The Cyber Toolchain — issue 061, September 1, 2026

A new opt-in Generate HAR files option can be toggled on under authentication verification settings to capture HAR files for inspecting auth flows and diagnosing credential or session issues; it is disabled by default to avoid unnecessary HAR file generation.

Consumes exploitability-qualified findings and automates remediation: teams define triggering events, agent action sequences, and confidence thresholds once, and the workflow fires automatically, routing findings to the owning engineer and returning fixes as reviewable pull requests with a full audit trail.

Detected authorization CVEs (gitea CVE-2025-68941 and next.js CVE-2025-29927) that Semgrep OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees., CodeQL, and Cycode's own rule engine all missed, across a ten-repository, six-language benchmark run on an affordable open-weights reasoning model.

Introduces per-scan configuration of mode, model, and scope as three independent dials, letting teams target expensive reasoning only at code classes rules cannot describe while keeping deterministic scanning on every commit; every scan records what ran, when, on which code, and with which model for auditability.

Links related findings across files into a single multi-step exploit path, carrying data flow from untrusted source to dangerous sink and tagging the resulting risk category, e.g. Code Injection — Critical.

veracode package gained finer control over what gets packaged: --exclude prevents specified Java packages or JAR files from being scanned, --skip-packagers excludes specific unsupported artifacts (e.g. unsupported SQL) without affecting other languages, --java-source and VERACODE_PACKAGE_JAVA_SOURCE=true enable Java source code packaging, VERACODE_PACKAGE_GOLANG_GENERATE enables client-side CGO code generation for Go, and SRCLR_MAKE_WINDOWS enables preprocessing C/C++ source with Make on Windows using a native gcc or clang compiler. The command also added --strict, which returns exit code 4 on build failures, and new exit codes 5, 6, and 7 to improve CI/CD pipeline error handling.

The new veracode package discover command detects toolchains required to produce scannable artifacts, with detection later extended to Java projects using Gradle and JavaScript projects using npm or Yarn; the command also gained exit codes to support automation.

veracode package added support for requirements-dev.txt in Python packaging to include development dependencies, the Poetry package manager for Python autopackaging, a generic packager for Apex, Go v1.24, .NET 9, MSBuild .NET framework packaging, preprocessor header files used to build PCH, and an option to process all Makefiles in a directory tree. Preprocessed source code scanning is now the default method for C/C++ projects on Windows and is now also available on Linux.

veracode scan now categorizes secret-type findings as Critical, prioritizes vulnerability results from the NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. database when available, allows specifying a custom location for downloading vulnerability databases, adds Dockerfile heredoc syntax parsing support, introduces schema enhancements for container and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scan results, and creates a separate asset for each repository in ADO workflows for easier individual scan result tracking. veracode static scan now displays the Static Engine version in the scan summary.

The veracode sca command now supports SBOM generation via SCA agent-based scans, with results publishable in CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. and SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format. formats.

veracode scan allows applying a custom policy defined in the Veracode Platform and enables viewing policy evaluation for individual findings alongside the overall policy result.

The SRCCLR_DOWNLOAD_URL environment variable now defaults to https://sca-downloads.veracode.com, replacing the previous default of https://download.sourceclear.com, which is now deprecated; all instances in your environment should be updated.

New --incomplete-policy warn|error flag (default: warn) controls exit behavior when detection data is incomplete; error exits with code 3. The GitHub Action also gains a matching incomplete-policy input for CI pipelines.

$ cve-lite /path/to/project --incomplete-policy error

Findings are enriched with FIRST.orgFIRST.orgA global forum of incident response and security teams that sets shared standards and best practices; cyber tools cite membership or its frameworks (like CVSS) to signal coordinated vulnerability handling. EPSS scores after the OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. pass: the highest score appears in the terminal top-3 block, a verbose table column, and the HTML report detail panel, while the full score array is included in JSON output. Enrichment is skipped in offline mode and for GHSA-only findings.

Adds the npm registry advisory API as a secondary source for packages with zero OSV matches, closing coverage gaps for CVEs without an npm ecosystem mapping in OSV. The fallback is skipped in offline mode and is non-fatal on error.

One Risk Orchestration correlates signals from SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., infrastructure-as-code security, API security, secrets detection, containers, repository health, DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces., and third-party tools, enriched with exploitability, reachability, exposure, ownership, and business criticality for enforcement across pull requests, builds, and releases.

Remediation Assist provides review-ready guidance and suggested code changes for prioritized findings and, for supported GitHub Code Repository Integration projects, can open a separate pull request containing the proposed fix for developer review — nothing is merged automatically.

AI Inventory and AI-BOM use deterministic analysis to identify models, agents, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, AI libraries, and SDKs across repositories, with findings traceable to specific files and lines of code, and versioned AI-BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. documentation generated per release.

Checkmarx Fusion (early access) is a Multi-Model AI Engine that runs curated frontier models over the hybrid SAST engine's already-validated findings to surface novel and AI-generated-code vulnerabilities with no known rule, CVE, or signature. It is available as an optional, usage-based layer where teams choose higher- or lower-cost models per project.

Developer Assist is a new autonomous mode that uses hooks and MCP to intercept coding-agent actions such as file writes and package installations before they take effect, returning remediation guidance directly to the agent from an independent AppSec layer.

Triage Assist applies AI reasoning to eligible SAST and SCA findings, grounded in reachability, exploitability, code context, risk context, policy, and mitigating controls, to distinguish actionable findings from acceptable risks and suspected false positives.

A new License Policy setting lets teams flag components with no license, assigning a severity and a label that then appears on the Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. for any component lacking a license.

Adds CRICTL_CREDSCRICTL_CREDSAn environment variable used to pass container registry credentials to crictl, the CLI for CRI-compatible container runtimes; cyber tools use it to pull images without embedding secrets in command arguments. and CRICTL_AUTH environment variables and a -u alias for --username to the crictl create and crictl run commands, aligning their authentication handling with crictl pull.

$ CRICTL_CREDS='myuser:mypassword' crictl run container-config.json pod-config.json

Adds a --max-retries flag to crictl to control the number of connection retry attempts, using exponential backoff, with a default of 3 retries.

The POST /api/v2/search/semantic endpoint now returns each hit as {score, matched, object_summary} instead of a full object with semantic_score and matched_on merged in. The new matched field returns only the specific matching document (e.g. for a DFIQ question matched via an approach, just that approach with its description and steps, not all approaches). The new object_summary field contains id, root_type, type, name, description, and tags — the id can be used to fetch the full object separately, and dfiq_yaml is no longer included in responses. This cuts response size from 19,845 to 2,836 bytes (~86% reduction) on a 5-result query with identical results and ordering. Existing clients parsing the old shape will break.

$ curl -s -X POST https://<yeti-host>/api/v2/search/semantic \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer <token>' \
  -d '{"query": "lateral movement via scheduled tasks", "count": 5}' | \
  jq '.hits[] | {score: .score, name: .object_summary.name, type: .object_summary.type, id: .object_summary.id}'

Sophos ITDR now surfaces a Risk Score per identity, combining breach likelihood with potential impact, powered by a patent-pending ML model that updates as findings and accounts change.

Custom Integration scripts now support WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. (WinRMWinRMA Windows-native remote management protocol from Microsoft, implementing the WS-Management standard, that lets tools execute commands and access data on remote Windows hosts over HTTP or HTTPS., SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments., DCERPC) for deep Windows host collection, custom application protocols over TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it., UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery., and Unix streams, and shared common settings for protocols like HTTP and TLS. Scripts can now define detailed credential fields and validation rules, track a maturity mode (alpha, beta, stable) for filtering, and be run in console instances in addition to Explorers and the CLI. Scripts can be authored and tested in-product using an AI model of choice, submitted for inclusion as native runZero sources, and are now available to all administrators including those with narrow access scopes; the community custom integration script library now covers more than 100 products and is accessible directly in the console.

The MCP service now supports OAuth, including Export Token and Organization Key as OAuth Client Secrets, in addition to API Clients. The MCP service and in-product AI Threads now share the same tools.

Applications can opt into biometric-template retention via face_retention_policy and face_retention_days fields on PATCH /v3/webhook/, or via the Retain biometric template toggle and required retention-period field under App Settings → Data (also visible at Lists → Biometric templates), keeping one image-free face template anchored to a user after session deletion so duplicate detection, Face Search, and biometric authentication keep working. A new Biometric Templates API — GET /v3/biometric-templates/, GET /v3/biometric-templates/count/, GET/DELETE /v3/biometric-templates/{template_uuid}/, and POST /v3/biometric-templates/delete/ — lists, counts, inspects, and purges retained templates; DELETE /v3/session/{sessionId}/delete/ also accepts retain_face_embeddings to override the policy per session, and deletion_instruction/instruction_id to satisfy privacy-erasure requests, while POST /v3/users/delete/ now purges a user's templates before deleting them and returns 503 if a template can't be purged. As a breaking change, DELETE /v3/session/{sessionId}/delete/ and POST /v3/sessions/delete/ now return 200 OK with a JSON body (face_retention_outcome, biometric_template_uuid, per-session results[]) instead of 204 No Content.

$ curl -X PATCH https://api.didit.me/v3/webhook/ \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"face_retention_policy": "retain", "face_retention_days": 365}'

$ curl -X PATCH https://api.didit.me/v3/webhook/ \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"face_retention_policy": "retain", "face_retention_days": 365}'

$ curl -X DELETE https://api.didit.me/v3/session/{sessionId}/delete/ \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"retain_face_embeddings": false}'

$ curl -X DELETE https://api.didit.me/v3/session/{sessionId}/delete/ \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"deletion_instruction": "privacy_erasure", "instruction_id": "<your-instruction-id>"}'

New POST /v3/email/risk/, POST /v3/phone/risk/, and POST /v3/ip/risk/ endpoints return standalone risk signals for an email address, phone number, or IP address without starting a full verification session, each priced per call.

$ curl -X POST https://api.didit.me/v3/email/risk/ \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"email": "user@example.com"}'

New /v3/transactions/rules/ Management API endpoints let you create, update, delete, and backtest transaction-monitoring rules programmatically, with matching library and install endpoints to browse, install, and remove preset rules from the rule library — mirroring what's available in the Business Console. Nine didit_transaction_rule_* MCP tools expose the same list, create, update, delete, backtest, and library workflows to any MCP-connected AI agent, and every manual transaction status change is now attributed to the console user who made it.

New POST /v3/document-ai/ endpoint extracts structured data from any uploaded document, not just identity documents, and accepts uploads up to 50 MB.

$ curl -X POST https://api.didit.me/v3/document-ai/ \
  -H 'Authorization: Bearer <token>' \
  -F 'file=@invoice.pdf'

New identity documents: Moldova ID card (2025), Pakistan ID card (2025), Uruguay ID card (2026), Greece asylum seeker card (2025), and a third Belgium driving license variant. Malaysia MyKad is now selectable as its own subtype rather than a generic ID card, and extraction is upgraded for Belgium, Germany, India, Israel, Madagascar, New Zealand, Norway, Sierra Leone, South Africa, and the United States. Firearm licenses are now a selectable document category, covering Victoria (Australia) and Illinois, Massachusetts, and two New Jersey permits (United States). Digital driving licenses are added for Argentina (Mi Argentina and Jujuy) and Australia (New South Wales including provisional, South Australia including learner, and Victoria including heavy vehicle). The ePassport trust store is expanded to 136 issuing countries with new signing-certificate generations for 32 of them, workflows can now route on the specific NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. skip reason when a chip is not read, and the barcode on North American driving licenses now reports its signed fields with each signature validated against its certificate's validity window.

Didit Copilot is now a resizable floating panel available on every Business Console page, with fullscreen layout on mobile and voice plus typed input. Copilot can build a complete workflow from a natural-language description — adding and configuring steps, branches, and final-status rules — and validate it before publishing; build a questionnaire from an attached CSV or Excel file, including very long answer lists; configure Database Validation by conversation for any supported country; and answer questions with inline citations that open the underlying documentation without leaving the panel.

The Didit assistant, or any MCP-connected agent, can accept a rule set exported as CSV or Excel from another provider, map it onto Didit's rule schema, backtest it against your own transaction history, and create the rules in test mode.

Registry-search outages now return HTTP 502 with code: 'kyb_registry_provider_unavailable', and phone-provider outages now return HTTP 502 with code: 'phone_provider_unavailable', so integrations can detect and react to provider downtime programmatically.

Age-assurance workflows can now support ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 27566-1: a workflow that declares the standard cannot return identity attributes alongside the age decision. The Age Estimation borderline band is now exposed in the workflow graph, enabling routing of uncertain results to a document check.

Nigeria Bank Verification Number (BVN) is now a Database Validation source, gated on a selfie face match with names as optional inputs. Database Validation can also run without a document capture step, with each field drawing from its own input source, such as a selfie plus a national ID number.

A new Support section in the Business Console gives organization-scoped tickets with live status, a standard tickets table, category/severity/session-ID filing, attachment support, per-ticket permalinks, and escalation to a human agent in the same thread.

SailPoint Workflows now warns in the workflow editor and on the Test Workflow experience when a filterable trigger has no filter configured. During test runs, the configured trigger filter is now applied against the test input and shown as matching or not — previously test runs ignored the trigger filter entirely.

A new Dashboard toggle on enterprise connections enables the Cross-App Access Requesting App flow, letting apps silently fetch third-party API tokens for authenticated users without requiring per-integration Connect your account clicks. It is built on Auth0 Token Vault using the ID-JAG (Identity Assertion Authorization Grant) protocol, currently supported on OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. and Okta Workforce connections. In multi-org tenants, token resolution is org-aware: requests are scoped by org_id and rejected if the enterprise connection or target resource app is not enabled for that organization, or if the org context is ambiguous across multiple identities.

⤢ ⤢ ⤢ ⤢

A new Admin Logs section in the Clerk Dashboard provides a reverse-chronological audit trail of configuration changes made via the Dashboard, Backend API, or Platform API — tracking events such as creating OAuth applications, updating instance settings, rotating secrets, and managing Roles and Permissions. Logs support filtering by Event type (with trailing wildcard support, e.g. oauth_application.*), Instance, Application, Actor, IP address, and Time range; available on Business and Enterprise plans, recording from August 24, 2026 onward.

⤢ ⤢

A new Reverification window setting on the Sessions page in the Clerk Dashboard lets admins configure how long a successful reverification remains valid, from 1 to 10 minutes (default: 10 minutes). This controls how frequently users must re-authenticate before sensitive actions such as changing a password, adding/removing an email address, revoking a session, or deleting an account.

Clerk mobile SDKs now support biometric credential enrollment and sign-in (Face ID, Touch ID, Android biometrics) via useBiometricCredentials (React Native), Clerk.shared.biometricCredentials.signInWithBiometrics and Clerk.shared.biometricCredentials.biometricCredentialId (Swift), and Clerk.biometricCredentials.signInWithBiometrics and Clerk.biometricCredentials.biometricCredentialId (Android), with the private key remaining device-bound.

Aembit access policies can now attach a CrowdStrike AIDR content security configuration to inspect MCP traffic — tool listings, tool inputs, and tool outputs — from the same control plane that handles identity and credential issuance. Inspection is opt-in per policy: only policies explicitly configured with a CrowdStrike AIDR content security configuration trigger checks, and each policy can be set to fail-open or fail-closed if AIDR is unreachable, with every failure recorded as a workload event. Based on AIDR's decision, Aembit allows, blocks, or forwards a transformed version of the MCP content (e.g., sensitive data redacted or defanged), logging the outcome as a workload event tied to the agent identity, target MCP server, and access policy. The integration is configurable through the Aembit UI, API, or Terraform, and requires a CrowdStrike AIDR for Agents subscription.

⤢

The new Cato MSASE Business Center adds a consolidated Business Overview page showing business accounts, orders, license usage, invoices, and customer lifecycle activity across a partner's portfolio. Authorized partners can self-provision eligible services and activate new customer accounts directly in the portal without waiting for manual approval workflows.

⤢

▶ ⤢

Customizable Dashboards is now the default landing view for all users, replacing the retired legacy Overview page; existing bookmarks to the old page redirect automatically. The new Dashboard Filters drawer merges the previous Quick Filters and Advanced Filters into a single experience, grouped by Source (Organizations, Sites, Roaming Clients/Relays, Users) and Traffic (Result).

CommandCredentialConfig gains a format field for ambient credentials — a literal template such as sk-ant-oat01-{} that shapes the visible phantom token so prefix-sniffing clients recognise it as valid while nono brokers the real secret behind it.

{
  "command_policies": {
    "credentials": {
      "claude-key": {
        "type": "ambient",
        "env_var": "ANTHROPIC_API_KEY",
        "format": "sk-ant-oat01-{}"
      }
    }
  }
}

New sandbox arg --strict-broker-path causes nono to refuse to start, instead of merely warning, when a filesystem grant overlaps a directory on PATH, blocking planted-binary attacks on host processes outside the sandbox.

$ nono run --profile nolabs-ai/opencode --strict-broker-path -- opencode

nono proxy gains the --extends <PROFILE> flag, giving it the same repeatable profile-composition semantics already available on nono run; it requires --profile to be set.

$ nono proxy -p default --extends extra-domains