read_skill_reference, and run_skill — for ranked keyword search, paginated catalog browsing, manifest inspection, single-file fetching, and full bundle loading. search_skills and list_skills take query/page_size (default 50, max 200)/page_token; run_skill returns { name, files, instructions } in one call; read_skill_reference rejects path-traversal attempts like ../another-skill/.... Skills are sourced from skills.cgr.dev/public and skills.cgr.dev/chainguard, pinned to the upstream commit they were hardened from. It can be added to Claude Code with claude mcp add --transport http --scope user cgr-skills https://skills.cgr.dev/mcp, with local, project, and user scopes, or shared project-wide via a committed .mcp.json.

$ claude mcp add --transport http --scope user cgr-skills https://skills.cgr.dev/mcp
claude
/mcp

{
  "mcpServers": {
    "cgr-skills": {
      "type": "http",
      "url": "https://skills.cgr.dev/mcp"
    }
  }
}

A new chainctl libraries cache build-pinning feature records which copy (upstream mirror or Chainguard rebuild) an org first received for a package version and keeps resolving that version to the same copy, preventing EINTEGRITY checksum mismatches in npm. New commands chainctl libraries cache opt-out and chainctl libraries cache opt-in, both accepting --ecosystem, control per-organization, per-ecosystem pinning behavior, and chainctl libraries cache list shows which copy each held version was sourced from. As of August 24, 2026 this pinning is enabled by default for orgs using upstream fallback (JavaScript, Python, and Java ecosystems), so resolutions no longer silently switch between upstream and a Chainguard rebuild unless an org runs chainctl libraries cache opt-out; orgs without upstream fallback are unaffected.

$ chainctl libraries cache list

$ chainctl libraries cache opt-out --ecosystem javascript

The Chainguard Guardener GitHub App (beta) now extends automated migration to GitHub Actions: it inventories Actions usage across org repositories, maps them to hardened Chainguard equivalents, and opens pull requests pinned to a specific SHA rather than a mutable tag. It runs in two modes — an upfront pass that surfaces existing Actions usage and opens migration PRs, and an ongoing standardization mode that watches workflow files and suggests equivalents as new upstream Actions appear.

XFA adds eight configurable per-organization device checks covering browser privacy: Chrome Safe Browsing (standard and enhanced modes), Chrome Do-Not-Track, Chrome DNS-over-HTTPSDNS-over-HTTPSA protocol that tunnels DNS queries inside encrypted HTTPS requests, hiding lookups from network observers. Cyber tools use it to evade DNS-based monitoring or filtering., Firefox HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate.-Only, Firefox DNS-over-HTTPS, and Firefox Enhanced Tracking Protection (standard and strict modes). Each check can be set to warn or block, and violations surface in the desktop tray menu and the device detail view in the dashboard with one-click remediation links built into the agent.

A new Investigations dashboard, accessible via the top navigation in the Huntress portal, shows a chronological timeline of signals reviewed, actions taken, remediations applied, and final outcomes for both reported and closed-benign investigations. It unifies coverage across Managed EDR, ITDR, and SIEM, includes a summary section with key stats for quick situational awareness, and supports export of investigations to CSV and Excel for reporting and recordkeeping.

A new Final URL domain registration age condition for Correlated Intelligence custom detection signals triggers when the domain of the final destination URL — after all redirects and short-link expansions — was registered within a configurable window of 0 to 366 days.

Endpoint Response Playbooks and Automated Response Playbooks now support operating system as a condition parameter, with include or exclude modes to precisely target automated actions by OS.

Cloud Email Gateway Protection's Correlated Intelligence custom detection signals gain a URL condition matching email URLs against a specified list of up to 1,024 URLs, and a URL domain condition matching the domain of any URL in an email against a specified list of up to 1,024 domains.

The STRATUS_RED_TEAM_CORRELATION_ID environment variable isolates each execution's Terraform state under $HOME/.stratus-red-team/<technique-id>/<correlation-id>, preventing concurrent runs of the same technique from sharing or destroying each other's resources. The Go library exposes runner.WithCorrelationID(id) for programmatic use, and technique authors can embed correlation IDs in cloud resource names via the Terraform variables var.correlation.short (8-character form) and var.correlation.id (full form), or via stratus.CorrelationShortID(providers.AWS().UniqueCorrelationId) in Go. A shared Terraform provider plugin cache at $HOME/.stratus-red-team/plugin-cache avoids re-downloading providers per run. stratus status now scopes its report to the specific execution when the correlation ID env var is set, falling back to the flat per-technique directory when unset, and existing flat state is automatically migrated into the per-execution directory on upgrade.

$ export STRATUS_RED_TEAM_CORRELATION_ID=$(uuidgen)
stratus detonate aws.persistence.iam-backdoor-user
stratus cleanup aws.persistence.iam-backdoor-user

locals {
  resource_prefix = "stratus-red-team-my-technique-${var.correlation.short}"
}

$ # Reports COLD (flat layout, no isolated state visible)
stratus status aws.persistence.iam-backdoor-user

# Reports WARM (scoped to this execution's directory)
STRATUS_RED_TEAM_CORRELATION_ID=$ID stratus status aws.persistence.iam-backdoor-user

$ STRATUS_RED_TEAM_CORRELATION_ID=session-alpha stratus detonate aws.impact.ec2-deregister-ami

A tags config setting applies custom tags (via the AWS provider's default_tags) to Terraform-managed prerequisites for AWS techniques, enabling correlation IDs, ownership labels, and environment markers per technique. A prefix config setting prepends a custom, template-capable string to the names of Terraform-managed prerequisite resources. Both are controlled via the Stratus Red Team configuration file.

New accept_relp operator receives Syslog over the Reliable Event Logging Protocol (RELP), supporting plaintext, TLS, and mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. connections. It preserves message boundaries and provides at-least-once delivery via bounded acknowledgements and backpressure.

$ accept_relp "0.0.0.0:2514"
syslog = data.parse_syslog()

The write_pcap operator gains a format = "pcapng" option to explicitly generate PCAPNG output, and read_pcap now auto-detects PCAPNG input, including multi-interface captures, variable timestamp resolutions, byte orders, and multiple sections.

$ write_pcap format = "pcapng"

Adds two new ASM risk fingerprints queryable via risks.name: "Exposed Copeland XWEB Pro Refrigeration Controller" and risks.name: "Exposed Payara Server Default Page". New risk types may be disabled by default, so review risk type configuration in the ASM web console.

$ risks.name: "Exposed Copeland XWEB Pro Refrigeration Controller"

$ risks.name: "Exposed Payara Server Default Page"

A new Elasticsearch Kibana connector lets practitioners enrich IPs, web properties, and certificates with Censys Platform data; initiate rescans of hosts or web properties; retrieve event history for an IP address; and launch CensEye automated pivoting jobs to find assets related to an IP, web property, or certificate.

⤢

Censys Assistant in ASM can now generate custom PDF-ready reports about your attack surface. This requires the organization to be migrated to the Platform for team management and the AI Features toggle enabled under Platform Organization Settings > Privacy.

A self-service Locations toggle on the Settings > Feature Flags page in DefectDojo Pro replaces the previous environment-variable-only deployment change; once enabled it locks (Cannot Be Disabled) because reversing the location data migration is not yet supported. The DD_V3_FEATURE_LOCATIONS environment variable still governs Classic UI and /api/v2 route wiring at boot, so a restart is recommended when enabling the toggle if either surface is in use. A new data-migration suite offers four idempotent, on-demand items — migrate_endpoints_to_locations, migrate_components_to_dependencies, migrate_findings_to_code_locations, and an identity rehash (locked until the first three complete) — each also runnable as a management command for scripted or air-gapped use. Separately, GET /api/v2/location/ is now scoped by RBAC instead of requiring superuser access.

$ python manage.py migrate_endpoints_to_locations

A note marked private is returned only to its author and to superusers, with consistent enforcement across the API, the UI notes tab, note popovers, finding/test/engagement note counts, generated reports, and issue-tracker sync. Private notes written by other users no longer appear anywhere for other viewers, so teams that relied on private notes remaining readable by all users must move that content into public notes before upgrading.

Adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. 2.0 provisioning under Connect > Authorization (tagged Provisioning): identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. can create, update, and deactivate DefectDojo users and manage groups directly; deactivating a user over SCIM also deletes that user's API tokens.

The Qualys connector now accepts a Host Tags filter to scope discovery to hosts carrying named Qualys asset tags; the filter applies to both detection downloads and host listing, reducing sync scope without downloading out-of-scope hosts.

New Messaging Connectors (beta) send alerts to Slack, Microsoft Teams, email, or an Amazon SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. topic, routed by Rules Engine 2.0 rules; requires the Messaging Connectors and Rules Engine 2.0 feature flags to be enabled.

Clerk Billing adds reusable percentage or fixed-amount discounts that can be applied manually to any active subscriber's subscription from the Dashboard and revoked at any time, plus promo codes (e.g. LAUNCH20) customers can enter at checkout to self-redeem, with optional redemption caps, new-subscriber restrictions, and per-code usage tracking. Discounts support different amounts per billing period (monthly vs. annual) and can last a single billing cycle, a set number of cycles, or indefinitely.

⤢

A new Findings module (early access) under Identity security > Findings continuously monitors for identity risk conditions — unowned service accounts, exposed credentials, misclassified identities, decoy credential use, and more — on every connector sync, replacing manual periodic reviews. Each finding supports per-finding actions from its detail view: Accept risk (requires justification and expiration date), Suppress (permanent, requires reason), Snooze (1, 7, 30, or 90 days or a custom date, requires reason), and Remediate (where supported). From All findings, bulk actions let you select up to all findings matching the current filter and apply Snooze, Suppress, Accept risk, or Reopen in one step, with a confirmation dialog showing how many selected findings each action affects. Transformation rules (at Findings > Transformation rules) match on finding.severity, finding.state, finding.risk_score, or finding.annotations via CEL expression, then set severity or add/remove annotations, running in ascending Order. Routing rules (at Findings > Routing rules) match on app, finding type, or a CEL expression, then suppress, snooze, accept, remediate, or dispatch (webhook, function, or automation), with only the first matching rule running in ascending Order. The finding detail view also adds an Evidence pane with a confidence score and an Activity audit trail covering creation, routing-rule evaluation, and evidence updates. Findings surface on the Identities & NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. dashboard, with every inventory table now filterable to identities with open findings.

⤢ ⤢ ⤢ ⤢

IQService-August-2026 requires administrators to run IQService.exe -g --enable <Service Name> to activate the ScriptExecutor (native before/after script execution) and gMSAPasswordData (gMSA password retrieval) privileged services, e.g. IQService.exe -g --enable ScriptExecutor and IQService.exe -g --enable gMSAPasswordData; both services are silently disabled if TLS is not exclusively configured on the IQService instance, and running non-TLS ports alongside a TLS port is no longer supported. Auto-update push via UpdateService begins October 19, 2026, with a 60-day manual configuration window starting August 18, 2026 for administrators to configure and validate before then.

$ IQService.exe -g --enable ScriptExecutor

$ IQService.exe -g --enable gMSAPasswordData

The Audit Events API now emits dedicated events for workflow definition lifecycle actions (create, fork, deprecate, delete) and for workflow step changes (add, edit, delete, reorder), each carrying structured payload fields including workflow identity, definition label, actor, and timestamp. Existing workflow session audit events are enriched with workflow_version_label and workflow_version_id fields identifying the definition version active when a session started, and the new events can be filtered by workflow subject and definition identifiers using the existing Audit Events query API.

Enables auto-lock support in KDE PlasmaKDE PlasmaA desktop environment for Linux and other Unix-like systems, maintained by the KDE community, giving cyber tools a full graphical shell and widget toolkit to build native GUI applications against. on Wayland and other Wayland environments that implement the ext_idle_notifier_v1 protocol.

Adds Custom Rate Limit Policies (Early Access), configured via API-based self-service policy configuration, to cap the number of Authentication API / OAuth requests an individual client or group (all third-party apps, or CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows. apps) can consume, preventing one client from exhausting a tenant's overall rate limit entitlement. Each policy supports two enforcement modes: blocking (reject requests over the limit) or non-blocking (notifications only), enabling staged rollouts.

⤢ ⤢ ⤢ ⤢

Cy adds Saved Prompts so teams can store and reuse proven natural-language investigation workflows across DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. and DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., adds suggested next steps that surface recommended follow-on actions after each query, and expands natural-language investigation to cover risky alerts, sensitive data exposure, access activity, and data movement patterns in one unified path.

⤢

Introduces Projects, a construct that lets security teams define scoped workspaces limiting user visibility to specific data, alerts, and identities within a single Cyera tenant, enables scoped API access per project so integrations only surface data relevant to their assigned scope, and preserves organization-wide visibility for global users while restricting project-scoped users to their defined perimeter.

⤢

Access Trail audit coverage now extends to Outlook, tracking message access, attachment access, send activity, deletions, inbox rules, folder permissions, and delegated access, and to NetApp on-prem file shares, tracking sensitive file activity across on-premises storage.

⤢

A new service that uses targeted data scanning and enriched classification to identify exactly what sensitive data was exposed, who accessed it, and when during a security incident, producing a defensible incident impact view suitable for legal, board, regulator, and disclosure decisions in place of broad blast-radius assumptions.

Adds SecureTransit, a policy-enforced encrypted privacy layer supporting WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. or IKEv2IKEv2The second version of the Internet Key Exchange protocol, standardized by the IETF, used to negotiate and authenticate IPsec tunnels. Cyber tools build on it for reliable, fast VPN session setup with built-in NAT traversal and EAP support. protocols, routing traffic through a DNSFilter-managed secure gateway to prevent network-level visibility of destinations on untrusted networks. Admins set policy mode to Always On, Manual, or Disabled per organization or per device from the existing DNS filtering dashboard, and SecureTransit blocks location trackers, mail trackers, data brokers, and ad networks at the network layer before data leaves the device. It is available as a per-device add-on with a 14-day free trial for existing customers, installed via the dashboard under Deployments → Roaming Clients → Beta Channel.

Introduces the DNSFilter One Agent, replacing the right-click tray menu with a full UI window supporting system light/dark mode, and showing protection state, filtering mode, last sync, and an activity view of blocked and allowed queries over the past hour. A SecureTransit panel within the Agent displays connection status, connected server on a map, region, protocol, session uptime, data transferred, and Connect/Disconnect controls.

Adds otelEndpointOverride to sandbox creation, enabling per-sandbox OpenTelemetry endpoint configuration.

Promotes fork and create-snapshot operations from experimental to stable API, retiring the experimental aliases.

The Cloud Agent API adds private-worker-pool management endpoints: GET /v0/private-workers lists connected self-hosted pool workers with filterable status and scope (team_pool / personal) params, returning workerId, labels, isInUse, repoOwner, repoName, workspaceRootPath, connectedAtMs, teamId, serviceAccountId, displayName, plus totalCount/nextPageToken pagination; GET /v0/private-workers/pools lists durable pools filterable by scope and includeStale, exposing poolName, connectedWorkerCount, inUseWorkerCount, firstSeenAtMs, lastSeenAtMs, isStale, and optional repo metadata for scale-to-zero autoscaling dashboards; DELETE /v0/private-workers/pools deregisters a durable pool by scope/poolName (optionally repoOwner/repoName), returning { "deregistered": true }; GET /v0/private-workers/pending-requests lists unassigned pool requests with queue depth via totalCount for queue-depth-based autoscaling, filterable by repository URL; and POST /v0/private-workers/claim atomically reserves a pending request (bcId) for a specific workerId before it starts, with the claimed id passed via the CURSOR_AGENT_WORKER_ID environment variable (or hidden --worker-id flag) to agent worker --pool <name> --worker-dir <path> start. Omitting repoOwner/repoName when targeting a pool with env.type: "pool" routes to a repo-less pool, and an unknown pool name returns 400 immediately instead of queueing.

$ curl --request GET \
  --url "https://api.cursor.com/v0/private-workers/pending-requests" \
  -u "$CURSOR_API_KEY:"

$ # 1. Claim the pending request
curl --request POST \
  --url "https://api.cursor.com/v0/private-workers/claim" \
  -u "$CURSOR_API_KEY:" \
  -d '{"bcId": "bc-00000000-0000-0000-0000-000000000002", "workerId": "pw_123"}'

# 2. Start the worker with the reserved id
export CURSOR_AGENT_WORKER_ID="pw_123"
agent worker --pool gpu --worker-dir /workspace start

$ curl --request GET \
  --url "https://api.cursor.com/v0/private-workers?status=idle&scope=team_pool&limit=50" \
  -u "$CURSOR_API_KEY:"

Origin, Cursor's git forge (early beta) at cursor.com/codebase, supports creating repositories, pushing and pulling with standard git, browsing and searching code, and sharing with Cursor teams. Repos can be cloned via HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. at https://origin.cursor.com/{owner}/{repo}.git from the Code dropdown, or evaluated by adding Origin as a second git remote alongside GitHub with git remote set-url --add --push. A new origin CLI installs via curl -fsSL https://downloads.cursor.com/origin/install.sh | sh and authenticates with origin auth login before git operations. Origin follows the Privacy Mode of the namespace owner (teams on legacy privacy mode must switch to Privacy Mode to enable it) and is available in early beta on Pro, Teams, and Enterprise plans (all paid plans, excluding opted-out enterprise orgs), not on free plans.

$ origin auth login
git clone https://origin.cursor.com/acme/checkout.git

$ git remote set-url --add --push origin git@github.com:acme/checkout.git
git remote set-url --add --push origin https://origin.cursor.com/acme/checkout.git
git push origin main

A Sync from GitHub workflow at cursor.com/codebase mirrors a GitHub repository into Origin, copying git history, branches, tags, and pull requests, and keeps Origin continuously updated as the GitHub source changes, with sync status visible under Settings → General. Pushes to a mirrored repo pass through to GitHub, which remains the source of truth and continues to run its own CI; access mirrors existing GitHub read/write permissions. Pull requests on a mirrored repo sync bi-directionally with GitHub, and cloud agents can be attached directly to mirrored repos to work against the full commit history.

Origin's Pull Requests tab (at cursor.com/codebase) lists open pull requests and opens a review page with Activity, Commits, Checks, and Files Changed tabs supporting line-level comments, reviewer requests, and reviews from the diff. Pull requests can be merged once reviews and CI checks are satisfied, with conflicts surfaced before merge; mirrored GitHub repositories expose GitHub pull requests inside Origin, syncing comments and reactions bidirectionally within seconds, and GitHub-assigned reviews can be completed and merged from Cursor. Cloud agents can open pull requests on Origin automatically as part of a task, and per-repo agent integration lets you ask questions about browsed code, request changes, update PRs, or push branches from the same interface.

Each Origin repository has a Settings tab with General, Permissions, Rules and Protections, and Apps sections: General shows a Sync Status indicator for GitHub-mirrored repos; Permissions lets you review and manage access with Internal (visible to all Cursor team members) and Private (explicit grant required) visibility modes; Rules and Protections configures branch rules and merge protections per repository. At the team level, a Permissions UI lets admins claim a codebase name, enable or disable Origin at any time, and grant repo-creation rights to members.

⤢ ⤢

A per-repo Apps tab (with codebase-level Manage Apps) supports connecting Vercel (auto-provisions a preview deployment for every PR), Depot (runs CI, including existing GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflows, on Origin-hosted repos), and Buildkite (runs GitHub Actions workflows and native Buildkite pipelines on Origin-hosted repos); Depot and Buildkite are restricted to Origin-hosted repositories, while GitHub-mirrored repos continue CI on GitHub. Admins install and manage these apps across all Origin repos from codebase settings at cursor.com/codebase/settings/apps, with per-repo activation visible from the repository's Apps tab.

⤢

Adds cloud agent sessions (remote provisioning, transcript synchronization, approval recovery, model switching, branch picker, and onboarding panel), gated behind an explicit Cloud sessions toggle in Settings. Users connect GitHub, pick a repository and branch, and hand sessions off between devices with transcripts, approvals, and queued prompts kept in sync, switching models mid-session; the onboarding flow now includes a GitHub integration step. Also includes early proof-of-concept support for running these sessions in SSH remote environments.

Propagates generated media (images, audio, video) through the CLI ACP layer — images are forwarded as agent_message_chunk content with type: image, data, and mimeType fields; non-image modalities are forwarded as text placeholders [Generated <modality>: <mediaType>].