PAGES
Subscribe Get it delivered — five to ten releases we picked each morning from the tools you run, with every release in the issue on the web. Compare plans →

The Cyber Toolchain — issue 055, August 24, 2026

THE CYBER TOOLCHAIN NO. 055
Tail
THE DAILY RELEASE FIREHOSE
PUBLISHED AUGUST 24, 2026 · EVERY DAY
EDITIONS tail grep head ls diff uniq

The daily firehose — everything the toolchain shipped today, already filtered.

We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.

VIEW
ISSUE VIEW scroll
ISSUE WIDTH reading width
Do you prefer scroll?
ADDITIONAL FILTERS 
$ tct list   # 21 tools matched
Offensive Security
◆  AI-Powered Offensive Security

T3MP3ST

Sources Commits → changes since 2026-08-12 Code

autonomous red teaming platform; multi-agent offensive-security meta-harness

T3MP3ST adds Novita AI as a native LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. provider and enables Claude Code session resume across kill-chain phases.

  • Adds NOVITA_API_KEY environment variable to enable Novita AI as a first-class LLM provider, dispatched through the OpenAI-compatible endpoint at https://api.novita.ai/openai/v1 with a default model and curated model catalog entries.
  • Adds T3MP3ST_TRUST_CLAUDE_SESSION environment variable (set to 1) to enable Claude Code session resume across kill-chain phases, persisting session state between agent turns instead of starting fresh each time.
  • Adds optional resetSession() method to the LLMProviderAdapter interface, allowing providers that support resumed backend sessions to expose a clean-session escape hatch.

3 details in Everything

Was this useful?
Application Security
◆  Web Application Security

Invicti

Sources Changelog → 1 release · 2026-08-24 Changelog

Official documentation for Invicti AppSec Platform, Invicti Platform, and Invicti Enterprise — web application security testing, DAST, API security, and vulnerability management.

Invicti adds application- and collection-level scan scheduling, ephemeral API targets for CI/CD environments, and incremental scanning support in scan-cli, alongside several smaller improvements to SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., integrations, and API discovery.

└──▷ WHAT SHIPPED · 10 FEATURES 2 OF 10 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
Incremental scanning via scan-cli environment variable new 75

Adds the INVICTI_INCREMENTAL_SCAN environment variable to scan-cli, limiting a scan to new or changed endpoints to reduce scan time in CI/CD pipelines.

— Names exact env var and mechanism, but no usage example shown. changelog-20260824-d73297dd
02 00
Exclude API action in API Discovery improved 70

Adds an Exclude API action in API Discovery, replacing Hide API, which labels APIs as third-party and requires a reason for exclusion. In the API Discovery view, users open the API's action menu, select Exclude API, choose Third-party as the type, and enter a reason.

Exclude a detected third-party API from discovery results so it no longer appears in the API Catalog.
📍In API Discovery, locate the API, open its action menu, select Exclude API, choose Third-party as the type, and enter a reason for the exclusion.
— Includes exact UI steps to perform the action via usage example. changelog-20260824-d73297dd
thinner coverage below
03 00
Scheduled scans for entire applications and collections improved 55

Adds scheduled scans for entire applications or collections, automatically running DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans across all included targets on a chosen recurrence; previously schedules were per-target only.

— Clear before/after but no exact config or endpoint given. changelog-20260824-d73297dd
04 02
Ephemeral API targets with dynamic base URL new 55

Adds ephemeral API targets with a dynamic base URL that resolves at scan time, enabling scanning of temporary or CI/CD-provisioned environments without manual target reconfiguration.

— Explains mechanism and use case but no concrete configuration steps. changelog-20260824-d73297dd
05 00
Exponential backoff with jitter on rate-limited scans improved 55

Scan engine now applies exponential backoff with jitter when retrying requests that receive a 429 Too Many Requests response with no Retry-After header, improving crawl coverage on rate-limited targets.

— Describes mechanism and trigger condition but is automatic, non-actionable by users. changelog-20260824-d73297dd
06 00
Downloadable large payloads in vulnerability details improved 55

Request and response payloads over 2 MB in vulnerability details are now offered as a download instead of being rendered inline, supporting very large scan results.

— Names exact size threshold and behavior change. changelog-20260824-d73297dd
07 00
Integration field mapping enhancements for Jira, Azure Boards, GitHub, GitLab new 50

Adds {Asset URL} placeholder support in Jira, Azure Boards, GitHub, and GitLab integration field mappings, and adds custom Jira fields of type Label to integration field mapping, enabling automatic tagging of Jira issues created by Invicti.

— Names placeholder and field type but no full mapping workflow shown. changelog-20260824-d73297dd
08 00
Permission-based filtering in API Catalog improved 50

API Catalog now filters displayed targets based on the user's collection-level permissions, removing the requirement to have account-wide target access.

— States before/after behavior but no exact UI path or setting. changelog-20260824-d73297dd
09 00
SSO settings enhancements new 45

Adds a unique organization identifier on the SSO settings page that can be copied for use when registering Invicti as a SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. service provider, and adds SSO login support for organizations whose identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. certificate is stored in bare base-64 DER format.

— Names the UI location and certificate format but lacks setup detail. changelog-20260824-d73297dd
10 00
scan-cli runtime updated to .NET 10 improved 30

Updates the scan-cli runtime to .NET 10.

— Bare version bump with no further detail. changelog-20260824-d73297dd
└──▷ ALSO FROM THESE RELEASES
Was this useful?

PortSwigger Burp Suite

Sources Blog / feed → 1 release · 2026-08-24 Blog

We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.

Burp Suite 2026.8 focuses on workflow and reporting refinements: customisable title bar actions, richer manual issue documentation, and clearer evidence highlighting for AT-raised issues.

└──▷ WHAT SHIPPED · 3 FEATURES 0 OF 3 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Customisable title bar actions new 33

Practitioners can pin frequently used functions directly to the title bar for faster access, rather than navigating menus each time.

— Describes benefit but no exact UI path or config Professional / Community 2026.8 (2026-08-24)
02 00
Multiple evidence items in manual issues improved 33

When manually creating issues, users can now attach multiple evidence items to a single issue entry, allowing richer documentation of findings.

— Explains capability but no mechanism or limit given Professional / Community 2026.8 (2026-08-24)
03 00
Evidence highlighting for Burp AT issues improved 31

Issues raised by Burp AT now include evidence highlighting, making it easier to identify the relevant portions of captured traffic.

— States benefit but no detail on highlighting mechanism Professional / Community 2026.8 (2026-08-24)
Was this useful?

DataDome

Sources Blog / feed → 1 release · 2026-08-24 Blog

DataDome is a bot management and API protection platform that defends against automated attacks, web scraping, and credential abuse.

DataDome extended two integrations this window: the CloudFront Lambda@EdgeLambda@EdgeAn AWS feature that runs Lambda functions at CloudFront edge locations, letting cyber tools execute logic closer to users without managing servers in each region. integration gained a newer Node runtime, and the Tyk module added GraphQL detection, host override support and redirect handling.

└──▷ WHAT SHIPPED · 2 FEATURES 0 OF 2 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Tyk module GraphQL and host detection new 86

The Tyk module (1.4.0) adds a datadome_graphql_endpoint config option to define one or more comma-separated paths used to detect GraphQL requests, defaulting to graphql (e.g. datadome_graphql_endpoint = graphql,api/graphql,query). It also adds datadome_use_x_forwarded_host to support host override via the X-Forwarded-Host header (datadome_use_x_forwarded_host = true), and adds support for 301/302 redirects.

Route GraphQL traffic detection across multiple non-standard endpoints in a Tyk plugin config.
ini 
datadome_graphql_endpoint = graphql,api/graphql,query
Enable host override via the X-Forwarded-Host header when DataDome sits behind a reverse proxy that rewrites the Host.
ini 
datadome_use_x_forwarded_host = true
— Names exact config keys, defaults and example values Tyk module 1.4.0 (2026-08-24)
thinner coverage below
02 00
nodejs26.x runtime for CloudFront integration improved 35

The DataDome CloudFront Lambda@Edge integration now supports the nodejs26.x Lambda runtime.

— Names the runtime but no setup detail product docs
Was this useful?
◆  SAST / SCA / Code Security

Snyk

Sources Blog / feed →Product docs → 1 release · 2026-08-24 Docs Blog

The official changelog for the Snyk AI Trust Platform. Discover what's new in our security intelligence, AI-powered tools, and latest product enhancements.

Snyk shipped a redesigned UI centered on faster navigation, including command-palette search, Dark Mode, a new breadcrumb-based scope switcher, and a consolidated Settings hub.

└──▷ WHAT SHIPPED · 5 FEATURES 1 OF 5 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Command-palette navigation search new 75

A Cmd/Ctrl+K shortcut opens a search box that jumps directly to any page or setting without menu-hunting, useful now that the sidebar is condensed to core areas.

Jump directly to any Snyk page or setting without navigating the sidebar — useful after the sidebar is condensed to core areas only.
📍In the Snyk UI, press Cmd+K (macOS) or Ctrl+K (Windows/Linux), then type the name of the setting or page you want (e.g. Integrations or Policies) and select the result.
— Exact shortcut and steps given, mechanism clear 2026-08-24-434df230
02 01
Breadcrumb bar for scope switching new 62

Replaces the classic multi-scope sidebar with a single breadcrumb bar supporting one-click scope switching via per-level drop-downs for Tenant, Group, and Organization.

— Describes before/after and named scope levels, no exact steps 2026-08-24-434df230
03 00
Dark Mode theming new 60

Adds Dark Mode with System/Light/Dark options, selectable from the user account menu and consistent across all pages.

Enable Dark Mode for a consistent dark-themed experience across Snyk and other dark-mode-enabled cyber tools.
📍In the Snyk UI, open the user account menu (top-right), navigate to appearance preferences, and select Dark (or System) from the Dark Mode options.
— Named options and UI path but no deeper mechanism 2026-08-24-434df230
thinner coverage below
04 00
Consolidated Settings hub new 54

Consolidates all settings-related pages into a single context-aware Settings hub, with the left sidebar condensed to core areas: Analytics, Inventory, Projects, Issues, Policies, and Settings.

— Names the consolidated sidebar areas but no interaction detail 2026-08-24-434df230
05 00
Toggle between classic and new navigation new 28

Users can switch freely between the classic and new navigation via the user account menu.

— Single-line mention with minimal mechanism 2026-08-24-434df230
Was this useful?

OWASP dependency-track

Sources Release notes → 1 release · 2026-08-24 Notes

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

Dependency-Track 5.0.5 improves OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. vulnerability data ingestion by speeding up full archive downloads.

└──▷ WHAT SHIPPED · 1 FEATURE 0 OF 1 FEATURE most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Faster OSV full archive downloads improved 35

Dependency-Track now leverages OSV's modified_id.csv list to optimize full vulnerability archive downloads, reducing unnecessary data transfer.

— Names the mechanism file but no numbers or config exposed. 5.0.5
Was this useful?

StepSecurity

Sources Blog / feed → 2 releases · 2026-08-20 → 2026-08-24 Blog

StepSecurity is a security platform that hardens CI/CD pipelines by reducing attack surface and detecting suspicious activity in GitHub Actions workflows.

StepSecurity added AWS as a second OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. federation provider for minting scoped API tokens, and shipped ARC Harden Runner v2.19.0 with configurable image pull policy and cluster-wide deny list egress enforcement.

└──▷ WHAT SHIPPED · 3 FEATURES 0 OF 3 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
AWS OIDC federation for API token minting new 93

Adds AWS as a second OIDC federation provider for StepSecurity trust policies alongside GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. — EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves., EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware., Lambda, and any workload that can call AWS STSAWS STSAWS Security Token Service, an Amazon Web service that issues short-lived credentials for IAM roles, letting tools authenticate to AWS APIs without storing long-term secrets. can mint scoped StepSecurity API tokens without a long-lived key. AWS trust policies match on the issuer URL of the account's outbound federation, the 12-digit AWS account ID, and an optional role ARN (leave blank to trust any role in the account, or specify one to pin to a single workload), and carry the same max session duration and permissions allowlist controls already available to GitHub Actions policies. The provider is configured at organization scope via the StepSecurity API (Org Access) trust policy form, which now opens with a provider selector (GitHub Actions or AWS) showing the matching identity fields.

Configure an org-scope trust policy in StepSecurity that allows any IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role in a specific AWS account to mint API tokens — useful for giving an EKS cluster-wide workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. access without storing a key.
📍In the StepSecurity console, go to Organization › Trust Policies › New Policy, set Provider to AWS, enter your 12-digit AWS account ID, leave Role ARN blank to trust any role in the account, set a max session duration, and add the required permissions to the allowlist.
Pin a trust policy to a single Lambda function's execution role so only that workload can mint a StepSecurity API token.
📍In the StepSecurity console, go to Organization › Trust Policies › New Policy, set Provider to AWS, enter the 12-digit AWS account ID, and enter the full role ARN (e.g. arn:aws:iam::123456789012:role/my-lambda-role) to restrict minting to that single workload.
— Exact matching fields and UI steps for both trust-all and pinned policies. Mint StepSecurity API Tokens from AWS Worklo…
02 00
Configurable image pull policy for ARC Harden Runner new 85

Adds env.imagePullPolicy and tetragon.imagePullPolicy Helm values to control image pull behavior for ARC Harden Runner and Tetragon images, enabling IfNotPresent for clusters that pre-pull images or operate behind constrained registries.

Stop ARC Harden Runner from pulling images on every pod start in air-gapped or registry-constrained clusters by setting pull policy to IfNotPresent in your Helm values file.
yaml 
env:
  imagePullPolicy: IfNotPresent
tetragon:
  imagePullPolicy: IfNotPresent
— Names exact Helm keys and gives runnable config snippet. ARC Harden Runner v2.19.0 (2026-08-24)
03 00
Deny list egress enforcement extended to ARC Harden Runner improved 60

Extends deny list egress policy enforcement to ARC Harden Runner — policies attached at Cluster scope in the Policy Store now block specific destinations across every job in that cluster without requiring workflow file changes.

— Describes scope and mechanism but no concrete example or command. ARC Harden Runner v2.19.0 (2026-08-24)
Was this useful?

Mend.io Mend Platform

Sources Release page → 1 release · 2026-08-23 Notes

Traditional application security misses AI risk. Standalone AI security tools miss your code.

Mend Platform's biggest addition this window is an AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. report for inventorying AI models, prompts, and agents, alongside account-level global workflows, Chainguard support in container hardened-image detection, several Renovate config additions, and a reorganized Administration sidebar.

└──▷ WHAT SHIPPED · 6 FEATURES 0 OF 6 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
AI Bill of Materials (AI-BOM) report new 78

New AI-BOMAI-BOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk. report available through the Mend Platform reporting interface and API, generating an inventory of detected AI entities — models, system prompts, agent configurations, tools, and agents — at organization, application, and project scopes. Exports use industry-standard CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims. and SPDX 3.0.1 formats with metadata-only content to preserve data privacy; data is populated only for scans performed after the 24-August-2026 release date.

— Names formats and scope but no concrete API endpoint given. product docs
02 00
Chainguard support in hardened image detection new 62

Adds Chainguard as a supported source in hardened image detection, incorporating Chainguard-specific vulnerability data, VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. information, and detection of Chainguard image layers and base images. Surfaces Chainguard VEX status and branding directly within the risk factors columns across the Mend Container UI for Chainguard-based images and findings.

— Explains mechanism and UI surface but no exact command or setting. product docs
03 00
Renovate config additions: overrideDescription and devcontainer folder patterns new 62

Adds overrideDescription option to the Renovate config, allowing custom descriptions to be set on dependencies. Adds folder pattern support to managerFilePatterns for the devcontainer manager, broadening which Dev ContainerDev ContainerA Docker-based development environment defined in a JSON config file, standardized by Microsoft, that lets a project ship its exact toolchain so any contributor's editor or CI system gets an identical workspace. files are detected.

— Names exact config keys but gives no syntax example. product docs
thinner coverage below
04 00
Account-level global workflows new 55

Introduces Account-Level (Global) Workflows, letting administrators define workflows centrally and propagate them to selected organizations, with controls over whether org-level admins can enable or disable them locally. Adds comprehensive API support for managing global workflows.

— Describes mechanism but no endpoint names or config keys given. Version 26.8.1 (23-August-2026)
05 00
Administration sidebar and AI Usage tab reorganization improved 55

Updates the Administration page sidebar with a categorized, collapsible navigation structure aligning with Application and Project pages. Moves AI Usage settings from the General tab into a dedicated AI Usage tab under a new AI category, and adds sub-headers for AI, Code, and Dependencies within Engine Settings.

Adjust AI Usage settings after the tab reorganization in the Administration page.
📍In the Administration page, open the sidebar, navigate to the AI category, and select the AI Usage tab to configure AI Usage settings.
— Exact navigation path given but no config keys or API surface. Version 26.8.1 (23-August-2026)
06 00
Renovate onboarding flow improvements improved 30

The onboarding summary view now shows the What to Expect section first, improving the onboarding flow for new repositories. The onboarding UI also clarifies that security PRs do not count against PR limits.

— Thin UI-only descriptions with no configurable surface named. product docs
Was this useful?
Reverse Engineering, Malware & Forensics
◆  Malware Analysis

YARA-X

Sources Release notes → 1 release · 2026-08-24 Notes

A rewrite of YARA in Rust.

YARA-X v1.20.0 adds an --ignore-invalid-rules CLI flag with a matching Python API option, introduces experimental msi, vba, and olecf file-format modules, and speeds up scanning with SIMD-accelerated matching and faster rule deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution., alongside new per-pattern match limits in the C and Go APIs.

└──▷ WHAT SHIPPED · 12 FEATURES 0 OF 12 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
--ignore-invalid-rules flag for skipping bad rules new 85

Adds --ignore-invalid-rules CLI option to skip rules that fail to compile instead of aborting a scan, and exposes the same behavior in the Python API via ignore_invalid_rules.

Scan a directory with a ruleset that contains some invalid rules, skipping failures instead of aborting.
$ yr scan --ignore-invalid-rules rules/ /path/to/samples/
— Exact flag, Python param, and runnable command given v1.20.0
02 00
Per-pattern match limits in C and Go APIs new 75

Adds yrx_scanner_max_matches_per_pattern to the C API and Scanner.MaxMatchedPerPattern to the Go API to cap the number of matches recorded per pattern.

— Names exact symbols in both APIs but no usage example v1.20.0
thinner coverage below
03 00
rlib crate types for capi and py new 55

Adds rlib crate types to yara-x-capi and yara-x-py to allow linking into wrapper crates.

— Names crates and purpose, no example given v1.20.0
04 00
Experimental MSI, VBA, and OLECF modules new 50

Implements experimental msi, vba, and olecf modules for parsing those file formats in YARA rules.

— Names three new modules but no usage detail v1.20.0
05 00
lnk module ShellItems and malformed section parsing improved 45

Extends the lnk module to parse ShellItems and malformed sections.

— Names module and parsed structures, no example v1.20.0
06 00
Faster rule deserialization via automata serialization improved 40

Serializes Aho-Corasick automata directly with compiled rules for faster deserialization.

— Explains mechanism but no numbers v1.20.0
07 00
Improved atom extraction and scan constraints improved 40

Improves atom extraction heuristics and applies file size/header constraints only to regular expressions for better scan performance.

— Describes change but no measurable impact v1.20.0
08 00
SIMD-accelerated masked literal matching improved 35

Implements SIMD-accelerated masked literal matching for faster pattern scanning.

— States mechanism but no benchmark or scope v1.20.0
09 00
Language server enum-aware code completion improved 30

Improves code completion in the language server by distinguishing enums from other fields.

— Names behavior change but no config or command v1.20.0
10 00
Playground UI theme support new 30

Adds light/dark theme support to the playground UI.

— Simple UI addition, no further detail v1.20.0
11 00
Python API type annotations improved 25

Adds type annotations to match and return data in the Python API.

— Bare mention, no specifics on scope v1.20.0
12 00
Warning for unintentional patterns in a set improved 20

Raises a warning when patterns are unintentionally included in a set.

— Thin one-line description, no mechanism v1.20.0
Was this useful?
Cloud & Container Security
◆  Container & Image Security

Mend.io Mend Container

Sources Release page → 1 release · 2026-08-23 Notes

Traditional application security misses AI risk. Standalone AI security tools miss your code.

Mend Container's biggest addition this window is an AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. report for AI entity inventories, alongside new Chainguard hardened-image support, account-level global workflows, and several Renovate configuration and onboarding refinements.

└──▷ WHAT SHIPPED · 6 FEATURES 0 OF 6 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
AI Bill of Materials (AI-BOM) report new 70

Generates a comprehensive inventory of detected AI entities — including models, system prompts, agent configurations, tools, and agents — exportable via the Mend Platform reporting interface and API in CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims. and SPDX 3.0.1 formats, across organization, application, and project scopes.

— Names formats and scopes but no exact endpoint path product docs
02 00
Renovate config additions: overrideDescription and devcontainer patterns new 65

Adds overrideDescription option to Renovate config, allowing custom description overrides per dependency update, and adds folder pattern support to managerFilePatterns for the devcontainer manager, broadening detection of dev container configuration files.

— Names exact config keys a reader can set directly product docs
03 00
Account-level global workflows with API support new 60

Introduces Account-Level (Global) Workflows, letting administrators define workflows centrally and propagate them to selected organizations, with controls over whether org-level admins can enable or disable them locally. Adds comprehensive API support for managing global workflows.

— Explains propagation and control mechanism but no named endpoints product docs
thinner coverage below
04 00
Chainguard support in hardened image detection new 55

Adds Chainguard as a supported source in hardened image detection, incorporating Chainguard-specific vulnerability and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. data, and detects Chainguard image layers and base images within scanned containers. Chainguard VEX status and branding are shown directly in the risk factors columns across the UI for clearer posture insights on Chainguard-based images and findings.

— Describes mechanism and UI surface but no config/API detail Version 26.8.1 (23-August-2026)
05 00
Administration sidebar restructure improved 55

Updates the Administration page sidebar with a categorized, collapsible navigation structure, including a new dedicated AI Usage tab under an AI category and sub-headers for AI, Code, and Dependencies within Engine Settings.

— Names exact nav elements, gives clear UI navigation path product docs
06 00
Renovate onboarding UI improvements improved 30

Onboarding summary view now surfaces the What to Expect section first, improving first-run clarity for new repositories, and onboarding documentation clarifies that security PRs do not count against PR limits.

— Thin, informational UI and docs changes with no mechanism product docs
Was this useful?
Detection & Response
◆  Detection Engineering

Tenzir

Sources Changelog → 1 release · 2026-08-24 Changelog

Tenzir is a data pipeline platform that ingests, transforms, and analyzes security telemetry and logs for threat detection.

Tenzir shipped parallel pipeline execution across the node and added RELPRELPReliable Event Logging Protocol, an open protocol for transporting syslog messages over a persistent TCP connection with application-layer acknowledgements, so a cyber tool built on it can guarantee log delivery without silent message loss. transport support for Syslog ingestion.

└──▷ WHAT SHIPPED · 2 FEATURES 0 OF 2 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Syslog ingestion over RELP new 35

Tenzir Node v6.12.0 adds Syslog ingestion over RELP (Reliable Event Logging Protocol).

— Names the protocol but no config keys or usage steps given changelog-20260824-a692e9f1
02 00
Parallel pipeline execution across the node new 30

Tenzir Node v6.13.0 supports parallel pipeline execution across the node, enabling concurrent pipeline runs.

— States the capability but no mechanism or config detail changelog-20260824-a692e9f1
Was this useful?
◆  Threat Intelligence

Yeti

Sources Release notes → 1 release · 2026-08-24 Notes

Your Everyday Threat Intelligence

Yeti 2.7.0 adds a dynamic endpoint for discovering creatable object types and reworks global search to group results by type with optional scoping for semantic searchsemantic searchSearching by meaning rather than requiring the same words. It commonly compares vector representations to find related content, even when the wording differs..

└──▷ WHAT SHIPPED · 2 FEATURES 0 OF 2 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Object-type discovery endpoint new 75

A new GET /system/types endpoint returns a dynamic list of every creatable object type available in the Yeti instance, useful for scripting bulk ingestion or building type-aware integrations before you know the schema.

Discover every object type your Yeti instance supports — useful before scripting bulk ingestion or building type-aware integrations.
$ curl -s -H 'Authorization: Bearer <token>' https://<yeti-host>/api/v2/system/types | jq .
— Named endpoint with runnable curl example, but no schema detail 2.7.0
thinner coverage below
02 00
Bucketed and scopeable global search improved 40

Global search results are now bucketed by type instead of returned as one merged, unranked list, and semantic search can be scoped to a single object type so it no longer crowds out other type results.

— Describes behavior change but no UI path or config surface named 2.7.0
Was this useful?
◆  SIEM

Sumo Logic

Sources Blog / feed → 1 release · 2026-08-24 Blog

Sumo Logic is a cloud-based platform for real-time log management, monitoring, and security analytics across applications and infrastructure.

Sumo Logic changed how the Save to Index alert type for scheduled searches stores results, removing the per-run result cap and altering how aggregate query fields are persisted.

└──▷ WHAT SHIPPED · 2 FEATURES 1 OF 2 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
Aggregate results no longer populate `_raw` field breaking 88

For scheduled searches using the Save to Index alert type with aggregate queries, the _raw (Message) field is now empty for results saved to a ScheduledSearchView; all values remain accessible in their individual named fields (e.g. _count, batch, parsedfield). Any downstream query that uses parse against _raw, searches plain-text keywords from the message body, or reads the Message column to get field values will break and must be updated to reference named fields directly.

— Names exact fields and gives a clear migration path. Changes to the Save to Index Alert Type for …
02 00
Unlimited results for Save to Index scheduled searches breaking 65

Removes the 512-result-per-run cap for scheduled searches using the Save to Index alert type, so every result returned by a run is now saved to the view. Searches that run frequently (e.g. every 15 minutes) without a limit operator may now save significantly more data per run than before.

— Names the alert type and cap removed, but no config example. Changes to the Save to Index Alert Type for …
└──▷ BREAKING ON UPGRADE
  • !
    For scheduled searches using the Save to Index alert type with aggregate queries, the _raw (Message) field is now empty — any downstream query that uses parse against _raw, searches plain-text keywords from the message body, or reads the Message column to get field values will break and must be updated to reference named fields directly.
  • !
    The 512-result-per-run limit for Save to Index scheduled searches is removed; searches that run frequently (e.g. every 15 minutes) without a limit operator may now save significantly more data per run than before.
Was this useful?
◆  Endpoint Security (EDR/XDR)

Trend Vision One

Sources Blog / feed → 1 release · 2026-08-24 Blog

Trend Micro's unified security platform providing threat intelligence, endpoint protection, and attack surface visibility across cloud and on-premises environments.

Trend Vision One's Zero Trust Secure Access On-premises Gateway 1.0.92 adds identity tracking for non-UPN users and expands DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest./AI detection log context tenfold.

└──▷ WHAT SHIPPED · 2 FEATURES 0 OF 2 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Larger DLP and AI detection log snippets improved 60

Maximum content snippet recorded in DLP and AI detection logs increases from 100 bytes to 1,000 bytes, providing substantially more context per log entry.

— Concrete before/after limits but no action step Zero Trust Secure Access On-premises Gateway…
thinner coverage below
02 00
Non-UPN support in authenticated user header improved 55

The gateway now supports non-UPN values in the X-Authenticated-User header and records them in traffic logs, enabling identity tracking for users whose identities are not expressed as UPNs.

— Names exact header but no config steps Zero Trust Secure Access On-premises Gateway…
Was this useful?
◆  Security Data Fabric & Federated Search

Vega

Sources Release page → updated · Aug 24, 2026 Notes

Vega is a decentralized protocol for derivatives trading that enables peer-to-peer trading of futures and options on a blockchain.

Vega launches Detection Skills, an open standard for post-match triage, investigation, and optimization built on Anthropic's Agent Skills format.

└──▷ HOW TO FIND IT
Export a spec-compliant Detection Skill as YAML from the detectionskills.io sandbox to review or contribute the skill to the community library.
📍In the detectionskills.io sandbox: build a detection, attach a triage or investigation skill from the library, preview the verdict, then click Export to download a spec-compliant YAML file. Submit it via the linked GitHub repository to publish it to the community library.
  • Launches the Detection Skills open standard at detectionskills.io, built on Anthropic's Agent Skills format, for encoding triage, investigation, and detection-optimization logic as versioned, shareable YAML skills.
  • Integrates Detection Skills into the Vega Cyber Defense Platform via a detection notebook workflow: compose detection logic, attach skills for triage/investigation/optimization, and receive tuning proposals with attached reasoning for engineer approval.
  • Adds an optimization loop that writes approved verdicts back into the detection rule, incrementally sharpening coverage with each alert fire.
  • Enables agentic detection and triage for emerging threat landscapes including dangerous AI model activity, with skills scoped to specific use cases rather than relying on a single catch-all agent.

4 details in Everything

Was this useful?
Identity, Access & Data Protection
◆  Secure Access (VPN / SASE / ZTNA)

DNSFilter

Sources Changelog → 1 release · 2026-08-24 Changelog

Give feedback to the DNSFilter team so we can make more informed product decisions. Powered by Canny.

DNSFilter shipped SecureTransit, a new VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection.-layer encryption policy for DNS traffic, alongside a full redesign of the DNSFilter One Agent and several dashboard usability changes.

└──▷ WHAT SHIPPED · 5 FEATURES 1 OF 5 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
SecureTransit encrypted VPN-layer traffic policy new 88

A new SecureTransit feature enforces DNS-layer traffic encryption through a DNSFilter-managed secure gateway, using either WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. or IKEv2IKEv2The second version of the Internet Key Exchange protocol, standardized by the IETF, used to negotiate and authenticate IPsec tunnels. Cyber tools build on it for reliable, fast VPN session setup with built-in NAT traversal and EAP support. protocols. Policy can be set per-organization or per-device to Always On, Manual, or Disabled from the existing DNS filtering dashboard, and it blocks location trackers, mail trackers, data brokers, and ad networks on-path before data leaves the device on any network. It is available as a per-device add-on with a 14-day free trial for existing customers, requiring no client-side credential setup.

Enforce always-on encrypted transit for a high-risk device group without requiring employees to configure anything.
📍In the DNSFilter dashboard, go to the policy settings for the target organization or device, locate SecureTransit, set the mode to Always On, choose WireGuard or IKEv2 as the protocol, and save. Credentials and gateway connections are provisioned server-side automatically.
— Names modes, protocols and rollout mechanics but no API/CLI surface. changelog-20260824-02df8de5
02 00
Redesigned DNSFilter One Agent UI improved 70

The DNSFilter One Agent (Windows) replaces the tray right-click menu with a full-window UI themed to system light or dark mode. Its Filtering panel shows protection state, filtering mode, last sync time, and an activity view of blocked and allowed queries over the past hour. Its SecureTransit panel (visible when SecureTransit is enabled) shows connection status, connected server on a map, region, protocol, session uptime, data transferred, and Connect/Disconnect controls. Its Settings panel consolidates version, hostname, diagnostics, and logs in one place.

— Names every panel and field but is a UI redesign, no exact navigation steps. changelog-20260824-02df8de5
thinner coverage below
03 00
Consolidated Query Log filter panel improved 40

Query Log filters have been consolidated into a single top-level panel with a unified Apply button, eliminating the need to set filters across multiple locations.

— Describes the change but gives no field names or exact UI path. changelog-20260824-02df8de5
04 00
Removal of Dashboard 'Reset to Default' action breaking 40

The destructive Reset to Default option has been removed from the Dashboard Actions menu; any workflow relying on it to reset dashboard layout will no longer find this control.

— Clear before/after but names only a menu item, not a config surface. changelog-20260824-02df8de5
05 00
Dashboard widget placement and view improvements improved 35

Dashboard widget placement now drops newly added widgets into the next available grid slot without overlapping or displacing existing widgets, and a persistent time range indicator remains visible while scrolling or switching dashboard views.

— Two thin dashboard UX tweaks with no further mechanism detail. changelog-20260824-02df8de5
└──▷ BREAKING ON UPGRADE
  • !
    The Reset to Default option has been removed from the Dashboard Actions menu — any workflow relying on it to reset dashboard layout will no longer find this control.
Was this useful?
◆  Identity & Access Management

Auth0

Sources Changelog → 1 release · 2026-08-24 Changelog

Secure users, AI agents, and more with Auth0, an easy-to-implement, scalable, and adaptable authentication and authorization platform.

Auth0 introduces Custom Rate Limits in Early Access, letting teams self-service throttle Authentication API consumption per client with either blocking or notify-only enforcement.

└──▷ WHAT SHIPPED · 1 FEATURE 1 OF 1 FEATURE most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
Custom Rate Limit Policies for Authentication API new 60

Adds API-based self-service configuration of Custom Rate Limit Policies to cap Authentication API OAuth request consumption per individual client, all third-party apps, or CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows. apps. Policies support configurable enforcement modes: block requests outright, or trigger non-blocking notifications for safer, gradual rollout.

— Names scope and modes but no API endpoint or config key changelog-20260824-f389ba09
Was this useful?

Ping Identity

Sources Changelog → 1 release · 2026-08-24 Changelog

Read docs, explore use cases, learn best practices

Ping Identity's PingOne AIC rapid channel shipped a batch of admin console refinements this window, including ESV support for connector server names, clearer script error feedback, faster identity and job editing workflows, and a reorganized navigation structure.

└──▷ WHAT SHIPPED · 6 FEATURES 0 OF 6 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 00
Reorganized navigation for verification, attestation and security settings improved 60

Moves the Identity Verification page under Integrations, Android Key Attestation under Authentication Methods, and Security Questions under Authentication in the admin console navigation.

— Names all three relocated pages and their new locations changelog-20260824-6e6a101a
thinner coverage below
02 00
ESV support for connector server name new 55

The New Connector Server modal now supports using an ESV (Environment Secret/Variable) to set the connector server name.

— Names exact modal and field, lacks further mechanism changelog-20260824-6e6a101a
03 00
Script error visibility for ESV references improved 45

The script editor now surfaces script errors directly in the editor when scripts reference environment ESVs incorrectly.

— Explains what changed, no config detail given changelog-20260824-6e6a101a
04 00
Faster consecutive identity creation improved 40

Users can now create another identity immediately after creating one, without closing the creation modal.

— Clear workflow change but no further scope changelog-20260824-6e6a101a
05 00
Edit future-scheduled jobs to start sooner improved 40

Supports editing a job that is scheduled to run in the future so that it starts sooner than originally planned.

— Names the capability but no mechanism detail changelog-20260824-6e6a101a
06 00
Modal and form usability improvements improved 30

Modals can now be closed with the Escape key, and form submissions now clearly highlight fields containing errors.

— Two minor UI polish items, thinly described changelog-20260824-6e6a101a
Was this useful?

iDenfy

Sources Release page → 1 release · seen 2026-08-24 Notes

Explore iDenfy documentation for identity verification (KYC), business verification (KYB), AML screening, fraud prevention, and more.

iDenfy's headline addition this window is a standalone Bank Card Verification flow running in a dedicated PCI-DSS v4.0.1PCI-DSS v4.0.1A payment card industry standard maintained by the PCI Security Standards Council that mandates controls protecting cardholder data; cyber tools use it as a compliance benchmark to audit and enforce those requirements. certified environment, shipped alongside Persian (Farsi) RTLRTLRegister Transfer Level, a hardware design abstraction describing how data moves between registers each clock cycle; cyber tools use it to analyze or synthesize digital circuits from HDL source. identity verification, Brazil Digital CNH support, and a cluster of smaller KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk. automation, data-field, and dashboard improvements.

└──▷ WHAT SHIPPED · 13 FEATURES 1 OF 13 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
Standalone Bank Card Verification flow new 78

Bank Card Verification can now run as a standalone flow, independently of identity verification, or as an additional step inside an existing KYCKYCKnow Your Customer — a regulatory requirement that financial services verify the identity of their users before granting access, used by cyber tools handling payments or financial data to stay compliant. flow, confirming the card used at onboarding belongs to its holder. The standalone flow is processed in a dedicated PCI-DSSPCI-DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. v4.0.1 certified environment and includes consent and capture screens, retry-attempt tracking, dual session clocks, and end-user result screens.

— Names environment and components but no exact API/flag snapshot-20260824
02 00
Full locale code reference for 37 languages new 60

Publishes a full locale code reference covering all 37 supported languages, including both Latin and non-Latin scripts, for use in KYC and KYB verification flows.

— Concrete language count, reference usable directly product docs
thinner coverage below
03 00
Risk Assessment PDF export new 55

Dashboard users can now export a Risk Assessment as a PDF from any KYC or KYB record for offline review or audit evidence.

Export a Risk Assessment as a PDF for offline review or audit evidence from a KYC record.
📍In the dashboard, open any KYC or KYB record › locate the Risk Assessment section › click Export PDF.
— Exact UI navigation path provided in example product docs
04 00
Persian (Farsi) RTL identity verification new 55

Identity verification now supports Persian (Farsi) with a full right-to-left (RTL) layout and automatic photo capture on the selfie step.

— Describes layout and capture behaviour, no config surface snapshot-20260824
05 00
No-further-shareholders declaration in KYB ownership chains new 55

KYB ownership chains can now terminate at a company declared to have no further shareholders, closing open-ended UBOUBOuBlock Origin, a browser extension maintained by Raymond Hill that blocks ads and trackers using filter lists; cyber tools embed or reference it to strip unwanted content from web traffic or scraped pages. (ultimate beneficial owner) chains.

— Explains mechanism and purpose but no UI/API detail snapshot-20260824
06 00
VAT Number, EIN, and TIN fields in KYB new 50

KYB workflows now include dedicated tax identification fields — VAT Number, EIN, and TIN — for capturing business tax identifiers.

— Names exact fields but no workflow mechanism product docs
07 00
Brazil Digital CNH document support new 45

Adds Brazil's Digital CNH (digital driver's license) as a supported identity document type for identity verification.

— Names document type but no flow detail product docs
08 00
API endpoint to re-run KYB automation new 43

A new API endpoint lets you programmatically re-trigger automated checks on existing KYB records, enabling re-running KYB automation without recreating a record.

— Endpoint exists but no exact path or method given product docs
09 00
External Reference field in KYC reports new 42

KYC verification reports now include an External Reference field for linking verifications to external systems.

— Names field but no usage detail product docs
10 00
Automated reminders in KYB Verify Later improved 40

KYB Verify Later now sends automated IDV reminders to beneficial owners to prompt them to complete verification.

— Describes behaviour but no trigger schedule or config product docs
11 00
Dedicated branding color for primary buttons improved 40

Primary buttons now support a dedicated branding color, separate from the general brand color configuration.

— Names the setting but no config key or path snapshot-20260824
12 00
Spelling variation matching in AI reviewer improved 30

The AI reviewer now matches spelling variations in name/entity review, improving detection of near-matches during automated review.

— No mechanism or examples of matching logic given product docs
13 00
Open dashboard records in new tab improved 20

Dashboard records can now be opened in a new browser tab.

— Minor UI change with no further detail product docs
Was this useful?
Govern
◆  AI/LLM Security

Mend.io Mend AI

Sources Release page → 1 release · 2026-08-24 Notes

Traditional application security misses AI risk. Standalone AI security tools miss your code.

Mend AI's biggest addition this window is an AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (AI-BOMAI-BOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk.) report for inventorying AI entities, alongside account-level global workflows with API management, Chainguard support in hardened image detection, a breaking Administration sidebar redesign, and a batch of Renovate configuration and onboarding tweaks.

└──▷ WHAT SHIPPED · 5 FEATURES 1 OF 5 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
AI Bill of Materials (AI-BOM) report new 78

New AI-BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. report available via the Mend Platform reporting interface and API, generating a metadata-only inventory of detected AI entities — models, system prompts, agent configurations, tools, and agents — scoped at organization, application, and project levels. Exports support the industry-standard CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims. and SPDX 3.0.1 formats for interoperability with existing SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. toolchains and compliance workflows.

— Names formats and scopes but no exact API endpoint (24-August-2026)
02 00
Chainguard support in hardened image detection new 70

Chainguard is now a supported source in hardened image detection, incorporating Chainguard-specific vulnerability data, VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. information, and base image/layer detection. Chainguard VEX status and branding are surfaced directly in the risk factors columns across the UI for Chainguard-based images and findings.

— Names the integration and UI surface but no config steps product docs
03 00
Renovate config, manager coverage and onboarding tweaks improved 67

Mend Renovate adds the overrideDescription config option to set custom descriptions on dependency update PRs, and adds folder pattern support to managerFilePatterns for the devcontainer manager to broaden file detection. The onboarding summary view now shows What to Expect first and clarifies that security PRs do not count against PR limits, and the Gradle manager now links to Dependency Verification documentation.

Override the auto-generated description on a Renovate dependency update PR using the new overrideDescription config option.
json 
{
  "overrideDescription": "Managed dependency update — reviewed by platform team"
}
— Names config key with runnable example, rest are thin UI notes product docs
04 00
Account-level global workflows new 65

Administrators can now define workflows centrally at the account level and propagate them to selected organizations, with controls over whether org-level admins can enable or disable them locally. Comprehensive API support was added for managing these global workflows.

— Describes mechanism but no concrete API paths given product docs
05 00
Administration sidebar redesign moves AI Usage settings breaking 60

The Administration page sidebar was redesigned with a categorized, collapsible navigation structure, adding a dedicated AI Usage tab under a new AI category and sub-headers for AI, Code, and Dependencies within Engine Settings. This is a breaking change: AI Usage settings moved from the General tab to the new dedicated tab, so any documentation or runbooks pointing to the General tab need updating.

— Clear UI path given but no config/API detail product docs
└──▷ BREAKING ON UPGRADE
  • !
    AI Usage settings have been moved from the General tab to a dedicated AI Usage tab under the new AI category in the Administration sidebar — any documentation or runbooks pointing to the General tab for AI Usage settings will need to be updated.
Was this useful?
Platforms & Utilities
◆  General Utilities & Libraries

goshs

Sources Release notes → 1 release · 2026-08-24 Notes

Feature-rich single-binary file server for red teamers and developers. HTTP/S · WebDAV · FTP/SFTP · SMB · LDAP/S · NTLM hash capture · DNS/SMTP callbacks · TLS · Auth · Share links.

goshs v2.1.6 replaces the old shared clipboard with a full persistent team chat (Markdown, ~1800 emoji, reactions, editing, image paste, file upload) synced across the web UI and TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency., adds an upload size cap, and closes several read-only/upload-only and ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource./auth bypasses across SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments., TFTPTFTPTrivial File Transfer Protocol, a minimal UDP-based file transfer protocol standardized in RFC 1350, used by cyber tools when simplicity and low overhead matter more than authentication or error recovery., HTTP and WebDAV.

└──▷ WHAT SHIPPED · 6 FEATURES 2 OF 6 FEATURES most completely described first
what's the number?

Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.

  • depth0–40 what it does and how it works or what changed
  • specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
  • actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point

Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.

01 01
Persistent team chat across web UI and TUI new 95

A new live team chat synchronized over a WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. connection replaces the old non-persistent shared clipboard in both the web UI and the --tui dashboard (TUI authors as tui@<host>). Messages render as Markdown with the full :shortcode: emoji set (~1800 emoji from the Mattermost catalog), composer autosuggest, collapsible code blocks (collapsed past 10 lines), emoji reactions with a who-reacted tooltip, in-place editing of own messages (press ↑ in the composer to recall and cycle previous messages, edits marked (edited)), image paste (inlined as base64 by default), file upload via a POST /?chatUpload endpoint (files land in .goshs-chat/, hidden from directory listing, respecting --read-only), and opt-in desktop Web Notifications for messages received while the tab is hidden. Chat can be disabled entirely with the -nc/--no-chat flag or no_chat config key (this replaces the old --no-clipboard flag, breaking any scripts that used it); the full chat log — messages, edit flags, per-emoji reaction authors — can be persisted to <webroot>/.goshs-chat/chat.json via -pc/--persist-chat (persist_chat config key) and restored on restart, with pasted images additionally written to disk via -pci/--persist-chat-images (persist_chat_images config key) instead of being inlined.

Persist the chat log and pasted images to disk so the conversation survives a goshs restart — useful across a long engagement.
$ goshs --persist-chat --persist-chat-images
Disable the team chat entirely when you want a clean, read-only file-sharing session without collaboration features.
$ goshs --no-chat
Configure chat persistence options in the goshs config file instead of passing flags each run.
json 
{
  "no_chat": false,
  "persist_chat": true,
  "persist_chat_images": true
}
Serve files without exposing the team chat — useful when sharing with untrusted recipients or in restricted environments.
$ goshs --no-chat
Disable chat entirely and avoid persisting any chat data when running goshs as a clean file-sharing server.
yaml 
no_chat: true
persist_chat: false
persist_chat_images: false
Run a persistent session that retains all chat messages and pasted images across restarts for later review.
$ goshs --persist-chat --persist-chat-images
Persist team chat history and pasted images across server restarts during a long engagement.
$ goshs --persist-chat --persist-chat-images
Run a read-only file server with chat disabled when you do not want any collaboration surface exposed.
$ goshs --read-only --no-chat
— Names every flag, config key, endpoint and storage path involved v2.1.6
02 00
Configurable upload size limit new 70

Adds the -mu/--max-upload flag to cap file upload size in bytes, defaulting to 0 (unlimited).

Cap uploads at 100 MB in a shared-session deployment so users cannot fill disk with large files.
$ goshs --max-upload 104857600
— Exact flag and default given, but limited context on error behavior product docs
03 02
Read-only/upload-only write-path enforcement hardened breaking 70

--no-delete, --upload-only and --read-only are now enforced across SMB, TFTP, HTTP and WebDAV write paths: overwrite, in-place write, truncate, and rename/move of pre-existing files are now refused as deletion-class operations, closing gaps where these were previously permitted.

— Names the flags and protocols but gives no reproduction command v2.1.6
04 00
WebDAV LOCK/UNLOCK blocked under restrictive modes improved 65

WebDAV LOCK/UNLOCK operations are now blocked by webdavGuard when --read-only or --upload-only is set, preventing lock-null empty file creation that previously bypassed those modes.

— Names the guard and methods but no runnable reproduction v2.1.6
05 00
ACL resolution merges .goshs files up to webroot improved 65

findEffectiveACL now merges .goshs files up to the webroot: the nearest ancestor that sets Auth wins, and block lists are unioned, preventing a block-only child .goshs file from erasing a parent directory's auth requirement.

— Names the function and merge rule but no example config shown v2.1.6
thinner coverage below
06 00
Collaborator feed strips Authorization header improved 50

The collaborator feed now unconditionally strips the Authorization header, alongside the CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. token, at every call site, preventing per-directory ACL credentials from leaking to unauthenticated watchers.

— Clear fix described but no way to verify or invoke it directly v2.1.6
└──▷ BREAKING ON UPGRADE
  • !
    The --no-clipboard flag is replaced by --no-chat (-nc); any scripts or configs using --no-clipboard will break on upgrade.
Was this useful?
// END OF TRANSMISSION

The Cyber Toolchain · curated daily · August 24, 2026
Releases & features from the open-source and commercial cyber tools that practitioners actually run.

▷ Subscribe
cyber-toolchain / feedback

Feedback on

compare.md

    Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

    my-toolchain — 0 tools

      Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
      browse all tools → score card for your toolchain →
      cyber-toolchain / feedback

      Send us feedback