The Cyber Toolchain — issue 064, September 4, 2026

Adds per-provider custom base URL configuration for the OpenAI Responses API, enabling use of self-hosted models, gateways (e.g. OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code., LiteLLM), or any other compatible endpoint.

Adds a --json option to the harden check command for machine-readable output, useful for feeding results into a CI pipeline or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..

$ harden check --json

Package Firewall intercepts every package install request and returns a 403 for flagged packages so they never touch disk, while clean packages are transparently redirected to the upstream registry. It integrates with private artifact managers (e.g. JFrog Artifactory) by pointing a remote repository at the Package Firewall URL with no developer-machine changes, or runs in Endpoint Mode where configuration is pushed to developer machines via MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. and to CI runners via a config snippet. It enforces configurable cooldown periods that block newly published package versions for a set window regardless of requester, and plugs into the Endor Labs policy engine to block packages with known CVEs or license non-compliance in addition to malware. Every install event (package name, version, time, reason) is logged and visible in the Endor Labs UI and via the API, powered by a real-time malware feed that uses multi-pass LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code., static, and behavioral analysis to classify newly uploaded npm, PyPI, and Go packages within minutes of upload.

Adds GET /actions/runners/deprecations/{version}, available at repository, organization, and enterprise level, returning runner_version, runtime_deprecates_at, and registration_deprecates_at so teams can plan runner upgrades before support ends.

$ curl -H "Authorization: Bearer <token>" \
  -H "Accept: application/vnd.github+json" \
  https://api.github.com/actions/runners/deprecations/2.315.0

Adds four new job context properties for reusable workflows — job.workflow_ref, job.workflow_sha, job.workflow_repository, and job.workflow_file_path — letting a reusable workflow determine its own source identity at runtime; not available on GitHub Enterprise Server.

jobs:
  called-job:
    runs-on: ubuntu-latest
    steps:
      - name: Print reusable workflow identity
        run: |
          echo "Workflow ref: ${{ job.workflow_ref }}"
          echo "Workflow SHA: ${{ job.workflow_sha }}"
          echo "Repository:   ${{ job.workflow_repository }}"
          echo "File path:    ${{ job.workflow_file_path }}"

Adds a vulnerability-alerts permission for GITHUB_TOKEN supporting read and none values, enabling least-privilege read-only access to Dependabot alerts without granting broader repository scopes.

permissions:
  vulnerability-alerts: read

jobs:
  audit-alerts:
    runs-on: ubuntu-latest
    steps:
      - name: List Dependabot alerts
        run: gh api repos/${{ github.repository }}/dependabot/alerts

The actions/unpinned-tag query now detects mutable references to reusable workflows, expanding pinning enforcement beyond actions to workflow calls. EnvironmentCheck can now be specified through a models-as-data model, allowing custom environment sanitizer definitions without modifying queries. Actor-field checks on fields like github.event.pull_request.user.login now only count as protection for events that actually populate that field, reducing false negatives in ControlCheck-based queries — though this may cause ControlCheck-based queries to surface more alerts since environments are no longer treated as a sufficient sanitizer.

npm packages can now have multiple trusted publishing (OIDC) configurations, each with its own repository, workflow, and environment criteria — a publish or stage succeeds if the incoming OIDC token matches any one configuration. Direct publishing is now opt-in per configuration (staging-only is the default, and every configuration can stage without extra setup), the staged publishing queue's approval button disables during malware scanning and re-enables once the scan completes (refreshing status every minute), and the versions tab on npmjs.com now shows a per-version staged history noting whether each version was approved, rejected, or remains staged.

CodeQL adds taint flow through list.extend and list.insert in Python (matching existing list.append coverage), taint propagation through String.valueOf(Object) when the argument is a CharSequence (e.g., String or StringBuilder) in Java/Kotlin, and support for regular expressions using the d flag and the React Native Worklets 'worklet' directive in JavaScript/TypeScript.

Gemini 3.8 Flash is now selectable in the Copilot model picker across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot cloud agent, GitHub Copilot app, JetBrains IDEs, Xcode, and Eclipse. Enterprise and Business admins can manage access via the model policy in Copilot settings, including a default model enablement toggle that auto-enables new models unless explicitly disabled.

AppTrust adds out-of-the-box compliance frameworks, starting with NIST SSDF and EU CRA, with controls pre-mapped to Policy-as-CodePolicy-as-CodeThe practice of expressing governance rules, access controls, or compliance requirements as machine-readable code so they can be versioned, tested, and automatically enforced rather than managed through manual processes. rules so teams can enable enforcement without writing Rego manually. Framework configuration is separated from rollout control: AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. owns which controls and rules are active, while development managers configure which applications fall under the framework, whether rules run as warnings or hard failures, and how long before a warning converts to a blocked package.

⤢ ⤢

JFrog AppTrust automatically collects and signs commits, pull requests, Jira ticket transition histories, and approver chains for every release before any promotion gate runs. It automatically flags self-approval violations by checking whether the PR approver is the same person as the committer, a check most compliance frameworks require but few teams automate. Upcoming JFrog Agent Plugins will extend this to capture AI agent session evidence — prompts, code produced, MCPs, skills, and agentic assets used — as signed evidence stored in Artifactory, and this SDLC traceability is described as connecting AI agent intent sessions alongside Git commits, pull requests, and Jira tickets to the artifacts that ship.

⤢

Adds a denied-endpoints input to step-security/harden-runner (v2.21.0) to block named domains, wildcard domains (e.g. *.example.org), or IP addresses while leaving all other destinations reachable under egress-policy: block. The same deny-list capability ships as denied_endpoints on the Self-Hosted VM Harden Runner (v1.9.0), and as a Policy Store option attached at organization or cluster scope via ARC Harden Runner v2.19.0+, enforcing CI egress restrictions across all repositories without per-workflow-file edits.

⤢ ⤢

- uses: step-security/harden-runner@v2.21.0
  with:
    egress-policy: block
    denied-endpoints: |
      registry.npmjs.org
      pypi.org
      files.pythonhosted.org

step-security/harden-runner@v2.20.1 adds support for GitHub Actions jobs running on AWS CodeBuild EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. compute, monitoring outbound network calls, file writes, and process execution; v2.21.0 extends this to Linux containers on EC2, including custom images from Amazon ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. and external Docker registries. Requires the CodeBuild project set to Compute: EC2, Host kernel: kernel-6 (Amazon Linux 2023), and Privileged: Enabled in the project's Additional configuration panel. It surfaces memory-read detections (the technique behind CVE-2025-8217) as a runtime alert with an attached triage runbook, and unifies CodeBuild-hosted, GitHub-hosted, ARC, and self-hosted runner fleets under a single dashboard, Policy Store, and detection baseline.

⤢

jobs:
  build:
    runs-on: codebuild-my-project-${{ github.run_id }}-${{ github.run_attempt }}
    steps:
      - uses: step-security/harden-runner@v2.21.0
        with:
          egress-policy: audit
      - uses: actions/checkout@v4

Token Controls evaluate the entire PAT inventory hourly across both GitHub and Azure DevOps organizations, surfacing breaching tokens as findings on the All Controls dashboard with evidence, impact, and a per-token revoke action. Organizations can set configurable max-age and idle-window thresholds, with separate limits for fine-grained versus classic GitHub tokens and a stricter limit for high-privilege Azure DevOps tokens, plus pre-expiry reminder notifications to token owners at configurable bands (30, 7, and 1 days by default) on both platforms. Scope risk classification flags Azure DevOps tokens against the 35 Microsoft-rated high-privilege scopes with colour-coded scope chips, while on GitHub it flags coarse classic scopes (repo, admin:org, workflow) and fine-grained tokens combining all-repository access with write permissions. Per-control notification events fire once when a token first breaches policy rather than on every scan, and each control's notifications are selectable independently.

⤢

Socket adds Microsoft Teams as a notification destination configured under Settings → Integrations → Notifications via a Microsoft Workflows incoming webhook (HTTP POST URL), alongside the existing email channel. A new subscription model lets owners and admins route organization alerts and supply chain attack campaign notifications to specific Teams channels, filtered by alert category (supply chain risk, vulnerability, quality, maintenance, license), severity, Socket priority, repository, or package ecosystem. Notifications are delivered as structured Adaptive Cards summarizing alert totals by severity, affected repository count, individual finding previews, and a direct link to the Socket dashboard, with related alert activity grouped into digests to prevent channel flooding. Attack campaign notifications also indicate whether affected packages are present in the organization, showing impacted repositories or confirming none are affected without manual per-repository checks.

⤢ ⤢ ⤢

Adds SBOM export in CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema., SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format., standalone CycloneDX VEXCycloneDX VEXA CycloneDX-format document that records which known vulnerabilities in a software bill of materials actually affect a given product, letting cyber tools automate triage by filtering out irrelevant CVEs. documents, and AI-BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. formats, all generated from the same stored scan inventory. VEX statements are driven by reachability analysis and emit one of three machine-readable states — not_affected (with justification code_not_reachable), exploitable, or in_triage — instead of manually authored verdicts. The AI-BOM export is a CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. ML-BOM covering seventeen AI component kinds (LLM SDKs, agent frameworks, vector databases, model weights, prompt templates, MCP servers) aligned to EU AI Act and NIST AI Risk Management Framework inventory expectations. License obligations are classified into five buckets — permissive, weak copyleft, strong copyleft, network copyleft (AGPL/Affero), and unknown — with network copyleft split out to surface AGPL's hosted-service trigger; packages with unknown licenses are marked license-unknown and fields with no data are omitted rather than filled with placeholders.

When a fresh CVE lands on a direct dependency, ZeroPath automatically re-runs reachability and exploitability analysis — cloning the repo, checking whether the vulnerable function is actually called — and produces a triaged alert with reachability verdict, exploitability rating, confidence, severity, and a pointer to the relevant line. It suppresses noise by hashing only the version-relevant portion of each OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. advisory (so cosmetic republications don't duplicate alerts), folds multiple hits from one CVE across many locations into a single notification, and enriches alerts with CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. data and FIRST EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scores to surface reachable-and-actively-exploited findings first. Deep transitive dependency matches are recorded as uninvestigated rather than scored, and when a finding is exploitable with a safe upgrade available, the alert arrives with a pull request already attached. Alerting is opt-in per repository, tag, or organization, and can be routed to Slack, a webhook, or an agent playbook.

The json-enumerator source now supports passing multiple files at once, e.g. trufflehog json-enumerator FILE_1 .. FILE_N, replacing the previous sequential behaviour and improving throughput on multicore systems. It also adds native zstd-compressed NDJSONNDJSONA text format where each line is a self-contained JSON object, making it easy to stream, append, and parse large datasets record-by-record without loading the whole file into memory. input handling, eliminating the need to decompress files externally before scanning, and json-enumerator can now be used inside a multi-source configuration.

$ trufflehog json-enumerator secrets_dump_1.ndjson.zst secrets_dump_2.ndjson.zst secrets_dump_3.ndjson.zst --results=verified

Adds a Daytona app connection and secret sync integration, enabling secrets stored in Infisical to be synced to Daytona environments. Configured via Project > Integrations > Secret Syncs by adding a sync, selecting Daytona, configuring the app connection, and choosing the source environment and path.

Extends INVICTI_IGNORE_SSL_CHECKS in scan-cli to cover all outbound platform API calls during a scan — DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces., Inventory, Identity, and report/export endpoints — not just the ephemeral agent.

The scan engine now automatically throttles request pacing when rate-limiting response headers (Retry-After, X-RateLimit-*) are received, reducing false-negative risk and incomplete coverage on rate-limited targets, and applies exponential backoff with jitter when retrying requests that receive a 429 response with no Retry-After header.

The INVICTI_MINIMUM_CONFIDENCE environment variable in scan-cli now independently fails a scan when the threshold is exceeded, without requiring INVICTI_MINIMUM_SEVERITY to also be set.

Leaving the minimum severity field empty in the CI/CD script generator now produces a script with no minimum vulnerability threshold, applicable to Azure Pipelines, CircleCI, GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure., GitLab CI/CD, and Jenkins.

Agentic Pentesting assessment reports can now be downloaded in Markdown (.md) and raw JSON formats, enabling import into automated pipelines and external tools.

SCIM2SCIM2An IETF-standardized REST/JSON protocol for automating user and group provisioning across identity systems, letting cyber tools sync accounts and permissions without custom per-service integrations. provisioning endpoints can now be toggled on or off per organization, preventing user and team updates or deletions through SCIM2-provisioned accounts when disabled.

Agentic Pentesting Assessment Profiles now support input caps, prioritization limits, and credit spend limits for more granular agent resource budgeting and control.

Adds Bearer Token and API Key as dedicated, first-class authentication header types in target configuration, separate from functional headers, simplifying authenticated scan setup.

Adds a built-in GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. MCP server, enabled via the ui.mcp.enabled setting (restart required) or Plugins > MCP > Start Server, listening at http://127.0.0.1:24642/mcp by default. The ui.mcp.token setting requires clients to send a matching bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else., and Plugins > MCP > Copy Connection Info copies the exact URL and authorization header for the active session. A standalone binaryninja_mcp headless binary (stdio-based MCP server) is also shipped for Commercial and Ultimate on macOS and Linux.

New Binary Similarity feature (Ultimate only) for comparing related binaries using pluggable providers, shipping with Google BinDiff and WARP providers, with automatic annotation transfer between binaries. Exposed through Python, C++, and Rust APIs, enabling headless sessions and registration of custom providers and resolvers.

⤢ ⤢ ⤢

Introduces a new BASE sampling mode (enabled by default) for faster automated base address detection, especially on large files; the previous IL Analysis Mode remains available for higher accuracy.

A new Timeline view merges events from browser activity, network activity, recent files, Jump Lists, device activity, and program execution into a single chronology, presented as an event table and histogram with quick filtering, event cards, and jump-to-source-artifact links. Timeline exports to PDF and XLS.

A new plugin-based artifact architecture enables six new artifact type plugins: Microsoft Defender logs, Windows Update Store (WUS), CAM database, Jump Lists, Windows Search index, and Prefetch files.

The MTK Dump acquisition workflow now separates acquisition and decryption into independent operations and adds passcode brute-force with unknown-length support, dictionary-based alphanumeric attacks, and new chipset support: MT3369, MT6762, MT6880, MT6883, MT6889, MT6890, MT8765, MT8766B, and MT8768T. Investigators can run acquisition to capture a raw dump, then later return to the saved dump and select Decrypt user data partition to enter a known passcode or launch a dictionary-based brute-force attack.

The Belkasoft Offline Map Server is a locally deployed map server for reviewing geolocation evidence without connecting forensic workstations to online mapping services, configured by specifying its network address in Belkasoft X settings. To use it, download the required map tiles, deploy the server within your network, then enter its network address under Settings in Belkasoft X to enable offline map review.

Belkasoft X extends Windows artifact support in several areas: BAM/DAM artifact extraction now covers Windows 10 version 1809 and later, capturing executable paths and timestamps from Background Activity Moderator and Desktop Activity Moderator data; a new Remote Desktop Cache reconstruction feature extracts Windows Remote Desktop bitmap cache tiles and automatically combines visually matching fragments into larger image sequences; a new SRUM (System Resource Usage Monitor) artifact extraction parses historical application network activity and associated timestamps; and System Event Log artifacts gain an Event cluster property that groups events into activity categories such as system logon/logout, software installation, remote access, Wi-Fi connections, and system startup/shutdown.

Custom SQLite artifacts let investigators map tables and columns from unsupported databases to standard Belkasoft X artifact fields (timestamps, participant names, message text, identifiers, geolocation) for search, filter, review, and reporting alongside parsed evidence.

The Android agent-based acquisition (Agent backup via SD card method) now supports USB flash drives via USB-C adapters, custom folder selection on device or external media, and improved reliability on recent Android versions with added SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. and call history collection.

Belkasoft X improves extraction for Android apps including Facebook (contact info, chat threads), Instagram (threads and reactions), Telegram (account owner name, replies, reactions, service messages, call duration), Viber (replies, reactions, call duration, picture captions), WhatsApp (contact merging, reply visualization, vCard contacts), and X/Twitter (separated DMs/group chats from feed, pictures, voice messages, reactions).

The new BelkaGPT Hub installer for Windows simplifies deployment of distributed offline AI processing to GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference.-equipped workstations and servers in a local network, with selectable GPU and CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. resources.

Belkasoft X adds iOS support for ChatGPT v1.2026.160 and improves extraction for Apple Unified Logs (application names in Timeline Info field), Instagram, WeChat (messages, reactions, media), and Zalo (audio artifacts).

The JavaScript SDK adds a clientSNI property to FetchEvent.client, exposing the TLS Server Name Indication value from the incoming client connection at the edge, enabling routing or logging based on the SNI hostname without inspecting the Host header.

addEventListener('fetch', (event) => {
  const sni = event.client.clientSNI;
  if (sni === 'api.example.com') {
    // apply API-specific logic
  }
  event.respondWith(fetch(event.request));
});

A new Endpoint AI Security Attack Chain Analysis capability reasons over the full state of an endpoint — AI agents, coding assistants, IDE and browser extensions, installed software, packages, and system configuration — to construct a realistic, step-by-step attack chain rather than a flat list of findings. Each step in the output is labeled as confirmed on the host, inferred from state, or flagged for verification, and the tool produces a prioritized remediation roadmap ordered by attacker progression. It runs as an endpoint agent, either standalone or as a module within the existing Zscaler client (deployed on more than 70 million devices), and is fully controlled and policy-scoped.

Adds an update action to gcp.dns-policy resources and enable-dnssec/set-dnssec-key-specs actions to gcp.dns-managed-zone.

policies:
  - name: enforce-dnssec-on-managed-zones
    resource: gcp.dns-managed-zone
    filters:
      - type: value
        key: dnssecConfig.state
        value: "on"
        op: ne
    actions:
      - type: enable-dnssec

Adds a delete action to aws.vpc-endpoint resources, enabling policy-driven removal of unwanted VPC endpoints, and a service-details filter for cross-region endpoint inspection.

policies:
  - name: delete-unused-aoss-vpc-endpoints
    resource: aws.vpc-endpoint
    filters:
      - type: value
        key: ServiceName
        op: contains
        value: "aoss"
    actions:
      - type: delete

Adds tagging, mark-for-op, and stop actions to aws.bedrock-model-invocation-job and aws.bedrock-inference-profile resources, a metrics filter to aws.bedrock-agent, a synthetic total-tokens metric on aws.bedrock-inference-profile, and new aws.bedrock-evaluation-job and aws.bedrock-mantle-project resources.

Adds azure.ai-foundry-agent, azure.ai-foundry-application, and azure.cognitiveservice-deployment resources with actions, plus azure.machine-learning-job (with an archive action), azure.machine-learning-online-endpoint, azure.machine-learning-model-version, and azure.machine-learning-data-container resources.

Adds a last-usage filter to aws.kms-key resources for identifying dormant keys.

policies:
  - name: flag-dormant-kms-keys
    resource: aws.kms-key
    filters:
      - type: last-usage
        value: 90
        op: greater-than
        value_type: age
    actions:
      - type: mark-for-op
        op: disable
        days: 7

Adds a monitor action and metrics filter to gcp.vertex-ai-endpoint, and new resources gcp.vertex-ai-custom-job, gcp.vertex-ai-dataset, gcp.vertex-ai-hyper-parameter-tuning-job, gcp.vertex-ai-model, and gcp.vertex-ai-evaluation-run.

Introduces the Calico MCP Server, which exposes Mylo's tools and skills to any MCP-compatible AI agent (Claude, Cursor, terminal agents, etc.) without requiring a new chat interface. Supports two run modes: live cluster diagnostics via the existing kubeconfig path (compatible with kubectl and calicoctl) for real-time use, and a fully offline mode against a Calico diagnostics bundle for air-gapped or post-incident analysis.

⤢ ⤢

Adds the diagnose_connectivity tool via the MCP Server, which returns an ordered, opinionated trace of a network path down to the specific Calico policy rule allowing or denying traffic, along with a suggested fix, rather than a raw dump.