The Cyber Toolchain — issue 062, September 2, 2026
THE CYBER TOOLCHAIN
NO. 062
Tail
THE DAILY RELEASE FIREHOSE
PUBLISHED SEPTEMBER 2, 2026 · EVERY DAY
EDITIONStail|grep|head|ls|diff|uniq
The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
What stands out across today's releases, grouped by what it lets you do. Every tool named links to its entry below.
Three unrelated things stand out. cve-lite-cli now folds FIRST.orgFIRST.orgA global forum of incident response and security teams that sets shared standards and best practices; cyber tools cite membership or its frameworks (like CVSS) to signal coordinated vulnerability handling. exploitation-likelihood into CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. so a backlog sorts by what actually gets exploited; Checkmarx runs reachability inside SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., killing the dependency findings nothing in your code calls; and Prowler adds 25 checks across AWS and seven other providers plus CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Google Workspace and NCSC Cyber EssentialsCyber EssentialsA UK government-backed certification scheme that defines a baseline set of technical controls organizations must implement to defend against common cyber threats, giving cyber tools a compliance benchmark to assess or report against. mappings.
identify
Cut a vulnerability backlog down to the findings that can actually hurt you
cve-lite-cli's EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. Priority Signal blends CVSS with FIRST.org exploitation likelihood into four tiers in JSON, terminal and HTML, so triage stops treating every critical as equal; Checkmarx One 3.66 puts reachability analysis natively in SCA so unreachable transitive dependencies drop out before anyone opens a ticket. Strix now emits contextual CVSS dependency reports in the same vein.
Produce audit evidence and AI-agent policy without a manual paper chase
JFrog AppTrust auto-assembles signed release-evidence chains against out-of-the-box NIST SSDFNIST SSDFA NIST framework of secure software development practices, organized into four groups, that gives teams a common vocabulary and baseline for reducing vulnerabilities introduced during the development lifecycle. and EU CRAEU CRAEU Cyber Resilience Act, a European Union regulation requiring manufacturers and publishers of products with digital elements to meet mandatory cybersecurity standards before selling into the EU market. frameworks, replacing the spreadsheet someone builds at audit time, and its AI Catalog puts MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, skills and plugins behind a governed registry with Shadow AI Detection. Prowler adds CIS Google Workspace v1.4.0CIS Google Workspace v1.4.0A benchmark published by the Center for Internet Security specifying hardening controls for Google Workspace tenants; cyber tools use it as a rule set to audit configurations against an accepted baseline. and NCSC Cyber Essentials v3.3NCSC Cyber Essentials v3.3A UK government-backed certification scheme, maintained by the NCSC, that defines a baseline of five technical controls organisations must meet to defend against common cyber threats; cyber tools use it as a compliance benchmark., and Aembit routes MCP traffic through CrowdStrike Falcon AIDR inspection tied to workload identity.
Three unrelated things stand out today: Elastic Security Labs can turn Sentinel migrations and alert triage into assisted SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. work, cve-lite-cli ranks CVEs by exploit likelihood instead of severity alone, and JFrog ties signed release evidence to compliance frameworks.
respond
Move alert triage and detection migration out of copy-paste mode
Elastic Security 9.5 adds AI-assisted Sentinel rule migration, alert triage, and Attack Discovery workflows that can draft detection rules. That reduces the analyst toil around porting detections and turning an investigation into reusable coverage.
Prioritize vulnerabilities by exploitation likelihood, not severity alone
cve-lite-cli adds an EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. Priority Signal that blends CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. with FIRST.orgFIRST.orgA global forum of incident response and security teams that sets shared standards and best practices; cyber tools cite membership or its frameworks (like CVSS) to signal coordinated vulnerability handling. exploitation-likelihood data into four tiers, while Checkmarx adds native reachability analysis inside SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scans. Teams get a cheaper first cut on which findings are likely exploitable or reachable before spending remediation time.
Attach evidence and policy to releases and AI components
JFrog now auto-assembles signed release-evidence chains for NIST SSDFNIST SSDFA NIST framework of secure software development practices, organized into four groups, that gives teams a common vocabulary and baseline for reducing vulnerabilities introduced during the development lifecycle. and EU CRAEU CRAEU Cyber Resilience Act, a European Union regulation requiring manufacturers and publishers of products with digital elements to meet mandatory cybersecurity standards before selling into the EU market. reporting, and expands governance over MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, skills, plugins, and agent packages. Aembit adds policy inspection for MCP traffic enriched with workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials., giving teams a control point for AI-agent activity instead of treating it as opaque application traffic.
Find more attack surface without waiting for cloud access
Noir extends endpoint detection into CLI frameworks across 20+ languages and can run passive-scan rules offline with custom rule paths. Prowler adds 25 checks across AWS and seven other providers plus Slack alerting, making newly discovered cloud and API findings easier to surface without manual report polling.
NodeZero's 2026.08 release adds two new pentest op types — WebApp and Azure Cloud — alongside Australian data residency, new Activity & Artifacts tabs for distinguishing NodeZero actions from real attacks, expanded Rapid Response coverage, and several Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. & Identity assessment upgrades.
NodeZero's 2026.08 release adds two new pentest op types — WebApp and Azure Cloud — alongside Australian data residency, new Activity & Artifacts tabs for distinguishing NodeZero actions from real attacks, expanded Rapid Response coverage, and several Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. & Identity assessment upgrades.
└──▷ WHAT SHIPPED ·
5 FEATURES2 OF 5 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0101
Azure Cloud pentest op typenew60how completely this was documenteddepth30/40specificity15/30actionability15/3060 / 100
A new Azure Cloud pentest op type combines Azure API enumeration with an Internal pentest for a single assumed-breach assessment covering both Azure control planes and workloads running on Azure VMs.
Assess an Azure environment end-to-end — from control plane enumeration to lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. on VMs — in a single assumed-breach op.
📍In NodeZero, go to Launch Op › Azure Cloud Pentest, supply your Azure credentials/scope, and select the combined Azure API + Internal pentest assessment mode.
— Clear mechanism and scope; only UI launch steps as action, no API.snapshot-20260901
0200
Activity & Artifacts tabs across Real-Time and post-op viewsnew60how completely this was documenteddepth25/40specificity15/30actionability20/3060 / 100
New Activity and Artifacts tabs are added to both the Real-Time View and post-op test results; the Action Log is extended across both views, and the Artifacts tab lets reviewers browse collected files to correlate NodeZero's actions against IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity./SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. alerts and rule out false positives, helping distinguish NodeZero activity from malicious attacks.
After an op completes, use the Artifacts tab to review files NodeZero collected and correlate its actions against IDS/SIEM alerts to rule out false positives.
📍In the NodeZero console, open a completed pentest, select the Activity tab, then switch to the Artifacts tab to browse collected artifacts alongside the Action Log entries.
— Exact UI navigation given; names the tabs and their purpose.snapshot-20260901
thinner coverage below
0302
Rapid Response tests for Metabase, GitLab, Ivanti, plus cert and S3 takeover detectionnew55how completely this was documenteddepth20/40specificity25/30actionability10/3055 / 100
New targeted Rapid Response tests cover critical vulnerabilities in Metabase, GitLab Community and Enterprise Editions, and Ivanti Endpoint Manager, plus expanded certificate and Amazon S3 takeover detection.
— Names all affected products but gives no steps to run a test.product docs
0400
Active Directory & Identity assessment upgradesimproved50how completely this was documenteddepth20/40specificity20/30actionability10/3050 / 100
Active Directory and Identity assessments gain a dedicated Identity Details view, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ticket extraction during credential dumping, and safer authentication workflows.
— Names three concrete additions but no UI path or command given.snapshot-20260901
0500
Australia data residencynew30how completely this was documenteddepth15/40specificity10/30actionability5/3030 / 100
Platform traffic and pentest data can now be kept within the Australian region for data-sovereignty compliance.
— States the capability but no setup steps or config named.snapshot-20260901
ADscan v11.3.0 adds a didactic teaching mode, seasonal password sprayingpassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password., a minimal-footprint krbtgt-only DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers. option, cross-forest attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis with two automated escalation routes, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. credential-attribute harvesting as a full attack step, and pre-filled independent-verification commands for every finding.
Free Active Directory pentesting tool for Linux. Automates AD and LDAP enumeration, Kerberoasting, ASREPRoast, password spraying, ADCS/ESC1, DCSync, RBCD, gMSA, shadow credentials, NTLM relay and credential dumping across 104 techniques, mapping BloodHound-compatible attack paths to Domain Admin.
ADscan v11.3.0 adds a didactic teaching mode, seasonal password sprayingpassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password., a minimal-footprint krbtgt-only DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers. option, cross-forest attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis with two automated escalation routes, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. credential-attribute harvesting as a full attack step, and pre-filled independent-verification commands for every finding.
└──▷ WHAT SHIPPED ·
7 FEATURES5 OF 7 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Independent verification commands per findingnew85how completely this was documenteddepth30/40specificity30/30actionability25/3085 / 100
Reports and the web platform now include a Verify this finding independently block per attack step, with native Windows/PowerShell (Get-ADUser, Get-Acl, dsacls, certutil) and Linux equivalents pre-filled with the real DC IP and domain name, covering KerberoastingKerberoastingAn attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access., AS-REP RoastingAS-REP RoastingAn attack against Kerberos accounts that do not require pre-authentication. An attacker obtains an encrypted authentication response and tries to crack the account's password offline., DCSync, ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. ESC1, and the GenericAll/GenericWrite/WriteDACL/WriteOwner ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. family.
— Named exact commands and coverage, pre-filled and ready to runv11.3.0
0200
Didactic mode for technique explanationsnew80how completely this was documenteddepth30/40specificity25/30actionability25/3080 / 100
Adds set explain_level off|basic|deep to control didactic mode verbosity, and explain <technique> (e.g. explain kerberoasting, explain "ADCS ESC1") to display a teaching card — MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. ID, equivalent manual command, and detection Event IDs — for any technique without executing it.
Before a Kerberoasting step in a lab, display its full teaching card — MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ID, manual equivalent, and detection Event IDs — without triggering the attack.
$ explain kerberoasting
— Names exact commands and card contents; runnable as shownv11.3.0
0301
Seasonal password spraying strategynew80how completely this was documenteddepth30/40specificity25/30actionability25/3080 / 100
Adds a month_season spray strategy to the scan config for seasonal password spraying (e.g. March2026, Verano2026), with per-domain language inference (English/Spanish) and last-password-change awareness when domain credentials are available; runs automatically in adscan ci.
Run a fully unattended CI scan that includes both month and season spray passes against a domain, using the month_season strategy.
$ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'
— Named config strategy and CI integration with a runnable examplev11.3.0
0402
Automated cross-forest escalation routesnew65how completely this was documenteddepth30/40specificity25/30actionability10/3065 / 100
Automated cross-forest escalation now ships two routes: from a compromised trusted forest into the trusting forest via cross-organization TGT-delegation trust, and from a compromised child domain up to its forest root (RaiseChild); each route triggers post-compromise actions on the reached domain.
— Clear before/after mechanism, no exact command shownv11.3.0
0503
LDAP description/info credential harvestingnew65how completely this was documenteddepth30/40specificity20/30actionability15/3065 / 100
Plaintext credentials stored in account description or info LDAP attributes are now a validated, end-to-end attack step: ADscan reads the attribute, recovers the credential, verifies the login, and traces the resulting route across forest boundaries.
— Full mechanism described, no direct command givenv11.3.0
0604
Cross-forest attack path graph analysisnew60how completely this was documenteddepth25/40specificity25/30actionability10/3060 / 100
Attack pathsAttack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. now cross domain and forest boundaries in multi-domain workspaces, analysed as a unified graph, including cross-forest Kerberoasting, AS-REP Roasting, and ADCS ESC8ESC8An Active Directory privilege escalation path where an attacker abuses the Web Enrollment interface of a Microsoft Certificate Authority to coerce NTLM authentication and relay it to obtain a certificate for a privileged account./ESC11 relay routes across trusts.
— Names specific techniques and route types but no command to invokev11.3.0
thinner coverage below
0705
krbtgt-only DCSync modenew50how completely this was documenteddepth25/40specificity15/30actionability10/3050 / 100
DCSync now supports a krbtgt only replication mode that captures the golden-ticket key without pulling every account, offering a minimal-footprint path to proving full domain compromise.
— Mechanism described but no flag or command givenv11.3.0
Strix v1.6.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server support with per-task isolation, a managed cloud CLI, workspace file injection into the sandbox, contextual CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. dependency vulnerability reports, and a wave of new security skills including OWASP LLM Top 10OWASP LLM Top 10A ranked list of the ten most critical security risks specific to large language model applications, maintained by OWASP, giving cyber tool developers a shared taxonomy for prioritizing LLM attack surfaces. 2026 coverage.
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
Strix v1.6.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server support with per-task isolation, a managed cloud CLI, workspace file injection into the sandbox, contextual CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. dependency vulnerability reports, and a wave of new security skills including OWASP LLM Top 10OWASP LLM Top 10A ranked list of the ten most critical security risks specific to large language model applications, maintained by OWASP, giving cyber tool developers a shared taxonomy for prioritizing LLM attack surfaces. 2026 coverage.
└──▷ WHAT SHIPPED ·
10 FEATURES0 OF 10 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Workspace file injection via `--workspace-file`new90how completely this was documenteddepth30/40specificity30/30actionability30/3090 / 100
Adds a --workspace-file CLI flag and extra_files config key that place caller-provided files into the sandbox workspace before a scan starts, letting agents reference fixtures or seed data without baking them into the target directory.
Inject a custom config or seed file into the sandbox so agents can reference it during a pentest without baking it into the target directory.
— Names exact flag, config key, and a runnable command.v1.6.0
0200
MCP server support with per-task isolationnew75how completely this was documenteddepth35/40specificity25/30actionability15/3075 / 100
Adds MCP server support with connections isolated per task, on-demand tool resolution instead of bulk registration, connection status surfaced in the UI, and resilience so connections survive transient transport failures.
— Describes mechanism and behaviour but no concrete command.v1.6.0
0300
`--host` option for `strix view`new75how completely this was documenteddepth20/40specificity25/30actionability30/3075 / 100
Adds a --host option to strix view to expose the local results viewer on a custom interface, e.g. --host 0.0.0.0.
Expose the scan results viewer on all interfaces at a fixed port when reviewing findings on a remote dev box over SSH.
`strix cloud` subcommand for managed platformnew55how completely this was documenteddepth20/40specificity20/30actionability15/3055 / 100
Adds a strix cloud subcommand for the managed platform CLI, covering login, scans, billing, and the full cloud API.
— Names subcommand and scope, no example usage.v1.6.0
0600
Contextual CVSS breakdown for dependency reportsimproved55how completely this was documenteddepth25/40specificity20/30actionability10/3055 / 100
Adds contextual CVSS breakdown and required usage evidence on dependency vulnerability reports.
— Describes what changed but no interface detail.v1.6.0
0700
New security skill coverage across domainsnew50how completely this was documenteddepth15/40specificity25/30actionability10/3050 / 100
Adds OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against.LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Top 10 2026 skill coverage, an Azure and Entra security skill, an argument injection security skill, ecosystem supply-chain security skills, Hurl and Hypothesis security playbooks, and semantic browser and Electron security skills.
— Names six skill areas but no mechanism given.v1.6.0
0800
Faster startup and scan launchimproved40how completely this was documenteddepth20/40specificity15/30actionability5/3040 / 100
Bootstraps Caido concurrently with scan start to reduce scan startup latency, and moves heavy imports off the startup path, pre-warming them in the background to reduce CLI startup time.
— Describes two startup optimizations without measurable numbers.v1.6.0
0900
CSV injection hardening in report outputimproved35how completely this was documenteddepth15/40specificity15/30actionability5/3035 / 100
Hardens CSV injection in report output.
— Brief security fix note, no mechanism given.v1.6.0
1000
Coverage as first-class artifact with evidence disciplineimproved30how completely this was documenteddepth15/40specificity10/30actionability5/3030 / 100
Promotes coverage as a first-class artifact with evidence discipline in the agent layer.
Nmap - the Network Mapper. Github mirror of official SVN repository.
Nmap NSE gets a 400 MB memory cap and a 5-second execution watchdog that kills non-yielding threads.
Enforces a 400 MB memory limit on the Nmap Scripting Engine (NSE) Lua runtime to bound per-scan resource consumption.
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!NSE scripts that legitimately run without yielding for more than 5 seconds will now be forcibly terminated, potentially breaking long-running scripts that do not yield control.
Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.
cve-lite-cli's sole release window feature is an EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. Priority Signal that fuses CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. severity with FIRST.orgFIRST.orgA global forum of incident response and security teams that sets shared standards and best practices; cyber tools cite membership or its frameworks (like CVSS) to signal coordinated vulnerability handling. exploitation-likelihood data into four actionable tiers across JSON, terminal, and HTML outputs.
└──▷ WHAT SHIPPED ·
1 FEATURE1 OF 1 FEATUREmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0101
EPSS Priority Signal across JSON, terminal, and HTML outputnew91how completely this was documenteddepth35/40specificity28/30actionability28/3091 / 100
Adds an EPSS Priority Signal tier system combining CVSS severity with FIRST.org EPSS exploitation-likelihood percentile into four tiers: fix_now (high impact + top 10% EPSS), fix_soon (high impact), monitor (lower severity + top 10% EPSS), and low_priority (all else). JSON output gains epssScores and prioritySignal fields, set to null when no CVE alias resolves against the FIRST.org API; the signal appears as a new column in the verbose terminal table (--verbose) with an inline ⚡ Fix Now flag in compact mode, and as a column plus interactive four-tier legend in HTML reports (--report).
Triage a project by exploitation likelihood in CI — pipe JSON output and filter for packages the model rates as needing immediate action.
Join the world's most widely adopted, AI-powered developer platform where millions of developers, businesses, and the largest open source community build software that advances humanity.
GitHub's biggest ships this window are file attachments landing in the CLI, Copilot code review gaining the power to formally approve pull requests, and GA launches for Enterprise Live Migrations and the Claude Fable 5.1 model.
└──▷ WHAT SHIPPED ·
6 FEATURES1 OF 6 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
File attachments via `--attach` in GitHub CLInew95how completely this was documenteddepth35/40specificity30/30actionability30/3095 / 100
Adds a repeatable --attach flag to gh issue create, gh issue edit, gh issue comment, gh pr create, gh pr edit, and gh pr comment, uploading a local file and embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. it inline in the Markdown body. Supports PNG, JPEG, GIF, WebP, SVG, MP4, MOV, and WebM formats, with size limits of 10 MB for images/GIFs, 10 MB for video on Free plans, and 100 MB for video on paid plans. Inline alt text can be set via # syntax, e.g. --attach './login.png#The login error state' (falls back to filename if omitted); local image paths already referenced in the Markdown body are rewritten to the uploaded asset URL with alt text preserved, and unreferenced attachments are appended at the end.
File a bug report with a screenshot attached in one command so the issue shows the actual problem immediately.
$ gh issue create --title 'Login button misaligned on mobile' --body 'See screenshot for the rendering issue.' --attach './screenshot.png#Login button misaligned'
Open a PR with before/after video clips so reviewers see the visual change without pulling the branch.
$ gh pr create --title 'Smooth out modal animation' --body 'Before and after recordings attached.' --attach './before.mp4#Before' --attach './after.mp4#After'
Add a clarifying screenshot to an existing issue comment when a text description alone is ambiguous.
$ gh issue comment 42 --body 'Reproduced on v2.99.0 — error visible here:' --attach './error.png#Error on screen'
Enterprise Live Migrations GA via `gh elm`new90how completely this was documenteddepth35/40specificity30/30actionability25/3090 / 100
Enterprise Live Migrations (ELM) is now generally available as a GHES-appliance service for near-zero-downtime repository migration to GitHub Enterprise Cloud with Data Residency (GHEC DR), supporting GHES versions 3.17.18+, 3.18.12+, 3.19.9+, 3.20.3+, 3.21.3+, and 3.22.0+. The gh elm GitHub CLI extension manages the full lifecycle — creating migrations, monitoring sync progress (with --json output for scripting), and initiating cutover — against the GHES REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., with resource-level progress tracking that surfaces failures before cutover. ELM can run concurrently with GitHub Enterprise Importer (GEI), letting teams pick the right tool per repository.
Expiration dates for individual user budgetsnew90how completely this was documenteddepth30/40specificity30/30actionability30/3090 / 100
The Budgets REST API adds an expires_at field when creating or updating an individual user budget, supporting no expiration (default), start of next billing cycle, or a specific date; the same options are exposed in the billing settings UI and can be changed or cleared at any time. Expired budgets are automatically removed on their expiration date, falling the user back to their cost center per-user budget or the universal budget. Available on Copilot Business and Copilot Enterprise plans.
Create a new individual user budget with an expiration at the start of the next billing cycle directly from billing settings.
📍1. Go to your enterprise Billing settings › Budgets.
2. Click Create budget or select an existing individual user budget to edit.
3. Under Expiration, choose 'Expiration at the start of the next billing cycle'.
4. Save the budget — GitHub will automatically remove it on that date.
Claude Fable 5.1 model in Copilotbreaking90how completely this was documenteddepth35/40specificity30/30actionability25/3090 / 100
Claude Fable 5.1 joins the Copilot model picker across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot coding agent, github.com, GitHub Mobile, JetBrains IDEs, Xcode, and Eclipse, available to Copilot Pro+, Max, Business, and Enterprise plans. Enterprise/Business admins enable it via the Claude Fable 5.1 policy in Copilot settings (off by default), and eligible enterprise customers can get zero data retention for Claude Fable 5.1 and Claude Fable 5 through a time-bound exemption while Anthropic rolls out Enterprise Frontier Safeguards. Unlike every other Claude model in Copilot, which runs under zero data retention (ZDR) by default, Claude Fable 5.1 and Claude Fable 5 retain prompts and outputs by default to operate safety classifiers, and enabling the policy constitutes acknowledgment of this requirement.
Enable Claude Fable 5.1 for your organization as a Copilot Enterprise or Business admin so team members can select it in the model picker.
📍In GitHub Copilot settings for your organization, navigate to Policies, locate the Claude Fable 5.1 policy, and toggle it on. Note: enabling constitutes acknowledgment of Anthropic's data retention requirement for Mythos-class models.
Copilot code review can approve pull requestsnew85how completely this was documenteddepth35/40specificity25/30actionability25/3085 / 100
Every Copilot code review now includes an approval assessment in its overview comment signaling whether Copilot considers the PR ready to approve (this alone doesn't count toward merge requirements). When enabled by an admin (off by default, configurable at enterprise, organization, and repository level, including per-file-path controls at the repo level), Copilot can submit a formal approval that counts toward a repository's required-approvals rule; the approval is automatically dismissed when new commits are pushed, matching human-reviewer behavior.
Enable Copilot approvals for specific repositories in your organization so Copilot-issued approvals count toward required-reviewer rules.
📍In your organization settings, go to Copilot › Code review › Approvals, set the policy to Enable for specific repositories, and select the target repositories. At the repository level, go to Settings › Copilot › Code review › Approvals, turn approvals on, and optionally restrict which file paths Copilot is allowed to approve.
Block users from discussion commentsnew55how completely this was documenteddepth20/40specificity15/30actionability20/3055 / 100
Adds in-context block/unblock controls to discussion comments in personal repositories, matching controls already available on issue and pull request comments, accessible via the More menu on any comment with an optional private note.
Block a disruptive commenter without leaving the discussion thread in your personal repository.
📍In a discussion comment on your personal repository, open the More menu (…) on the comment › select Block user › optionally enter a private note explaining the reason › confirm your selection.
Claude Fable 5.1 (and Claude Fable 5) require data retention by default — prompts and outputs are retained by Anthropic to operate safety classifiers — unlike all other Claude models in Copilot, which continue to operate under zero data retention (ZDR).
The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!
AFL++ v5.03c's headline additions are Value Profile-guided mutation, four new LLVM instrumentation tuning env vars, and a starved-mode fuzzing state with automatic queue minimization, alongside a breaking switch to POSIX shared memoryPOSIX shared memoryA POSIX-standard IPC mechanism letting two or more processes map the same named memory region into their address spaces, giving cyber tools a fast, zero-copy channel for passing large data between components. on macOS and removal of classic AFL instrumentation and the afl-as wrapper.
└──▷ WHAT SHIPPED ·
12 FEATURES2 OF 12 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
New LLVM instrumentation coverage tuning optionsnew87how completely this was documenteddepth32/40specificity30/30actionability25/3087 / 100
Adds four env vars to tune LLVM instrumentation density and sensitivity: AFL_LLVM_DENSE=1 disables PCGUARD basic block pruning for denser coverage maps; AFL_LLVM_MINMAX=1 scores min/max/abs intrinsics (branchless clamps), adding ~10% map entries at a ~20% throughput cost, default off; AFL_LLVM_FUSED=1 scores both halves of fused conditions (e.g. if (a && b) compiled to a single and i1); AFL_LLVM_VECTORS=1 instruments vector selects and vector min/max with one guard pair per lane, default off.
Score branchless min/max/abs clamps and fused conditions for deeper coverage of optimizer-transformed code, accepting the throughput trade-off.
— Names all four env vars with exact behaviour and cost trade-offs.v5.03c
0200
Value Profile fuzzing modenew86how completely this was documenteddepth30/40specificity28/30actionability28/3086 / 100
Adds AFL_LLVM_VALUE_PROFILE=1 to enable Value Profile instrumentation in fuzz targets, paired with a new afl-fuzz flag -r <seconds> that activates value-profile-guided mutation after a delay, letting a baseline fuzzing period run before switching to value-profile-informed mutation.
Enable Value Profile instrumentation to capture comparison operand diversity, then activate it in afl-fuzz after 30 seconds of baseline fuzzing.
— Names exact env var and paired flag with a runnable example.v5.03c
0301
POSIX shared memory on macOSbreaking81how completely this was documenteddepth35/40specificity28/30actionability18/3081 / 100
macOS builds now use POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. shared memory instead of SysV, removing the kern.sysv.shmseg / kern.sysv.shmmax ceiling constraints — CmpLog alone requires a 145 MB segment, far above the 4 MB macOS default. Targets built with an older afl-cc still expect a SysV id in __AFL_SHM_ID and must be recompiled with the new compiler to work.
— Explains mechanism, concrete limits, and migration requirement.v5.03c
0400
Starved mode with automatic queue minimizationnew79how completely this was documenteddepth32/40specificity25/30actionability22/3079 / 100
afl-fuzz now implements a starved mode: when no new finds occur for an extended period, seed and mutation variability increases automatically (including the splicing phase), visible in the UI. The new AFL_STARVED_MINIMIZE_QUEUE env var makes starved mode minimize the queue (like afl-cmin) when it fails to find new coverage, and removed entries' coverage becomes rediscoverable.
When a long-running campaign stalls, trigger queue minimization automatically so stale entries are pruned and their coverage becomes rediscoverable.
— Describes trigger, mechanism and named env var with example.v5.03c
0500
Symlink and foreign sync directory handlingimproved65how completely this was documenteddepth25/40specificity25/30actionability15/3065 / 100
afl-fuzz-i input directory and afl-showmap-i now follow symlinked test cases and symlinked subdirectories; foreign sync directories (-F) also import symlinked test cases. Unreadable foreign sync (-F) directories are now reported once per directory and listed at startup, replacing silent failure.
— Names affected flags and behaviour but no example command.v5.03c
0600
afl-cmin default implementation switchimproved62how completely this was documenteddepth25/40specificity22/30actionability15/3062 / 100
Switches afl-cmin.c to be the default afl-cmin implementation; -T all on both the C and Python variants now counts CPUsCPUsThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. the process is actually allowed to run on, rather than all system CPUs.
— Explains the CPU-counting behaviour change but gives no example.v5.03c
0700
Trimming stage saves crashes and hangsimproved62how completely this was documenteddepth25/40specificity22/30actionability15/3062 / 100
The afl-fuzz trimming stage now saves crashes, hangs, and new coverage discovered while shortening inputs, visible as op:trim / op:ptrim in output file names.
— Names exact output markers for the behaviour change.v5.03c
thinner coverage below
0802
Removal of legacy AFL instrumentation and afl-asbreaking59how completely this was documenteddepth22/40specificity22/30actionability15/3059 / 100
Removes classic AFL instrumentation (colliding coverage) from afl-cc, superseded by AFL_LLVM_PATH and AFL_LLVM_CALLER; also removes the obsolete afl-as assembler wrapper.
— Names removed components and their replacement, no migration steps.v5.03c
0900
SIGUSR2 forces immediate syncnew55how completely this was documenteddepth20/40specificity20/30actionability15/3055 / 100
afl-fuzz now handles SIGUSR2 to force an immediate sync (both AFL's internal sync and foreign -F sync directories) once the current queue entry finishes processing.
— Names signal and behaviour but gives no usage example.v5.03c
1000
afl-merge corpus merging toolnew45how completely this was documenteddepth15/40specificity15/30actionability15/3045 / 100
Adds afl-merge as a symlink tool to merge new files into an existing (non-minimized) corpus.
— Names tool and purpose but no usage example.v5.03c
1100
AFL_DUMP_MAP_SIZE diagnostic env varnew37how completely this was documenteddepth10/40specificity15/30actionability12/3037 / 100
Adds AFL_DUMP_MAP_SIZE to print the coverage/IJON breakdown to stderr.
— Bare description of a single env var, no example.v5.03c
1200
Exec-count-based mode switchingimproved30how completely this was documenteddepth12/40specificity10/30actionability8/3030 / 100
Mode-switching limits in afl-fuzz are now based on execution counts rather than elapsed time.
— States the change with no further mechanism detail.v5.03c
└──▷ BREAKING ON UPGRADE
!
macOS targets must be recompiled with the new afl-cc: a target built by an older afl-cc still expects a SysV id in __AFL_SHM_ID and will not work with the new POSIX shared memory.
!
Classic AFL instrumentation (colliding coverage) has been removed from afl-cc; projects relying on it must switch to AFL_LLVM_PATH or AFL_LLVM_CALLER.
!
The obsolete afl-as assembler wrapper has been removed.
JFrog expanded AppTrust with auto-assembled, signed release-evidence chains and out-of-the-box NIST SSDFNIST SSDFA NIST framework of secure software development practices, organized into four groups, that gives teams a common vocabulary and baseline for reducing vulnerabilities introduced during the development lifecycle. / EU CRAEU CRAEU Cyber Resilience Act, a European Union regulation requiring manufacturers and publishers of products with digital elements to meet mandatory cybersecurity standards before selling into the EU market. compliance frameworks, while JFrog AI Catalog grew into a fuller AI control plane with governed registries for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, skills and plugins, Agent Packages, semantic scanning, Shadow AI Detection, and runtime policy enforcement via Agent Guard.
JFrog software supply chain solutions provide an end-to-end pipeline to control your binaries from build to production. Power your software updates to the edge.
JFrog expanded AppTrust with auto-assembled, signed release-evidence chains and out-of-the-box NIST SSDFNIST SSDFA NIST framework of secure software development practices, organized into four groups, that gives teams a common vocabulary and baseline for reducing vulnerabilities introduced during the development lifecycle. / EU CRAEU CRAEU Cyber Resilience Act, a European Union regulation requiring manufacturers and publishers of products with digital elements to meet mandatory cybersecurity standards before selling into the EU market. compliance frameworks, while JFrog AI Catalog grew into a fuller AI control plane with governed registries for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, skills and plugins, Agent Packages, semantic scanning, Shadow AI Detection, and runtime policy enforcement via Agent Guard.
└──▷ WHAT SHIPPED ·
8 FEATURES7 OF 8 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0101
Agent Guard runtime policy enforcementnew75how completely this was documenteddepth30/40specificity25/30actionability20/3075 / 100
Agent Guard, installed via the official JFrog agent plugin, enforces organizational policy at runtime by checking every MCP tool call and skill call against defined policies, regardless of agent harnessagent harnessThe software around an AI agent that manages its tools, execution loop, state and limits. It determines how the model's proposed actions are run and checked. or coding environment. Setup: install the JFrog agent plugin under AI Catalog > Agent Plugins, configure the MCP Registry's allowed servers and restricted tool calls per project, then enable Agent Guard in plugin settings.
Enforce that a coding agent in Cursor or Claude Code can only install MCP servers, skills, and plugins that have passed your organization's security checks via Agent Guard at runtime.
📍Steps:
1. In the JFrog platform, go to AI Catalog › Agent Plugins and install the JFrog agent plugin for your coding environment (Cursor, Claude Code, VS Code, OpenCode, or Codex).
2. Configure your MCP Registry: define the allowed MCP servers per project and specify any restricted tool calls.
3. Enable Agent Guard within the plugin settings to activate runtime policy enforcement for MCP tool calls and skill calls.
AppTrust Prompt-to-Release Traceabilitynew70how completely this was documenteddepth35/40specificity25/30actionability10/3070 / 100
AppTrust now auto-assembles a signed audit evidence chain — commits, PRs, Jira ticket transitions, and approver records — and attaches it to the application version before any promotion gate runs. It validates full Jira ticket transition history (creation → in-progress → done, with dates) rather than just checking ticket existence, and detects self-approval violations by mapping each PR's merger and approver back to the committer. Incoming JFrog Agent Plugins will capture AI agent session evidence (prompts, code produced, and a full session bill of materialsbill of materialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. including which MCPs, skills, and agentic assets were used) as signed evidence stored in Artifactory. Git-based evidence is generally available now; agent session evidence and the session bill of materials are planned for later this year.
Out-of-the-Box Compliance Frameworks in AppTrustnew70how completely this was documenteddepth35/40specificity25/30actionability10/3070 / 100
Launches with NIST SSDF and the EU Cyber Resilience Act pre-mapped to Policy-as-CodePolicy-as-CodeThe practice of expressing governance rules, access controls, or compliance requirements as machine-readable code so they can be versioned, tested, and automatically enforced rather than managed through manual processes. rules, requiring no Rego to write and no manual control mapping. A compliance catalog inside AppTrust lets AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. teams pick a framework and see every control translated into plain requirements linked to specific Policy-as-Code rules enforced at release gates, with uncovered controls flagged and satisfied controls shown as covered by default. Full SDLCSDLCThe Software Development Life Cycle: a structured process covering planning, design, coding, testing, and deployment. Cyber tools integrate into it to catch vulnerabilities before code ships rather than after. traceability (agent intent sessions, Git commits, PRs, Jira tickets) feeds live data to these rules. Framework configuration is split from rollout control: AppSec owns which controls/rules are active, while development managers control application scope, whether rules run as warnings or hard failures, and the warning-to-block conversion window. Available now as part of the Ultimate Security Bundle.
MCP, Agent Skills, and Agent Plugins Registries in AI Catalognew70how completely this was documenteddepth30/40specificity30/30actionability10/3070 / 100
Adds an MCP Registry to define which MCP servers are allowed per project, restrict specific tool calls, and scan local MCP packages before an agent can use them; an Agent Skills Registry to curate, sign, verify, and scan packaged agent behaviors before execution; and an Agent Plugins Registry to control, sign, verify, and scan plugin bundles agents install. Models, MCP servers, skills, plugins, and agent packages are all stored as versioned, traceable artifacts in Artifactory under a single RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. model and audit trail.
Shadow AI Detection in AI Catalognew65how completely this was documenteddepth25/40specificity20/30actionability20/3065 / 100
Automatically detects and categorizes every AI asset across an environment as managed, unmanaged, partially managed, or malicious, via AI Catalog > Shadow AI Detection; unvetted assets can then be promoted into the appropriate governed registry (MCP Registry, Agent Skills Registry, or Agent Plugins Registry).
Detect unvetted AI assets sprawling across your environment before they reach an agent, by reviewing Shadow AI Detection results categorized as managed, unmanaged, partially managed, or malicious.
📍Steps:
1. In the JFrog platform, navigate to AI Catalog › Shadow AI Detection.
2. Review the categorized inventory of AI assets across your environment (managed, unmanaged, partially managed, malicious).
3. Promote assets you wish to approve into the appropriate governed registry (MCP Registry, Agent Skills Registry, or Agent Plugins Registry).
AI Coding Agent Plugins for Claude Code, Cursor, VS Code, OpenCode, and Codexnew60how completely this was documenteddepth20/40specificity25/30actionability15/3060 / 100
The AI Coding Agent Plugin now supports Claude Code, Cursor, VS Code, and OpenCode as agents, and JFrog released official agent plugins for Claude Code, Cursor, VS Code, OpenCode, and Codex, installed via AI Catalog > Agent Plugins, to bring organizational policy control directly into the coding agent environment.
Agent Packages support (APM standard)new45how completely this was documenteddepth20/40specificity20/30actionability5/3045 / 100
Adds Agent Packages support to ship an agent's entire context and dependency tree as a single versioned, resolvable package compliant with the open-source APMAPMApplication Performance Monitoring — a category of software that collects metrics, traces, and logs from running applications so developers can detect slowdowns and diagnose their root cause. (Agent Package Manager) standard.
Semantic scanning of AI assetsnew40how completely this was documenteddepth25/40specificity15/30actionability0/3040 / 100
Introduces semantic scans that analyze what an asset instructs an agent to do, rather than matching against known-bad hashes, in order to catch novel malicious skills and MCP servers.
Snyk shipped Repo Content Sync, now generally available for Enterprise plans, which automatically keeps Projects in sync with manifest, Dockerfile, and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. files as they're added, moved, or removed from monitored branches.
The official changelog for the Snyk AI Trust Platform. Discover what's new in our security intelligence, AI-powered tools, and latest product enhancements.
Snyk shipped Repo Content Sync, now generally available for Enterprise plans, which automatically keeps Projects in sync with manifest, Dockerfile, and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. files as they're added, moved, or removed from monitored branches.
└──▷ WHAT SHIPPED ·
1 FEATURE1 OF 1 FEATUREmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0101
Repo Content Sync for automatic Project managementnew74how completely this was documenteddepth30/40specificity24/30actionability20/3074 / 100
Repo Content Sync (GA for Enterprise plans) automatically creates Projects for newly merged manifest, Dockerfile, and IaC configuration files, and deactivates Projects whose files are removed or renamed, eliminating manual re-import. It is on by default for Enterprise organizations with no configuration required; organizations already opted in via Snyk Preview retain their existing setting. To permanently suppress a deleted Project from being recreated when its source file still exists, open the Project, click Delete, and select 'exclude it from future scans' in the delete dialog before confirming.
Permanently suppress a deleted Project from being recreated by sync when its source file still exists in the repo.
📍In the Snyk UI, open the Project you want to remove, click Delete, and in the delete dialog select the option 'exclude it from future scans' before confirming.
— Names mechanism, default behavior, and exact UI steps to opt out.2026-08-31-baf195e9
Snyk Code is a developer security tool that scans source code to identify and fix vulnerabilities, open source issues, and code quality problems.
Snyk Code's repo content sync now covers all Snyk project types and works beyond default branches.
└──▷ WHAT SHIPPED ·
1 FEATURE0 OF 1 FEATUREmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Expanded repo content sync coverageimproved50how completely this was documenteddepth22/40specificity20/30actionability8/3050 / 100
Repo content sync now covers Code, open source, secrets, infrastructure as code, and container (Dockerfile) Projects — not just a subset of project types — and works on custom branches in addition to default branches.
— Names project types and branch scope but no config or command shown.2026-08-31-b80221ae
Snyk Open Source scans open-source dependencies for known vulnerabilities and license issues, helping developers find and fix risks in their software supply chain.
Snyk Open Source's repo content sync now extends coverage across all project types and to custom branches, not just default branches.
└──▷ WHAT SHIPPED ·
1 FEATURE0 OF 1 FEATUREmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Expanded repo content sync coverageimproved48how completely this was documenteddepth20/40specificity18/30actionability10/3048 / 100
Repo content sync now covers Code, open source, secrets, infrastructure as code, and container (Dockerfile) project types — not just a subset — and now works on custom branches in addition to default branches.
— Names project types and branch scope but no config/API detail.2026-08-31-b80221ae
Infisical is the open-source platform for secrets, certificates, and privileged access management.
Infisical's v0.165.1 release focuses on PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. expansion (GCP Certificate Manager sync, agent renewal tracking, pre-fetch commands), tighter access control (folder RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., ABACABACAttribute-based access control, where rules evaluate facts about the user, resource and request. Access can depend on conditions such as department, data sensitivity or device status.trim suffix, Kubernetes MI auth), and several smaller usability and provider tweaks across secret management and PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded..
└──▷ WHAT SHIPPED ·
13 FEATURES0 OF 13 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
GCP Certificate Manager Sync for PKInew60how completely this was documenteddepth25/40specificity20/30actionability15/3060 / 100
Certificates managed in Infisical's PKI can now be synced to Google Cloud Certificate Manager, letting teams keep GCP-hosted certificate resources in step with Infisical as the source of truth.
— Names target integration but no config steps givenv0.165.1
0200
`trim suffix` function in ABAC policiesnew60how completely this was documenteddepth15/40specificity25/30actionability20/3060 / 100
Adds a trim suffix function usable within attribute-based access controlattribute-based access controlAttribute-based access control, where rules evaluate facts about the user, resource and request. Access can depend on conditions such as department, data sensitivity or device status. (ABAC) policy expressions.
— Named function directly usable in policy expressionsv0.165.1
thinner coverage below
0300
Folder-level RBACnew50how completely this was documenteddepth20/40specificity15/30actionability15/3050 / 100
Role-based access controlRole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. can now be scoped at the folder level within projects, rather than only at the project level.
Port configuration for Splunk dynamic secretsimproved50how completely this was documenteddepth15/40specificity20/30actionability15/3050 / 100
Adds port number configuration to the Splunk dynamic secrets provider.
— Names provider and setting but no field name shownv0.165.1
0700
Certificate renewal visibility in PKI agentnew45how completely this was documenteddepth20/40specificity15/30actionability10/3045 / 100
The PKI agent now exposes the latest renewal of a certificate so agents can detect and follow certificate renewals.
— Explains behavior but no API/field name givenv0.165.1
0800
Default interactive shell for PAM SSH accessimproved40how completely this was documenteddepth15/40specificity15/30actionability10/3040 / 100
SSH access in Privileged Access ManagementPrivileged Access ManagementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. (PAM) now defaults to an interactive shell.
— Clear default change, no config override mentionedv0.165.1
0900
Pre-fetch commands for PKI sync agentsnew35how completely this was documenteddepth10/40specificity15/30actionability10/3035 / 100
Adds pre-fetch commands for PKI sync agents on Windows and Linux platforms.
— Bare mention, no command syntax or use casev0.165.1
1000
Project-level secret retention limitsnew35how completely this was documenteddepth15/40specificity10/30actionability10/3035 / 100
Adds the ability to set secret retention limits at the project level.
— No limit values or config path specifiedv0.165.1
1100
Revamped replicate secrets workflowimproved35how completely this was documenteddepth15/40specificity10/30actionability10/3035 / 100
The replicate secrets workflow in the secret manager UI has been revamped.
— No specifics on what changed in the workflowv0.165.1
1200
Select-all for Vault import secret path pickerimproved30how completely this was documenteddepth10/40specificity10/30actionability10/3030 / 100
Adds a select all option for the Vault import secret path Combobox in the UI.
MVT adds a plugin system for extending forensic analysis, a unified mvt CLI with shell completion, and substantially deeper Android bugreport and ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control. forensics.
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
MVT adds a plugin system for extending forensic analysis, a unified mvt CLI with shell completion, and substantially deeper Android bugreport and ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control. forensics.
└──▷ WHAT SHIPPED ·
10 FEATURES1 OF 10 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Shell completion via `mvt completion`new90how completely this was documenteddepth30/40specificity30/30actionability30/3090 / 100
Adds mvt completion to generate shell completion scripts for Bash, Zsh, and Fish across mvt, mvt-ios, and mvt-android; pass the shell name (e.g. mvt completion bash) to emit the script directly, and --install to write it.
Generate and install shell completion for Bash so all three MVT commands are tab-completable in your daily workflow.
$ mvt completion bash --install
View command output v2026.9.1
● actually ran
exit 0
·
772ms
· 14affed5acbf
mvt
$ mvt completion bash --installInstalled bash completion for mvt, mvt-ios and mvt-android to /home/ctk/.mvt-complete.bash
Updated ~/.bashrc
— Exact runnable command with flags givenv2026.9.1
0201
Plugin system for custom modules and commandsnew88how completely this was documenteddepth35/40specificity28/30actionability25/3088 / 100
Adds a plugin system: third-party packages can register forensic modules and top-level CLI commands via Python entry points, and custom modules can replace built-in MVT modules. mvt plugins lists installed plugins and checks for updates, and mvt.plugin is now a public Python import surface for writing plugin packages.
Check what plugins are installed and whether any have updates available, before running an analysis.
$ mvt plugins
— Names the command and import surface with runnable examplev2026.9.1
0300
Expanded Android bugreport parsingimproved80how completely this was documenteddepth35/40specificity30/30actionability15/3080 / 100
Preserves Android tombstone abort messages and protobuf causes lists in both text-parsed and protobuf-parsed output; parses package installer attribution, process tables, system settings, and mountinfo from bugreports; and adds parsing of system package flags, accessibility service states per user, ADB binary XML keys, AppOps UID and event details, battery history events, database operation details, multi-user package details, platform compatibility overrides, and multiline Android properties.
— Enumerates every new bugreport data type parsedv2026.9.1
0400
ADB trusted key alerting in AndroidQFnew78how completely this was documenteddepth35/40specificity28/30actionability15/3078 / 100
Alerts on unexpected trusted ADB keys in AndroidQF acquisitions: raises LOW-severity alerts for malformed keys, keys from a different host, and trusted keys when no acquisition host key is present, plus an informational alert when the acquisition host key was last connected more than one day before collection.
— Detailed alert conditions but no command to trigger checkv2026.9.1
0500
Top-level `mvt` commandnew70how completely this was documenteddepth25/40specificity25/30actionability20/3070 / 100
Adds a platform-neutral mvt command hosting version, completion, plugins, and download-iocs subcommands; running mvt alone shows the installed version, update notices, and available commands.
— Names subcommands but no full usage walkthroughv2026.9.1
thinner coverage below
0600
Encrypted backup.ab handling in AndroidQFimproved55how completely this was documenteddepth25/40specificity20/30actionability10/3055 / 100
AndroidQF runs no longer abort when encountering an encrypted backup.ab; the encrypted backup is skipped and analysis continues.
— Names the file and behavior change, no further stepsv2026.9.1
0700
Modules skip on missing dependenciesimproved35how completely this was documenteddepth15/40specificity10/30actionability10/3035 / 100
Modules with unavailable dependencies are now skipped instead of aborting the entire run.
— Behavior described but no mechanism or affected module listv2026.9.1
0800
WhatsApp contacts forensic modulenew35how completely this was documenteddepth10/40specificity15/30actionability10/3035 / 100
Adds a WhatsApp contacts forensic module.
— Bare mention, no detail on what it extractsv2026.9.1
0900
ARM64 Docker imagesnew35how completely this was documenteddepth10/40specificity15/30actionability10/3035 / 100
Builds and publishes Docker images for ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead..
— Bare announcement with no pull instructionsv2026.9.1
1000
Timezone provenance on file timestampsimproved25how completely this was documenteddepth10/40specificity10/30actionability5/3025 / 100
Adds timezone provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. to file timestamps in analysis output.
— Very brief, no example of output changev2026.9.1
Fastly is a content delivery network and edge computing platform that accelerates website and application performance globally.
Fastly shipped two new platform capabilities—schema-based API request validation and on-platform log storage/monitoring—plus a new client-disconnect metric across its analytics APIs.
└──▷ WHAT SHIPPED ·
3 FEATURES2 OF 3 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
status_499 metric for client disconnectsnew75how completely this was documenteddepth25/40specificity30/30actionability20/3075 / 100
Adds a status_499 metric to the Historical Stats API, Real-Time Analytics API, Domain Inspector Historical API, and Domain Inspector Real-Time API to surface client disconnects from Varnish services.
API Enforcement for schema-based request validationnew40how completely this was documenteddepth20/40specificity10/30actionability10/3040 / 100
A new API Enforcement feature validates incoming API requests against user-defined schemas, and can be configured to either log or block requests that don't conform to the schema.
— Describes behavior but no config keys or endpoints namedproduct docs
0302
Log Explorer & Insights for on-platform loggingnew40how completely this was documenteddepth20/40specificity10/30actionability10/3040 / 100
A new Log Explorer & Insights feature enables proactive storage, inspection, and monitoring of log data directly on the Fastly Platform, without needing to ship logs to a third-party system.
— Explains purpose but lacks specific UI paths or API detailsproduct docs
Sophos Email Security is a cloud-based email protection solution that detects and blocks malware, phishing, spam, and advanced threats.
Sophos Email Security added recipient notifications for Data Control rule actions and automatic Intelix-based release of cleared quarantined emails.
└──▷ WHAT SHIPPED ·
2 FEATURES0 OF 2 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Automatic Intelix-based quarantine releasenew65how completely this was documenteddepth25/40specificity20/30actionability20/3065 / 100
Automatically releases quarantined emails when an Intelix scan determines the email is not malicious or suspicious, reducing manual triage of held mail. Enabled via Scan attachments with Intelix automatic release option in an Email Security > Policies > Data Control rule set to Quarantine.
Configure automatic quarantine release so emails cleared by Intelix are freed without manual intervention — reducing analyst queue depth for low-risk holds.
📍In the Sophos Central console, go to Email Security › Policies › Data Control, open or create a rule, set the action to Quarantine, then under Scan attachments with Intelix enable automatic release so emails assessed as not malicious or suspicious are released automatically. Under Notifications, add the recipient addresses that should be alerted when the rule triggers.
Notification recipients for Data Control rulesnew50how completely this was documenteddepth20/40specificity15/30actionability15/3050 / 100
Enables configuration of notification recipients for Data Control rule actions, so the right people are alerted when a Data Control policy triggers. Configured under Email Security > Policies > Data Control, in a rule's Notifications section.
Configure automatic quarantine release so emails cleared by Intelix are freed without manual intervention — reducing analyst queue depth for low-risk holds.
📍In the Sophos Central console, go to Email Security › Policies › Data Control, open or create a rule, set the action to Quarantine, then under Scan attachments with Intelix enable automatic release so emails assessed as not malicious or suspicious are released automatically. Under Notifications, add the recipient addresses that should be alerted when the rule triggers.
Chainguard provides trusted open source artifacts for every layer of your modern software stack—containers, language libraries, and VM images.
Chainguard's latest changelog introduces open-beta custom container pull policies and enables cross-language build pinning for Chainguard Libraries, alongside a batch of new container images and extended support windows.
└──▷ WHAT SHIPPED ·
1 FEATURE0 OF 1 FEATUREmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Extended support for Istio 1.29 and Teleport 18 imagesimproved58how completely this was documenteddepth18/40specificity28/30actionability12/3058 / 100
Extends the active support window for Istio 1.29 images (istio, istio-cni, istio-envoy, istio-operator, istio-pilot-agent, istio-pilot-discovery, ztunnel) and teleport:18 through 2027-02-28.
Kubescape v4.0.13 adds custom RegoRegoA declarative policy language created by the Open Policy Agent project, used to express authorization and compliance rules as code so cyber tools can evaluate structured data against those rules consistently. rule loading and fully offline image scanning, expands kubescape fix to handle cluster reports and JSON manifests with per-control selection, introduces MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server tools for AI assistants, and ships new RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. privilege-escalation controls alongside VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable., GitLab and Harbor scan-output support.
Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.
Kubescape v4.0.13 adds custom RegoRegoA declarative policy language created by the Open Policy Agent project, used to express authorization and compliance rules as code so cyber tools can evaluate structured data against those rules consistently. rule loading and fully offline image scanning, expands kubescape fix to handle cluster reports and JSON manifests with per-control selection, introduces MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server tools for AI assistants, and ships new RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. privilege-escalation controls alongside VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable., GitLab and Harbor scan-output support.
└──▷ WHAT SHIPPED ·
17 FEATURES0 OF 17 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
kubescape fix control selection and manifest supportimproved93how completely this was documenteddepth35/40specificity28/30actionability30/3093 / 100
kubescape fix gains --include-controls and --skip-controls to choose which controls get remediated, now supports printing patched manifests from cluster scan reports (previously only file-based manifests were supported), and can apply fixes to JSON manifests in addition to YAML.
Auto-remediate only specific controls to limit the blast radius of a fix run.
— Named flags, before/after, and a runnable examplev4.0.13
0200
Fully offline image vulnerability scanningnew80how completely this was documenteddepth25/40specificity25/30actionability30/3080 / 100
Adds --skip-db-update to kubescape scan image so image vulnerability scans can run in fully offline or air-gapped environments without updating the vulnerability database.
Scan a container image for vulnerabilities in an air-gapped environment without updating the vulnerability DB.
— Exact flag, subcommand and a runnable examplev4.0.13
0300
New RBAC privilege-escalation controlsnew78how completely this was documenteddepth30/40specificity28/30actionability20/3078 / 100
New control C-0298 detects RBAC subjects that can attach ephemeral containers to pods. Adds RBAC-police rules covering impersonate, token-mint, escalate, bind, node-proxy, and PV create privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. paths.
— Named control ID and six specific privilege pathsv4.0.13
0400
Custom Rego rules for scansnew70how completely this was documenteddepth25/40specificity20/30actionability25/3070 / 100
Adds a --custom-rules flag to load user-authored Rego rules from the standard rule directory layout during scans, letting users extend Kubescape's built-in control set.
— Names the flag but not the directory layout formatv4.0.13
0500
Offline evaluation of VAP matchConditionsimproved65how completely this was documenteddepth30/40specificity25/30actionability10/3065 / 100
Evaluates VAP matchConditions offline instead of refusing the control, and honors spec.failurePolicy for validation expression errors.
— Names fields and behavior change, no user-facing flagv4.0.13
0600
MCP server tools for AI assistantsnew60how completely this was documenteddepth20/40specificity25/30actionability15/3060 / 100
Adds scan_controls, scan_local_iac_controls, list_frameworks, and list_controls tools to the MCP server, exposing Kubescape scanning and control listing to AI assistant integrations.
— Names all four tools but not invocation detailsv4.0.13
0700
External exposure modeling via Ingress and Gateway APIimproved60how completely this was documenteddepth25/40specificity25/30actionability10/3060 / 100
The exposure engine now models external exposure via Ingress, Gateway API, and Service type, plus spec.externalIPs.
— Names all four exposure surfaces, but detection is automaticv4.0.13
thinner coverage below
0800
MutatingAdmissionPolicy discovery in admission-policy reconcilernew50how completely this was documenteddepth20/40specificity20/30actionability10/3050 / 100
Adds MutatingAdmissionPolicy discovery and impact matching to the admission-policy map reconciler.
— Names the resource and reconciler, no user action shownv4.0.13
0900
kubescape list controls filtering and config displayimproved50how completely this was documenteddepth20/40specificity15/30actionability15/3050 / 100
Adds filter support to kubescape list controls for filtering by framework and search term, and displays the control configuration a scan evaluates against in kubescape list.
— Names subcommand, no exact filter flag givenv4.0.13
1000
Framework coverage transparency reportingimproved50how completely this was documenteddepth25/40specificity15/30actionability10/3050 / 100
Flags frameworks scored 100% purely from irrelevant controls and reports resource kinds that no control examined, improving coverage transparency.
— Explains mechanism, no named flag or report fieldv4.0.13
1100
Format flag for config viewnew45how completely this was documenteddepth15/40specificity15/30actionability15/3045 / 100
Adds a --format / -f flag to kubescape config view to control the output format.
— Flag named but no example or format list givenv4.0.13
1200
Vulnerability adaptors for GitLab and Harbornew45how completely this was documenteddepth15/40specificity20/30actionability10/3045 / 100
Adds native adaptors that convert image scanning output for GitLab and Harbor vulnerability formats.
— Two named integrations, no output format or flag givenv4.0.13
1300
Aggregate summary outputs in kubescape diffimproved45how completely this was documenteddepth15/40specificity15/30actionability15/3045 / 100
Adds aggregate summary outputs to kubescape diff.
— Names subcommand but not the summary formatv4.0.13
1400
VEX status in image scan reportsnew40how completely this was documenteddepth15/40specificity15/30actionability10/3040 / 100
Surfaces VEX (Vulnerability Exploitability eXchangeVulnerability Exploitability eXchangeA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable.) status directly in image scan reports.
— Names VEX but no mechanism or config detailv4.0.13
1500
Audit logging for posture exceptionsnew35how completely this was documenteddepth15/40specificity10/30actionability10/3035 / 100
Adds opt-in audit logging for posture exceptions.
— Opt-in noted but no config key or flag namedv4.0.13
1600
Multi-arch image scanning supportimproved30how completely this was documenteddepth15/40specificity10/30actionability5/3030 / 100
Scans the correct platform for multi-arch container images instead of a single default architecture.
— Generic description, no configuration surfacev4.0.13
1700
URL context in repository scanner errorsimproved15how completely this was documenteddepth10/40specificity5/30actionability0/3015 / 100
Adds URL context to repository scanner error messages for easier diagnosis.
— Minor diagnostic tweak with no actionable detailv4.0.13
Snyk Container scans container images and Kubernetes workloads for vulnerabilities and misconfigurations, helping developers fix and secure them.
Snyk Container now benefits from automatic repository content sync, which keeps Dockerfile-based Projects in step with changes to a repo without manual re-import.
└──▷ WHAT SHIPPED ·
1 FEATURE0 OF 1 FEATUREmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Automatic Project sync for Dockerfile changesnew67how completely this was documenteddepth30/40specificity22/30actionability15/3067 / 100
Snyk automatically creates and begins monitoring new Projects when Dockerfile or configuration files are added to a repository, deactivates Projects whose source files are removed, and tracks moved or renamed files by activating a Project at the new path while deactivating the one at the old path. Sync support covers Code, open source, secrets, infrastructure as code, and container (Dockerfile) Project types, and works on custom branches in addition to default branches.
— Explains mechanism and scope but no config keys or commands given.2026-08-31-338a15d8
Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.
Prowler shipped 25 new checks spanning AWS and seven other providers, two new compliance frameworks (CIS Google Workspace v1.4.0CIS Google Workspace v1.4.0A benchmark published by the Center for Internet Security specifying hardening controls for Google Workspace tenants; cyber tools use it as a rule set to audit configurations against an accepted baseline. and NCSC Cyber Essentials v3.3NCSC Cyber Essentials v3.3A UK government-backed certification scheme, maintained by the NCSC, that defines a baseline of five technical controls organisations must meet to defend against common cyber threats; cyber tools use it as a compliance benchmark.), Slack as an alert destination, and a browser-based Import Findings workflow, alongside SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly.-safe private-registry scanning for its Image provider and several Jira/MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. automation improvements.
└──▷ WHAT SHIPPED ·
15 FEATURES0 OF 15 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Private network allowlist for on-prem registry scanningnew80how completely this was documenteddepth30/40specificity30/30actionability20/3080 / 100
Adds PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS environment variable accepting a comma-separated list of IPs and CIDRs (e.g. 192.168.65.254/32,10.20.0.0/16) so the Image provider can reach on-premises registries while keeping link-local, loopback, and other unlisted private addresses blocked by the SSRF guard. Malformed entries cause a startup failure, and any non-empty allowlist is logged as a relaxed security control for audit purposes.
— Names exact env var and CIDR example but no runnable command.5.41.0
0200
Configurable log group prefixes for AgentCore data protection checknew80how completely this was documenteddepth20/40specificity30/30actionability30/3080 / 100
Adds agentcore_log_group_name_prefixes key to config.yaml to configure which CloudWatch log group prefixes the cloudwatch_log_group_agentcore_data_protection_policy_enabled check evaluates.
Scope the AgentCore log-group data-protection check to your organization's specific log group prefixes.
— Config key, file, and runnable YAML example all given.5.41.0
0300
Ten new AWS checks including Bedrock AgentCore and GuardDutynew80how completely this was documenteddepth30/40specificity30/30actionability20/3080 / 100
Adds iam_policy_passrole_to_bedrock_agentcore_restricted (flags PassRole over roles reaching Bedrock AgentCore), iam_policy_no_agentcore_workload_access_token_wildcard (flags overly broad workload access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. grants), cloudwatch_log_group_agentcore_data_protection_policy_enabled (verifies AgentCore log groups mask sensitive data), guardduty_runtime_monitoring_enabled (unified Runtime Monitoring across EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware./ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping./EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves.), guardduty_ai_protection_enabled (AI Protection for Bedrock, AgentCore, SageMaker), ecr_registry_enhanced_scanning_enabled (Inspector-based continuous rescanning), eks_cluster_vpc_cni_network_policy_enforced (VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. CNI network policy enforcement), iam_role_service_trust_restricts_source_to_account (source-account constraint on service trust), elasticbeanstalk_environment_no_secrets_in_configuration (secret scanning in EB config), and memorydb_cluster_in_transit_encryption_enabled (TLS for MemoryDB).
— All ten check IDs and what each flags are named.5.41.0
0400
Fifteen new checks across seven providersnew80how completely this was documenteddepth30/40specificity30/30actionability20/3080 / 100
Adds ecr_repository_image_no_secrets (scans latest ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. image config/filesystem for secrets), bedrock_guardrail_contextual_grounding_filter_enabled, bedrock_custom_model_encrypted_with_cmk, bedrock_knowledge_base_encrypted_with_cmk, bedrock_agent_role_not_shared_across_agents, rolesanywhere_profile_restricts_session_permissions (all AWS); iam_workload_identity_pool_provider_attribute_condition (GCP); organization_default_workflow_permissions_read_only, repository_default_workflow_permissions_read_only, organization_actions_pull_request_approval_disabled (GitHub); defender_domain_dmarc_records_published (M365 Defender, requiring p=quarantine or p=reject); oss_bucket_versioning_enabled, oss_bucket_server_side_encryption_enabled (Alibaba Cloud OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees.); vpc_security_group_open_egress (Huawei Cloud); and ske_cluster_no_public_endpoint (STACKIT SKE, checking ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. and 0.0.0.0/0/::/0 CIDRs).
— All 15 check IDs and providers named with conditions.product docs
0500
Jira finding deep links via DJANGO_UI_BASE_URLnew75how completely this was documenteddepth20/40specificity25/30actionability30/3075 / 100
Adds DJANGO_UI_BASE_URL API environment variable; when set, Jira issues created from findings include a direct link back to the finding filtered by its UID.
Enable finding-to-issue deep links in Jira by pointing the API at your Prowler Cloud UI base URL.
$ DJANGO_UI_BASE_URL=https://cloud.prowler.com
— Named env var with a concrete setting example.5.41.0
0600
Import Findings workflow for OCSF reportsnew75how completely this was documenteddepth30/40specificity25/30actionability20/3075 / 100
Adds a browser-based Import Findings dialog on the Scans page (Prowler Cloud and Private Cloud) accepting .ocsf.json reports via drag-and-drop or file picker, with inline job-completion and error reporting (requires Manage Ingestions permission). Providers whose findings were loaded via this workflow now show an Imported provider indicator in the providers table, distinguishing them from live connected providers.
— UI path and file format named, permission requirement given.5.41.0
0700
NCSC Cyber Essentials v3.3 compliance frameworknew75how completely this was documenteddepth30/40specificity30/30actionability15/3075 / 100
Adds NCSC Cyber EssentialsCyber EssentialsA UK government-backed certification scheme that defines a baseline set of technical controls organizations must implement to defend against common cyber threats, giving cyber tools a compliance benchmark to assess or report against.: Requirements for IT Infrastructure v3.3 (April 2026) as a universal compliance framework with 28 requirements across five control themes — Firewalls, Secure Configuration, Security Update Management, User Access Control, and Malware Protection — of which 16 requirements map to Azure checks and 12 are reported as Manual.
— Precise scope and numbers given, no direct usage step.product docs
0800
Insecure registry scanning via Trivynew70how completely this was documenteddepth20/40specificity25/30actionability25/3070 / 100
Adds --registry-insecure flag propagated to Trivy via TRIVY_INSECURE, enabling pull and scan of images behind self-signed certificates on trusted internal registries.
— Exact flag and env var named, minimal added mechanism.5.41.0
0900
Automation labels on Jira issues from findingsnew70how completely this was documenteddepth20/40specificity30/30actionability20/3070 / 100
Jira issues created from findings now carry labels prowler, prowler-<provider>, prowler-<severity>, prowler-<check-id>, and prowler-finding-<finding-uid> for JQL filtering and automation matching.
— All label formats named but no usage walkthrough.5.41.0
1000
MCP tool execution error reportingimproved70how completely this was documenteddepth25/40specificity30/30actionability15/3070 / 100
MCP server tools now report failures as proper MCP tool execution errors (isError: true) instead of successful responses carrying an {"error": ...} payload; affects prowler_docs_search, prowler_docs_get_document, prowler_hub_get_check_code, prowler_hub_get_check_fixer, and prowler_get_compliance_framework_state_details.
— Exact behavior change and affected tools named, no example call.5.41.0
1100
Image provider registry scanning improvementsimproved65how completely this was documenteddepth30/40specificity25/30actionability10/3065 / 100
Image provider registry scans now enumerate repositories in parallel, skip non-image OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. artifacts (Helm charts, cosign signatures, SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. attestations), and continue scanning remaining images when Trivy fails on a single image. Authentication now falls back to Basic when a registry rejects a bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else., and upgrades to bearer when the server responds with a Bearer challenge to a Basic or anonymous request.
— Clear before/after behavior, but no config surface to act on.5.41.0
1200
Slack as an alert destinationnew65how completely this was documenteddepth25/40specificity20/30actionability20/3065 / 100
Adds Slack as an alert destination: connect a workspace from the Integrations page, authorize destination channels, and select them in the alert modal's Destination channels selector alongside the existing Recipients email selector.
— Exact UI navigation given, no API surface named.product docs
thinner coverage below
1300
CIS Google Workspace Foundations Benchmark v1.4.0new50how completely this was documenteddepth20/40specificity20/30actionability10/3050 / 100
Ships the CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Google Workspace Foundations Benchmark v1.4.0 compliance framework with reworked checks covering Gmail spoofing, 2-Step Verification, password expiration, and alert severity defaults.
— Names framework version and covered areas, no check IDs.5.41.0
1400
Slack connection status shown on integration cardimproved50how completely this was documenteddepth20/40specificity20/30actionability10/3050 / 100
Slack integration connection check now displays its result (including the refused or reached channels) directly on the integration card, not only in a transient toast notification (Prowler Cloud only).
— Describes the change but only a UI display tweak.5.41.0
1500
Thumbs up/down feedback on Lighthouse AI answersnew50how completely this was documenteddepth20/40specificity15/30actionability15/3050 / 100
Adds per-answer thumbs-up/thumbs-down feedback with an optional description field to every Lighthouse AI chat response.
— Simple description, no field name or endpoint given.product docs
Check out our full list of release notes, and stay up to date with what
Automox improved Exclusion Windows with local device time zone scheduling and more precise per-device conflict warnings to reduce false positives.
└──▷ WHAT SHIPPED ·
2 FEATURES0 OF 2 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Local time zone scheduling for Exclusion Windowsnew75how completely this was documenteddepth30/40specificity25/30actionability20/3075 / 100
The Exclusion Window builder now includes a toggle to switch between Local time of device and UTC scheduling, so a window set for 2:00 AM fires at 2:00 AM in each endpoint's own time zone without manual UTC conversion. An interactive time preview in the builder shows the equivalent wall-clock time when toggling between Local and UTC, based on the current browser time zone.
Set a maintenance exclusion window to run at 2:00 AM in each device's local time zone, so globally distributed endpoints all get their local off-hours window without calculating per-region UTC offsets.
📍In the Automox console, go to Manage › Exclusion Windows › New Exclusion Window, set your start time to 2:00 AM, then toggle the time zone selector to Local time of device before saving.
Per-device conflict warnings for Exclusion Windowsimproved45how completely this was documenteddepth20/40specificity15/30actionability10/3045 / 100
Exclusion window warning modals now show per-device conflict counts (e.g., '3 of 12 selected devices are currently in an exclusion window') instead of group-level alerts, eliminating false-positive warnings.
Fleet introduces a configurable throttle for its own automated activities, preventing mass automation triggers from overwhelming hosts, while ensuring user-initiated actions always jump the queue.
Open device management
Fleet introduces a configurable throttle for its own automated activities, preventing mass automation triggers from overwhelming hosts, while ensuring user-initiated actions always jump the queue.
└──▷ WHAT SHIPPED ·
1 FEATURE0 OF 1 FEATUREmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Configurable release rate for Fleet-initiated activitiesnew83how completely this was documenteddepth30/40specificity28/30actionability25/3083 / 100
A new FLEET_ACTIVITY_FLEET_INITIATED_RELEASE_PER_MINUTE environment variable throttles Fleet-initiated activities (policy-automation software installs, scripts, iOS/iPadOS scheduled app updates) to a configurable rate, defaulting to 1000 hosts/minute (0 = unlimited), to spread install-execution and result-ingestion load when automations fire across many hosts simultaneously. User-initiated activities (self-service installs, admin-run scripts, lock/unlock/wipe, setup experience) now take precedence over queued Fleet-initiated activities on the same host.
— Names exact env var, default value, and precedence behaviour.fleet-v4.90.2
CrowdStrike launched SafeMind, an agentic offensive/defensive AI system native to the Falcon platform, built on NVIDIA Nemotron models and CoreWeave infrastructure.
CrowdStrike is a cybersecurity platform providing cloud-based endpoint protection, threat intelligence, and incident response services.
CrowdStrike launched SafeMind, an agentic offensive/defensive AI system native to the Falcon platform, built on NVIDIA Nemotron models and CoreWeave infrastructure.
└──▷ WHAT SHIPPED ·
1 FEATURE1 OF 1 FEATUREmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0101
SafeMind agentic AI system in Falconnew68how completely this was documenteddepth32/40specificity28/30actionability8/3068 / 100
CrowdStrike introduced SafeMind, an agentic system operating natively in the Falcon platform that pairs an offensive model, Red Tempest (trained for advanced attack-scenario emulation on CrowdStrike sensor telemetry, threat intelligence, Falcon Complete MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. event annotations, and fifteen years of incident response data), with a defensive model, Blue Solano (trained on the same dataset to autonomously deploy defensive measures), inside a closed-loop harness that continuously pits them against each other to improve. The harnesses also interoperate with third-party frontier and open-source models for model choice and cost control; SafeMind is built on NVIDIA Nemotron open models, trained and served on CoreWeave's AI Cloud, and will be made available to external parties as standalone models and harnesses through the Project QuiltWorks program. CrowdStrike reports SafeMind achieves a 29% higher detection rate, 6x faster end-to-end remediation, and 99% cost reduction versus leading frontier and open-source model baselines.
— Names models, infra and metrics but no API, flag or config to act on.2026-09-01-898a0e58
Trend Vision One is a unified cybersecurity platform providing threat detection, incident response, and risk management across endpoints, networks, and clouds.
Trend Vision One's Container Security added new scan types and finer-grained policy controls for Runtime Malware Scanning, including image filtering and path exclusions.
└──▷ WHAT SHIPPED ·
3 FEATURES0 OF 3 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Filesystem path exclusions in Container Security policynew65how completely this was documenteddepth28/40specificity25/30actionability12/3065 / 100
The Container Security policy adds configurable filesystem path exclusions for scanning; /proc, /dev, and /sys are excluded by default, and additional paths can be added to fine-tune which paths within scanned images are examined.
Image filter rules in Container Security policynew60how completely this was documenteddepth28/40specificity20/30actionability12/3060 / 100
The Container Security policy gains image filter rules that let you exclude specific images (e.g. trusted third-party operators) from scanning or restrict scanning to only matching images, with per-namespace scoping so the same image can follow different policies in different namespaces.
Scheduled and real-time scan types for Runtime Malware Scanningnew45how completely this was documenteddepth22/40specificity15/30actionability8/3045 / 100
Container Security Runtime Malware Scanning now supports two scan types: scheduled scans, aimed at comprehensive coverage against the latest malware patterns, and real-time scans, aimed at immediate threat detection right after deployment.
Sophos Anti-Virus for macOS is endpoint security software that detects and removes malware, viruses, and threats on Apple computers.
Sophos Anti-Virus for macOS 2026.2.0 adds support for macOS 27 Golden Gate and bumps the threat detection engine to v3.99.0.
└──▷ WHAT SHIPPED ·
2 FEATURES0 OF 2 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Support for macOS 27 Golden Gatenew30how completely this was documenteddepth10/40specificity15/30actionability5/3030 / 100
Sophos Anti-Virus for macOS now supports macOS 27 Golden Gate.
— Names the OS version but no detail on scope or changesVersion 2026.2.0
0200
Threat detection engine updated to v3.99.0improved30how completely this was documenteddepth10/40specificity15/30actionability5/3030 / 100
The threat detection engine has been updated to version 3.99.0.
— Names version number but no detail on what changedVersion 2026.2.0
Yeti 2.11.0 brings configurable model choice and finer session control to the agent chat interface.
└──▷ WHAT SHIPPED ·
2 FEATURES0 OF 2 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Per-message model selection in agent chatnew75how completely this was documenteddepth25/40specificity25/30actionability25/3075 / 100
Agent chat now supports choosing a model per message, with the selection remembered per conversation so each session shows which model answered it. The list of selectable models is configured via GEMINI_MODELS in prod/.env.example (yeti-docker) or agents.geminiModels in the Helm chart.
— Names config keys and behavior but no exact UI steps2.11.0
thinner coverage below
0200
Agent chat session deletionnew35how completely this was documenteddepth15/40specificity10/30actionability10/3035 / 100
Adds the ability to delete agent chat sessions, removing the conversation and its metadata together.
— States what changed but no interface or endpoint detail2.11.0
IntelOwl: manage your Threat Intelligence at scale
IntelOwl v6.8.0 standardizes CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. connectors with a new base class, tightens up chatbot query handling and adds an Ollama keep-alive setting, and improves connector health-check error reporting in the UI.
└──▷ WHAT SHIPPED ·
3 FEATURES0 OF 3 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Chatbot query handling and Ollama keep-aliveimproved80how completely this was documenteddepth30/40specificity25/30actionability25/3080 / 100
The chatbot now defaults analyze_observable to a curated playbook and enforces rejection of placeholder names to prevent accidental stub submissions, hardens jobs-vs-investigations routing, and accepts null filter arguments to broaden valid queries. A new OLLAMA_KEEP_ALIVE environment variable (e.g. OLLAMA_KEEP_ALIVE=30m in .env) keeps the Ollama model loaded in VRAMVRAMMemory attached to a graphics processor. Models, intermediate calculations and caches must fit here or be moved to slower memory. between chatbot requests to avoid cold-start delays.
Keep the Ollama model loaded in VRAM between chatbot requests to avoid cold-start delays in high-frequency analysis workflows.
$ OLLAMA_KEEP_ALIVE=30m
— Names env var, config file and multiple behavior changes.v6.8.0
thinner coverage below
0200
Connector health-check error messagesimproved50how completely this was documenteddepth20/40specificity20/30actionability10/3050 / 100
Connector health-check methods now return a (status, message) tuple, and the UI surfaces the full error message when a health check fails.
— Names return type change but no UI path given.v6.8.0
0300
CTIConnector base class for connectorsnew35how completely this was documenteddepth15/40specificity15/30actionability5/3035 / 100
Introduces a CTIConnector base class to standardize CTI connector implementations and support data-model enrichment across them.
— Names the class but not how connectors use it.v6.8.0
OpenCTI's 7.260901.0 release adds cross-instance workflow status synchronization, built-in Filigran UI themes, and a new vulnerability data module.
└──▷ WHAT SHIPPED ·
3 FEATURES0 OF 3 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Workflow status sync via streamsnew35how completely this was documenteddepth20/40specificity10/30actionability5/3035 / 100
Workflow release status can now be synchronized by name across instances through streams, enabling cross-instance status propagation without manual mapping.
— Names the mechanism (streams) but no config or command given.7.260901.0
0200
Built-in Filigran themesnew25how completely this was documenteddepth15/40specificity5/30actionability5/3025 / 100
OpenCTI now ships built-in Filigran themes, giving teams out-of-the-box branded UI options without needing custom theme configuration.
— Describes benefit but no theme names or settings path given.7.260901.0
0300
Vulnerability module in data modelnew25how completely this was documenteddepth15/40specificity5/30actionability5/3025 / 100
A new vulnerability module has been added to the data model, expanding structured tracking of vulnerability entities.
— States the addition but no fields or schema details given.7.260901.0
Edgescan is a vulnerability management and penetration testing platform that identifies and tracks security risks in applications and infrastructure.
Edgescan's biggest move this window is Atomic, a new end-to-end automated penetration-testing engine that plans its own attacks and steadily expands coverage across injection, IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data., business-logic, path-traversal and authenticated testing while surfacing live visibility into running assessments; alongside it, the core platform gained new EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. filters, per-location-type default scan profiles, TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip.-authenticated DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scanning, and asset/organization management improvements.
└──▷ WHAT SHIPPED ·
22 FEATURES0 OF 22 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Assessment run visibility: live stream, phase indicator, activity timelineimproved65how completely this was documenteddepth30/40specificity20/30actionability15/3065 / 100
Adds a live assessment stream so findings and activity can be watched as an assessment runs (v0.1.0); adds a phase indicator so assessments show which phase is currently running, with access-control findings categorised more accurately and results saved even if an assessment ends early (v0.4.0); and adds a live assessment activity timeline giving a readable, real-time view of tester activity while an assessment is in progress (v0.5.0).
Broken access-control (IDOR) testingimproved65how completely this was documenteddepth30/40specificity20/30actionability15/3065 / 100
Adds broken-access-control (IDOR) modules (v0.1.0), then extends access-control testing to more link and request types and enables testing the same target as both a logged-in and anonymous user to expose access-control gaps (v0.4.0).
Business-logic testing for discount, coupon and quantity abuseimproved65how completely this was documenteddepth30/40specificity20/30actionability15/3065 / 100
Adds a business-logic testing agent team covering abuse of discount and coupon handling in commerce flows (v0.2.0), adds detection for quantity manipulation such as negative values to surface invalid order states (v0.3.0), and expands business-logic detection in commerce flows building on the discount/coupon and quantity-manipulation checks (v0.4.0).
EASM filtering by service, port, API and certificatenew65how completely this was documenteddepth25/40specificity25/30actionability15/3065 / 100
Adds a new EASM/ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. filter to scope the host and domain list to assets where no services were discovered, enabling investigation without a full CSV export; adds new EASM domain page filters to narrow domains by open port, API presence, and API confidence for precise external attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. triage; and adds a certificate filter to filter certificates by issue type.
Per-location-type default scan profilesnew65how completely this was documenteddepth30/40specificity20/30actionability15/3065 / 100
Adds support for two separate organisation-default scan profiles based on asset location type — one for URL-only unauthenticated web app assets and one for URL+Network — so new assets automatically inherit the correct profile.
Contact assignment at asset creationimproved60how completely this was documenteddepth25/40specificity20/30actionability15/3060 / 100
Adds ability to assign asset owner, technical POC, and assessment notifier emails when creating a single asset, eliminating the need to configure them post-creation.
Bulk role permission assignmentnew55how completely this was documenteddepth20/40specificity20/30actionability15/3055 / 100
Bulk Actions on the organization index page now includes a create role permission option, enabling bulk permission assignment within an organization's scope.
Injection detection coverage (XSS, SQL injection)improved50how completely this was documenteddepth25/40specificity15/30actionability10/3050 / 100
Adds injection modules covering cross-site scriptingcross-site scriptingCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., and similar (v0.1.0), then expands this detection with more complete and durably recorded results (v0.4.0).
Independent finding confirmation stepnew50how completely this was documenteddepth25/40specificity15/30actionability10/3050 / 100
Introduces a separate, independent confirmation step for each potential finding before it is marked validated; findings that do not pass remain marked as suspected.
Multi-identity authentication and session persistencenew50how completely this was documenteddepth25/40specificity15/30actionability10/3050 / 100
Adds foundational multi-identity authenticated testing where an assessment can carry multiple sets of credentials as named identities, and strengthens session persistence through multi-step and session-rotating application flows to broaden coverage of authenticated areas.
Path traversal and file disclosure testingnew50how completely this was documenteddepth25/40specificity15/30actionability10/3050 / 100
Adds path-traversal detection where requests are manipulated to test whether files outside the intended directory can be read, and adds broader file-disclosure testing support.
TOTP support in authenticated DAST scansnew50how completely this was documenteddepth20/40specificity20/30actionability10/3050 / 100
Adds TOTP support in authenticated DAST scans, enabling scanning of applications protected by MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone./time-based one-time passwords.
EASM export content and clarity improvementsimproved40how completely this was documenteddepth15/40specificity15/30actionability10/3040 / 100
Domain names are now included in EASM export files for records and services, and a new tooltip clarifies the difference between the index page export option and the bulk actions export option.
WAF-adaptive testingnew35how completely this was documenteddepth20/40specificity10/30actionability5/3035 / 100
Adds WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server.-adaptive testing where assessment behaviour adapts based on how the application and any web application firewall respond.
Cloudmersive provides cloud-based APIs for document processing, data validation, virus scanning, and content conversion tasks.
Cloudmersive's Cloud DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. AI API now supports scanning much larger files submitted via multipart form uploads.
└──▷ WHAT SHIPPED ·
1 FEATURE0 OF 1 FEATUREmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Large file support for DLP scanningimproved45how completely this was documenteddepth15/40specificity20/30actionability10/3045 / 100
The Cloud DLP AI API now supports multipart/form-data encoded file uploads over 2 GB in size for DLP scanning.
runZero is a network asset discovery and inventory tool that identifies and maps all devices connected to networks in real-time.
runZero's biggest changes this window were alert rules that can trigger on Issue lifecycle events and a new comment: search operator for the Issues inventory, alongside smaller additions spanning MCP OAuthMCP OAuthAn authentication layer for the Model Context Protocol that lets MCP clients obtain delegated access tokens so cyber tools can call MCP servers on a user's behalf without handling raw credentials., CBOMCBOMA structured inventory of cryptographic assets — algorithms, keys, certificates, and protocols — used in a system, modeled after the Software Bill of Materials concept to help teams audit and manage cryptographic risk. export, integration scripting, and reporting.
└──▷ WHAT SHIPPED ·
9 FEATURES1 OF 9 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
`comment:` search operator for Issuesnew65how completely this was documenteddepth20/40specificity20/30actionability25/3065 / 100
The comment: search operator is now supported in the Issues inventory for searching Issue comments, e.g. comment:CVE-2025 or, via the search bar, comment:<term> to find Issues containing a specific term in their comments.
Search Issue comments for a keyword to quickly surface relevant discussion on open Issues.
$ comment:CVE-2025
Find Issues that contain a specific term in their comments — useful for tracking discussion-driven triage without leaving the Issues inventory.
📍In the Issues inventory search bar, enter: comment:<term>
Censys Platform v3 integrationnew20how completely this was documenteddepth5/40specificity15/30actionability0/3020 / 100
runZero added support for Censys Platform v3.
— Names the integration and version, no setup detailproduct docs
0601
MCP OAuth supportnew15how completely this was documenteddepth5/40specificity10/30actionability0/3015 / 100
runZero added OAuth support for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. integrations.
WMI scripting supportnew15how completely this was documenteddepth5/40specificity10/30actionability0/3015 / 100
runZero added WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. scripting capability.
Aembit shipped a new integration with CrowdStrike Falcon AI Detection and Response (AIDR) that lets MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. traffic for AI agents be inspected and governed using centrally configured policies enriched with Aembit workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials..
Aembit is IAM for agentic AI and workloads. Enable secretless access and real-time policy enforcement across any environment to protect data and accelerate AI adoption.
Aembit shipped a new integration with CrowdStrike Falcon AI Detection and Response (AIDR) that lets MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. traffic for AI agents be inspected and governed using centrally configured policies enriched with Aembit workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials..
└──▷ WHAT SHIPPED ·
1 FEATURE0 OF 1 FEATUREmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
CrowdStrike Falcon AIDR integration for MCP trafficnew70how completely this was documenteddepth30/40specificity25/30actionability15/3070 / 100
Aembit's MCP Identity Gateway now applies centrally pre-configured CrowdStrike Falcon AI Detection and Response (AIDR) policies across all MCP clients, inspecting MCP tool listings, inputs, and outputs for AI agent traffic without requiring per-client configuration or custom agent-side inspection logic. Configurable policies support allow, report, block, or transform actions based on identity context and risks identified by AIDR. Aembit supplies run-time identities for both user-delegated and autonomous agents to AIDR to enrich its policy decisions, and CrowdStrike AIDR findings now link directly to corresponding Aembit access records so investigators can pivot between platforms without manually reconciling logs.
— Describes mechanism and scope well but no config keys or commands given.launch-20260902-d7ab4bbe
Didit provides identity verification, fraud prevention, and transaction-monitoring APIs, SDKs, and MCP tools.
Didit's biggest window addition is a full transaction-monitoring rules Management API alongside opt-in biometric-template retention with a breaking change to session-deletion response bodies; it also shipped new fraud signals, age-assurance templates, marketplace access, an upgraded Copilot, and in-console support tickets.
└──▷ WHAT SHIPPED ·
7 FEATURES1 OF 7 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Opt-in biometric-template retention after deletionnew95how completely this was documenteddepth35/40specificity30/30actionability30/3095 / 100
Retention of biometric templates after session deletion can be enabled via face_retention_policy and face_retention_days on PATCH /v3/webhook/, and overridden per call with retain_face_embeddings on DELETE /v3/session/{sessionId}/delete/ and POST /v3/sessions/delete/. Retained templates carry a finite expires_at and never contain images or identity fields.
Enable biometric-template retention for an app so duplicate detection and Face Search keep working after session data is purged.
Delete a session while issuing a privacy-erasure instruction to purge all retained biometric templates for that person, regardless of the app-level retention policy.
Transaction-monitoring rules Management APInew80how completely this was documenteddepth30/40specificity25/30actionability25/3080 / 100
New /v3/transactions/rules/ Management API endpoints let you create, update, delete, and backtest transaction-monitoring rules programmatically; matching library and install endpoints manage preset rules.
Session-deletion endpoints now return 200 with JSON bodybreaking75how completely this was documenteddepth30/40specificity25/30actionability20/3075 / 100
DELETE /v3/session/{sessionId}/delete/ and POST /v3/sessions/delete/ now return 200 OK with a JSON body (face_retention_outcome, biometric_template_uuid; per-session results[] for batch) instead of 204 No Content — clients that assert on 204 must be updated.
Didit Copilot upgraded to floating panelimproved65how completely this was documenteddepth25/40specificity25/30actionability15/3065 / 100
Didit Copilot is now a floating panel available on every console page, with inline source citations, a fullscreen mobile layout, workflow-building from a description, Database Validation configuration by conversation, and questionnaire generation from a CSV or Excel file.
DELETE /v3/session/{sessionId}/delete/ and POST /v3/sessions/delete/ now return 200 OK with a JSON body (face_retention_outcome, biometric_template_uuid; per-session results[] for batch) instead of 204 No Content — clients that assert on 204 must be updated.
The easiest way to add authentication and user management to your application. Purpose-built for React, Next.js, Remix, and “The Modern Web”.
└──▷ WHAT SHIPPED ·
2 FEATURES2 OF 2 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0101
Reverification window setting for sensitive actionsnew75how completely this was documenteddepth30/40specificity25/30actionability20/3075 / 100
Adds a Reverification window setting (1–10 minutes, default 10) under Session lifetime on the Sessions page in the Clerk Dashboard, controlling how long a successful reverification remains valid for Clerk-protected sensitive actions like account deletion.
Reduce the reverification window so users must re-verify more frequently before sensitive actions like deleting their account.
📍In the Clerk Dashboard, go to Sessions › Session lifetime › Reverification window and set the value to a number between 1 and 10 minutes.
Biometric sign-in APIs for mobile SDKsnew75how completely this was documenteddepth30/40specificity30/30actionability15/3075 / 100
Adds biometric credential APIs across Clerk's mobile SDKs: useBiometricCredentials for React Native/Expo, Clerk.shared.biometricCredentials.signInWithBiometrics and Clerk.shared.biometricCredentials.biometricCredentialId for Swift, and Clerk.biometricCredentials.signInWithBiometrics and Clerk.biometricCredentials.biometricCredentialId for Android. These enable enrollment and sign-in via Face ID, Touch ID, or Android biometrics using a device-bound private key.
Auth0 has made Advanced MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. Configurations generally available, letting admins customize OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. lifetimes for SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. and email-based multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone..
Secure users, AI agents, and more with Auth0, an easy-to-implement, scalable, and adaptable authentication and authorization platform.
Auth0 has made Advanced MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. Configurations generally available, letting admins customize OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. lifetimes for SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. and email-based multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone..
└──▷ WHAT SHIPPED ·
1 FEATURE1 OF 1 FEATUREmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0101
Configurable OTP lifetimes for MFAnew60how completely this was documenteddepth25/40specificity20/30actionability15/3060 / 100
Advanced MFA Configurations are now Generally Available, enabling customizable OTP lengths, lifetimes, and device-remember windows. Specifically, OTP lifetime for SMS MFA can be set from 30 seconds to 1 hour, and for email MFA from 5 minutes to 1 hour.
Okta for AI Agents added JA4JA4A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies. TLS fingerprinting across Syslog events and manual MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server registration for legacy servers, alongside a new suspicious authenticator enrollment detection, an added OAuth scope, new OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation. integrations, and a Jamf Pro SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. mapping field.
Okta for AI Agents provides identity and access management capabilities enabling secure authentication and authorization for artificial intelligence agents.
Okta for AI Agents added JA4JA4A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies. TLS fingerprinting across Syslog events and manual MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server registration for legacy servers, alongside a new suspicious authenticator enrollment detection, an added OAuth scope, new OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation. integrations, and a Jamf Pro SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. mapping field.
└──▷ WHAT SHIPPED ·
7 FEATURES1 OF 7 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
JA4 TLS fingerprinting in Syslog eventsnew88how completely this was documenteddepth32/40specificity28/30actionability28/3088 / 100
Okta now captures JA4 TLS client fingerprints in securityContext.tlsFingerprint.ja4 across all Syslog event types, including telephony (OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets./SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels.), sign-in, auth, and token events, enabling detection of bot traffic, toll fraud, and TLS-based attack patterns beyond IP/user-agent signals alone. Not yet available for orgs on custom-hosted domains.
Query the System Log to surface JA4 TLS fingerprints across all event types and identify bot or toll-fraud patterns that IP/user-agent signals miss.
Manual MCP server registrationnew83how completely this was documenteddepth30/40specificity25/30actionability28/3083 / 100
Adds manual MCP server registration, allowing admins to configure authorization server details and client credentials directly for internal or legacy MCP servers that don't support automated metadata discovery endpoints. In the Admin Console, go to AI Agents > MCP Servers > Add MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface., select Manual registration, then enter the authorization server URL, client ID, and client secret.
Register an internal MCP server that lacks automated metadata discovery by supplying authorization server details and client credentials manually.
📍In the Admin Console, go to AI Agents › MCP Servers › Add MCP Server, select Manual registration, then enter the authorization server URL, client ID, and client secret for the internal or legacy MCP server.
Application username format field for Jamf Pronew65how completely this was documenteddepth20/40specificity25/30actionability20/3065 / 100
Adds Application username format field to the Jamf Pro integration in the Admin Console by default, enabling custom mappings for the SCIM userName attribute.
AI agent binding tab shows authentication requirementimproved50how completely this was documenteddepth20/40specificity15/30actionability15/3050 / 100
Displays the authentication requirement for an app on the AI agent binding tab, with a direct link to the app's Sign On tab to configure an authentication policy.
Suspicious authenticator enrollment detectionnew45how completely this was documenteddepth20/40specificity15/30actionability10/3045 / 100
Adds Suspicious authenticator enrollment detection to Okta Identity Threat Protection (ITP), flagging suspicious activity during authenticator enrollment with details recorded in the System Log for investigation.
New OIN integrations addednew45how completely this was documenteddepth10/40specificity25/30actionability10/3045 / 100
Adds new OIN integrations: Flexopus (SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.), Paminga (OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.), Paminga (SCIM), Upwave Lifecycle Management by Redblock (SCIM), Velantix Axiom (OIDC), and Velantix Axiom (SCIM).
Netskope is a cloud security platform that provides visibility and threat protection for cloud applications and web traffic.
Netskope R141 introduces per-app-instance visibility controls for SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. findings, letting teams scope findings to individual SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. app deployments.
└──▷ WHAT SHIPPED ·
1 FEATURE0 OF 1 FEATUREmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Per-app-instance visibility for SSPM findingsnew33how completely this was documenteddepth15/40specificity10/30actionability8/3033 / 100
Adds the ability to control visibility of SSPM findings scoped to individual app instances, enabling teams to restrict or expose findings by specific SaaS app deployments.
ScoutDNS's Windows Client 2.2.6 adds compatibility with Microsoft Entra Global Secure Access, letting ScoutDNS and Entra Private Access coexist without manual configuration.
DNS filtering and threat protection for businesses, MSPs, schools, and nonprofits. Block malware, phishing, and unwanted content at the DNS layer.
ScoutDNS's Windows Client 2.2.6 adds compatibility with Microsoft Entra Global Secure Access, letting ScoutDNS and Entra Private Access coexist without manual configuration.
└──▷ WHAT SHIPPED ·
1 FEATURE0 OF 1 FEATUREmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Microsoft Entra Global Secure Access compatibilitynew70how completely this was documenteddepth30/40specificity25/30actionability15/3070 / 100
Windows Client 2.2.6 (driver 1.0.0.22) adds compatibility with Microsoft Entra Global Secure Access (GSA), allowing ScoutDNS and Entra Private Access to coexist without disrupting private DNS or tunnel startup. It automatically detects an active GSA Private Access tunnel and permits only required GSA bootstrap and synthetic DNS paths while continuing to enforce ScoutDNS policy for public DNS, with no manual domain or IP exclusions required. Validated in both split tunnel (GSA Private Access) and full tunnel modes.
Knocknoc is a security tool for detecting and managing security vulnerabilities in software dependencies and code.
Knocknoc's 26.08 release focused on expanding dynamic network access control to new backend targets, adding native integrations for Fastly, nftablesnftablesA Linux kernel packet-filtering framework maintained by Netfilter that replaces iptables, offering a unified ruleset for firewalling and NAT that cyber tools use for efficient, scriptable traffic control., and Kemp LoadMaster.
└──▷ WHAT SHIPPED ·
1 FEATURE0 OF 1 FEATUREmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
New backend integrations for Fastly, nftables, and Kemp LoadMasternew65how completely this was documenteddepth25/40specificity25/30actionability15/3065 / 100
Knocknoc added three new backend integrations for dynamic, just-in-time network access control: a Fastly integration that controls which source IPs are permitted through a Fastly edge service (also described as an ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. integration for network access control enforcement), enabling JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. access at the CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. layer; a native nftables integration that dynamically adds and removes source IPs via nftables rules on Linux hosts when users authenticate; and a Kemp LoadMaster integration that dynamically controls network access through the load balancer based on Knocknoc authentication events.
CISO Assistant is a one-stop-shop GRC platform for Risk Management, AppSec, Compliance & Audit, TPRM, BIA, Privacy, and Reporting. It supports 200+ global frameworks with automatic control mapping, including ISO 27001, NIST CSF, SOC 2, CIS, PCI DSS, NIS2, DORA, GDPR, HIPAA, CMMC, and more.
CISO Assistant's v3.21.4 release adds automatic SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. user provisioning and broadens workflow tooling and localization.
└──▷ WHAT SHIPPED ·
3 FEATURES1 OF 3 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0101
Just-in-Time SSO user provisioningnew50how completely this was documenteddepth25/40specificity15/30actionability10/3050 / 100
User accounts are now automatically created on first SSO login, eliminating the need for manual pre-provisioning of accounts before a user can sign in via SSO.
— Explains mechanism but no config key or setup steps givenv3.21.4
0200
Expanded workflow enablers and sample workflowsimproved20how completely this was documenteddepth10/40specificity5/30actionability5/3020 / 100
Adds more workflow enablers and additional sample workflows to the platform's workflow capabilities.
— Vague description with no named enablers or workflowsv3.21.4
0300
Updated Dutch translationsimproved20how completely this was documenteddepth5/40specificity10/30actionability5/3020 / 100
Adds updated Dutch (nl) translations for the UI.
— Names the language but no scope of coveragev3.21.4
GitHub CLI adds a repeatable --attach flag for uploading local images and videos directly into issues, PRs, and comments, alongside worktree support for gh issue develop and agent-friendly spinner output.
GitHub’s official command line tool
GitHub CLI adds a repeatable --attach flag for uploading local images and videos directly into issues, PRs, and comments, alongside worktree support for gh issue develop and agent-friendly spinner output.
└──▷ WHAT SHIPPED ·
3 FEATURES0 OF 3 FEATURESmost completely described firstwhat's the number?
Each feature carries 0–100 for how completely the vendor documented
it — not how big or important the work is. A major capability
described in eight words scores low, and that is the finding.
depth0–40what it does and how it works or what changed
specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint,
flag or config key scores at the top of specificity and actionability,
so it sorts above a feature described only in prose. Under
60 the notes go thin — everything below the “thinner
coverage” line is thinner documentation, not smaller work.
Hover any meter for that feature's three sub-scores.
0100
Attach local images and videos via CLInew93how completely this was documenteddepth35/40specificity28/30actionability30/3093 / 100
Adds a repeatable --attach flag to gh issue create, gh issue edit, gh issue comment, gh pr create, gh pr edit, and gh pr comment that uploads a local image or video to GitHub and embeds the resulting URL inline in the body; the same file cannot be attached twice. Alt text for images is supported via a # suffix on the file path (e.g. --attach 'PATH/TO/IMAGE#ALT-TEXT'), though not for videos. When combined with --body or --body-file (or stdin/interactive editor input), GitHub CLI rewrites any matching local file references already present in the Markdown body in-place with the uploaded URL rather than appending a duplicate, and appends new ones otherwise. Requires push access to the repository.
Add a screenshot inline to a PR when opening it, so reviewers see the image rendered without leaving the CLI.
Embed a video player in an issue comment by referencing the local file in the body and attaching it, so GitHub CLI rewrites the path to a rendered player.
— Full flag syntax, behavior, and constraints documented with runnable examples.v2.99.0
0200
Worktree support in gh issue developnew70how completely this was documenteddepth25/40specificity20/30actionability25/3070 / 100
Extends gh issue develop with a --worktree flag, used alongside --checkout, to create a linked branch and check it out in a new Git worktree without disturbing the current working copy.
Create a linked feature branch for an issue and check it out in an isolated worktree, leaving your main checkout untouched.
THE CYBER TOOLCHAIN
