The Cyber Toolchain — issue 051, August 20, 2026

Introduces wingman, a StackHawk umbrella plugin for GitHub Copilot that bundles four skills — hawkscan, stackhawk-api, data-seed, and optimize — in one install, since Copilot has no plugin-dependency resolution mechanism. Adds a separate hawkscan-ci skill installable via copilot plugin install hawkscan-ci@stackhawk for CI-focused scanning. Plugins installed via copilot plugin install are stored in ~/.copilot/installed-plugins/ and available across all projects, with additional project-skill directories configurable via the chat.agentSkillsLocations setting; the same marketplace catalog now also serves Claude Code and Codex.

$ copilot plugin install wingman@stackhawk
copilot plugin install hawkscan-ci@stackhawk

PUT /api/v1/org/{orgId}/team/{teamId}/application previously returned a success response without actually saving the Team assignment. It now saves correctly, but any application-to-Team assignments made through that endpoint before the fix must be re-run to confirm they are actually in place.

Adds a Team ownership column to the Applications table letting users change a Team assignment in place; applications without a Team are marked Unassigned and can be assigned by selecting the label and searching for a Team. Adds a matching Team field in Application Settings > General (with Unassigned at the top) so clearing or changing ownership works the same way in both places, and moving an application between Teams no longer requires removing it from its current Team first. Members can now open Teams they belong to and View Only users can review every Team in the organization without manage permissions. Team management controls (Create a Team, Add Members, Add Applications, rename, Delete Team) are shown disabled rather than hidden for users without manage permissions. In the Create Application flow, users who cannot manage Teams but belong to at least one Team must now assign the new application to one of their Teams, and the Filter by Unassigned Applications checkbox now returns results for Members and View Only users.

GitHub Actions analysis now recognizes untrusted data in github.event.merge_group for workflows triggered by the merge_group event. The js/missing-rate-limiting query now recognizes @fastify/rate-limit as a rate limiter. actions/output-clobbering/high no longer reports simple jq path filters when their output remains JSON-encoded. actions/cache-poisoning/poisonable-step and actions/untrusted-checkout/critical now start alert paths at the expressions that control untrusted checkouts. actions/envvar-injection/critical now requires the untrusted source and privileged context to originate from the same trigger event, and no longer treats pull request head labels as injection-capable. actions/cache-poisoning/code-injection, actions/cache-poisoning/direct-cache, and actions/cache-poisoning/poisonable-step now account for read-only cache access on low-trust triggers running in the default branch scope. Queries also now correctly classify the schedule event when determining whether a workflow can be externally triggered.

Adds file:<path> package name syntax for JavaScript/TypeScript custom models, letting analysts define sources and sinks from a file's public exports. Adds flow models for Vue Composition API helpers ref, shallowRef, toRef, reactive, and computed, and recognizes Vue Router's useRoute() as a client-side remote flow source including its query, params, path, fullPath, and hash members. Treats declared inputs properties in Sails Action2 controller files as remote flow sources, potentially improving js/path-injection results, and tracks promise-wrapped client response data into promise fulfillment values under the response threat model, potentially improving js/xss results. Also adds flow source models for RegQueryValue and related functions from the winreg.h Windows header in C/C++.

HTTPQL gains req.header, req.header["<name>"], req.body, resp.body, and resp.header fields, letting queries target specific headers or body content without scanning the full raw field; all support .eq, .cont, and .regex operators.

$ req.header["Authorization"].cont:"Bearer" and req.body.regex:"password=[^&]+"

A new Pipeline Replay session type supports race-condition testing with two strategies: Sequential (ordered execution) and Last Byte Synchronization, which holds back the final byte of every request and releases them all simultaneously.

The Plugin page now shows an Official badge, quality rating, author, download count, and version per plugin, and supports filtering by Official or Community and bulk install/update.

Bumps the mitm addon to v2.3 (mitmproxy 12.2.3) with full 16 KB page-size device support; the mitm addon now requires Android 24+ and drops support for the x86 and armeabi-v7a ABIs.

New API endpoints let teams read, write, and clear detection exemptions on any detection without opening the platform UI. Exemptions can match on asset name, tags, region, principal, or API Gateway route, and existing findings on the dashboard are re-evaluated immediately when an exemption is written rather than waiting for the next scan. Plerion also notes that teams should list profiles via the API first, since the default profile only covers integrations that don't have a profile of their own.

Exposes device system health statuses for hardware components (camera, NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions., baseband, Touch ID, and others) in the device record UI for supported devices running iOS or iPadOS 27 beta, and makes those values available via the enterprise API device details endpoint for iOS and iPadOS devices.

Adds configurable sync frequency per directory sync integration, with intervals including Manual Only, Every 30 minutes, every hour, 2 hours, 4 hours, 8 hours, 12 hours, daily, every 2 days, or weekly, plus a Refresh and Sync Now capability for directory sync integrations.

Adds a Credential managers setting to the Android Restrictions Library Item, letting admins block all credential managers or allow the device's pre-loaded system credential managers in the work profile on managed Android devices. Also adds a managed Google Account setting to the same Library Item, with two modes controlling which managed Google Accounts are permitted on company-owned Android devices with work profiles.

Mac Auto Apps now support enforcing a specific version, selectable from a list of Iru-hosted versions, so devices installing for the first time or that are out of date install the pinned version rather than the latest available.

Virtual Network Sensor 1.0.1737 adds decoding and inspection of GPRS Tunnelling Protocol (GTP), Network Service Header (NSH), and Teredo traffic, along with new CLI commands to enable and disable inspection for GTP, NSH, Teredo, VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments., and VXLAN GPE protocols.

From a Forensics evidence package, IR and SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. teams can select relevant evidence items and click Add selected to Workbench insight timeline to consolidate them into one shared chronological record for a Workbench insight. The same evidence selection workflow also supports adding selected evidence to a Forensics timeline.

Ingestion Rules gain post actions chained with then: skip_field removes named fields before they're written to the database (e.g. device key_exists ["id"] then skip_field ["physical_location", "qualys_agent_ports"]); remove_values drops matching values from list fields; remove_items drops entire list items when a subfield condition matches (e.g. remove_items network_interfaces.ip4 in_net ["10.20.0.0/24"]); trim_prefix/trim_suffix strip literal text and trim_regex strips a regex match (with (?i) for case-insensitivity); set_value creates or overwrites a field from static literals, field references, or transforms including regex_extract (capture-group index, default 1), and automatically preserves any overwritten value in a new <field>_original field. Post actions can also use key_exists/key_not_exists conditions.

⤢ ⤢ ⤢ ⤢

$ device key_exists ["id"] then skip_field ["physical_location", "qualys_agent_ports"]

$ device key_exists ["id"] then trim_regex ad_hostname ["-([A-Fa-f0-9]{2}(:[A-Fa-f0-9]{2}){5})"]

$ device.remote_url key_exists ["id"] then set_value host = regex_extract(device.remote_url, "https?://([^/]+)", 1)

Documents the full operator set for primary Ingestion Rule statements: ==/!= (with the caveat that != only matches assets where the field exists, requiring key_not_exists for missing fields), date comparisons </> via date(YYYY-MM-DD), date(now-nd), date(now+nd) (>=/<= unsupported for dates), numeric </>/>=/<=, in/not_in, in_net/not_in_net (IPv4 and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network.), starts_with/not_starts_with, ends_with/not_ends_with, key_exists/key_not_exists, field_equal/field_not_equal, field_starts_with/field_not_starts_with, contains/not_contains (case-insensitive), and match_regex/not_match_regex.

⤢

$ device.confidence_level < 65 then skip_field ["os.type", "os.distribution", "os.type_distribution", "os.os_str"]

$ device.network_interfaces.ips in_net ["10.10.11.0/24"]

$ user.last_logon > date(now-10d)

Adds an Ingestion Rules Configuration page under each adapter's Advanced Settings, with a toggle to enable rules and a Select logical operator for all rules drop-down supporting OR, AND, or Custom (via a Custom Logical Expression field accepting expressions like 1 AND (2 OR 3), case-sensitive uppercase keywords). An Enable ingestion rules settings for each connection separately toggle adds an Ingestion Rules Configuration tab to the Add Connection drawer. A Save and Fetch action tests rules immediately, with results visible via From Last Fetch - yes in the Query Wizard and in Adapter Fetch History. Excluded entities remain until the Delete devices (or users)... retention window expires.

⤢ ⤢ ⤢ ⤢

Adds a Number of connections to fetch in parallel field in Adapter Discovery Configuration, letting practitioners set simultaneous connection counts (1 up to the adapter's maximum, default 1/sequential) during scheduled discovery cycles; enabled for Claroty CTD, F5 BIG-IP iControl, Infoblox DDI, Salesforce, VMware ESXi, and vSphere adapters.

⤢ ⤢ ⤢ ⤢

Adds per-adapter advanced settings: AppViewX CERT gets Enrich certificates with discovery data and a Discovery Name field for cipher, TLS version, and port scan enrichment; Cisco ASA gets a Connection Method setting to choose Legacy REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. or HTTP Interface (required for Firepower 2100/2120); Cisco Identity Services Engine gets API Gateway support routing through Layer7 or IBM API Connect; CrowdStrike Falcon's CSPM Account / Tenants Settings gains an OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. account type ingesting tenancy name, tenancy OCID, home region, user information, and CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. Status; the Custom Files adapter gains Software asset fetching from CSV and JSON files, a configurable custom field delimiter (e.g. semicolon or pipe), and SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. Distributed File System (DFS) path support; Certero gets a Certificate advanced setting (enabled by default) to disable Certificate asset fetching; Azure Defender for IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. gets a MAC address parsing option for uncertain (Guess) MAC addresses.

Adds CSV export for all chart visualization types — Bar, Pie, Donut, Stacked Bar, Line, Table, and Venn — across all compatible widgets, including count and percentage values, a Total row, full numeric values, and filenames formatted as Axonius - [Chart Name] - DD Month YYYY, HH.MM AM/PM.csv.

Adds enrichment of software vulnerability data from the GitHub Advisory Database, toggled via Enrich software vulnerabilities from GitHub Advisory Database in Settings > Enrichment > CVE Enrichment Settings, with a Fetch GitHub Reviewed Advisories option for curated coverage; supplements CVE data with CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v3/v4, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching., and exploit availability details.

Adds OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..1 authentication for service accounts; access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. are issued via the /api/oauth2/token endpoint and are automatically invalidated on credential reset or new token generation.

Extends the Enterprise Password Manager (vault) integration beyond password fields to support sensitive file fields: client certificate files (.pem), client private key files (.pem), advanced configuration files (JSON/XML), and credentials-format files.

Adds Black Duck Polaris (Aggregated Security Findings, Application Resources, Business/SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Applications), Cisco IoT Control Center (Devices), Invicti Platform Cloud (Aggregated Security Findings, Business/SaaS Applications, URLs), Mashery/Boomi Cloud API Management (Application Services, Business Applications, Organizational Units, Secrets, Security Roles, URLs, Users), Mindtickle (Groups, Users), Smart SD (Devices), and StrongDM (Devices).

Adds an Include only mode for field-level adapter scoping in data scopes alongside the existing Exclude mode, with updated labels distinguishing Define asset access by adapter connection from Define field access by adapter connection.

Changes data scope behavior so that selecting all individual connections for an adapter no longer auto-upgrades to adapter-wide selection; the adapter parent checkbox must now be explicitly selected to include current and future connections, meaning new connections won't be automatically covered otherwise.

The Tailscale container image adds a TS_BOOT_TIMEOUT environment variable, accepting a duration value (e.g. 90s or 3m) to extend how long the container waits for its initial connection to the coordination server; it defaults to 60s.

R2 now supports a us jurisdiction guaranteeing data is stored and processed within the United States; access buckets via the jurisdiction-specific S3 endpoint https://<ACCOUNT_ID>.us.r2.cloudflarestorage.com or set jurisdiction = "us" in a [[r2_buckets]] Workers binding.

[[r2_buckets]]
binding = "MY_BUCKET"
bucket_name = "<YOUR_BUCKET_NAME>"
jurisdiction = "us"

New Cloudflare Wallets product gives Cloudflare accounts and AI agents a stable, human-readable identity and a way to pay for APIs and content using stablecoins. Account Wallets let human owners manage funds and delegate spend to agent-controlled Virtual Wallets, which operate via API keys under a maximum spend cap set by the owner, enabling autonomous agent spending without per-action approval. Wallet handles can be reserved now at cloudflare.pay (one per Cloudflare account), publishing a page at HANDLE.cloudflare.pay and registering for early access; the system integrates with Agentic Payments so agents can charge for or pay for HTTP content and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools using the x402x402A proposed HTTP payment protocol revival using status code 402, enabling machine-to-machine micropayments over HTTP so cyber tools can gate API access or resources behind automated, per-request cryptocurrency payments. protocol.

⤢

Cloudflare WAF leaked credentials detection now automatically scans Authorization: Basic headers by default; matches populate existing fields such as cf.waf.credential_check.password_leaked and trigger the Exposed-Credential-Check managed transform header when configured, so existing custom rules and rate limiting rules apply without modification.

Workers AI catalog adds qwen-image-3.0-pro (Alibaba, text-to-image with up to 6 variants, negative prompts, seed control), qwen3.7-max (Alibaba flagship agentic LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. via DashScope), qwen3.7-plus (Alibaba, image/video understanding plus coding and GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. automation), qwen3.8-max (Alibaba, 2.4T-parameter MoEMoEA model design that splits its layers into many expert sub-networks and routes each token to only a few. The model holds many parameters but spends the compute of a much smaller one per token. with native video understanding), Claude Opus 5 (Anthropic, one million token context, no data retention for general access), ByteDance's next-generation video model (text-to-video with up to 30 reference images, 10 reference videos, 10 reference audio clips, first/last-frame image-to-video, video editing/extension, adaptive aspect ratio), gemini-3.7-flash (Google, multimodalmultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. reasoning for agentic workflows), ltx-2-5-fast (Lightricks, fast text/image-to-video with synchronized audio), and grok-imagine-image-2.0 (xAI, image generation/editing with typography and layout strength).

⤢

AI Gateway adds support for the openai/gpt-5.6-sol model at 50% promotional pricing ($2.50/1M input tokens, $15/1M output tokens, $0.25/1M cache-read tokens) through September 18, 2026 for non-BYOKBYOKBring Your Own Key — a cloud deployment model where the customer supplies and controls the encryption keys rather than the provider, so sensitive data stays under the customer's cryptographic authority. users.

Cloudflare Email Security now negotiates X25519MLKEM768 post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. hybrid key exchange on inbound MX and outbound SMTP delivery connections when the peer supports it, protecting mail traffic against harvest-now, decrypt-later attacks; it is backwards compatible and enabled automatically for all Email Security packages.

Cloudflare Tunnel now supports configuring origin application parameters — including TLS verification, HTTP Host header, and connection timeouts — directly in the Cloudflare dashboard when editing a published application.

⤢