The Cyber Toolchain — issue 069, September 9, 2026

Adds in-process async TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connect port scanning on Windows, replacing the nmap/Npcap dependency that hardened Windows hosts cannot satisfy. Throughput is tunable via the new ADSCAN_PORTSCAN_CONCURRENCY and ADSCAN_PORTSCAN_PER_HOST environment variables.

$ set ADSCAN_PORTSCAN_CONCURRENCY=500 && set ADSCAN_PORTSCAN_PER_HOST=20 && adscan.exe ci auth --type audit --interface Ethernet --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'

ADscan now runs natively on Windows as a self-contained bundle — no Docker, no Python, no nmap, no Npcap required — allowing a low-privilege user on a domain-joined Windows host to run a full scan.

$ adscan.exe ci auth --type audit --interface Ethernet --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'

Domain-wide attack-path discovery now targets Tier-0 (high-value) assets only, with the CLI printing an honest note listing those targets instead of silently launching an all-objects sweep. Discovery switches to a bounded per-target search when full analysis would exhaust available resources, covering every reachable high-value target on very large, dense directories. Reports and the web platform now plainly declare when attack-path routes are a representative sample rather than the full set, and surface a stable exposure count metric for tracking over time.

Adds a Dashboard overview page with summary metrics, agent check-ins, a recent-tasks list, an agents breakdown chart, and an interactive topology panel. The topology graph panel supports fullscreen expand and a context-aware right-click menu (Open, Popout, Execute shell/module, Kill, Focus), gains multi-agent selection on the Check Ins card, and both Dashboard and Graph View are now available to all users (previously restricted).

Chat messages now render Markdown — bold, italic, strikethrough, inline code, code blocks, links, lists, blockquotes, and tables; links are hardened with noopener/noreferrer/no-referrer and restricted to http/https; the message box is now multi-line (Enter sends, Shift+Enter adds a newline).

Package manager switched from yarn to pnpm 11, which requires Node 22+. Existing yarn-based installs must migrate to pnpm 11 before upgrading.

Adds a per-agent Stats tab on the agent page showing task counts, host info, and check-in and tasks-over-time charts.

Adds a revamped v2 tag picker dialog for attaching tags to agents, listeners, and other taggable entities, featuring a filter box, a checklist of existing tags, and inline create-and-attach.

Adds a Background override toggle to module execution, auto-selects the best DotNetVersion based on the agent's installed .NET, renders Empire 7.0 typed boolean module options as toggle switches via the value_type option metadata, and filters the bypass picker to stagers matching the selected execution language.

Adds an Add Destination control in the pathfinding UI that lets you route attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. through up to two additional intermediate waypoint nodes in a user-specified traversal order; the Explore graph adds drag-and-drop reordering of these destinations.

ZeroPath adds a remote MCP server at https://zeropath.com/mcp supporting Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. clients (Claude, Cursor, Codex); connections are read-only until changes are approved, and administrators can revoke all org connections at once. Every MCP tool call is recorded to the audit log by parameter name, while credentials passed to a tool are never stored in audit rows or forwarded to a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..

$ https://zeropath.com/mcp

ZeroPath adds Microsoft Teams channel notifications via an incoming webhook — paste the webhook URL into ZeroPath to deliver scan notifications and vulnerability alerts as Adaptive CardsAdaptive CardsAn open-source card schema from Microsoft that lets apps render structured UI snippets — buttons, text, images — natively inside any host surface, so a tool can push rich, interactive notifications without owning the renderer., with no Azure AD app registration required.

Continuous Scanning triggers a full scan on every meaningful commit to a repository's default branch, including merged pull requests, with follow-up scans closing findings fixed by those commits. It is available on GitHub, GitLab, Bitbucket Cloud, and Bitbucket Server, and is configurable per organization, tag, or repository.

Connecting an integration now requires the Create Integrations or Create Installations permission; adding a repository by URL requires Create Repositories; and creating Jira and Linear tickets now requires a per-repository permission. Existing automations lacking these grants will be refused, and organizations using access control must explicitly grant the ticketing permission or ticket creation will be unavailable.

The repository object's lastScanError field is replaced by lastScanFailure, which carries both the message and the outcome of a failed scan. API clients or integrations still reading lastScanError will receive no value.

Assistant skills are reusable methodology definitions authored from the Skills tab, with four built-in skills for triage, dependency reachability, report writing, and patch review — each forkable into an editable copy.

Approved patches now show pull request submission status — queued, in progress, waiting on retry, or stopped — with Cancel and Retry actions on the issue itself, and up to five automatic submission attempts.

ZeroPath adds CVS module support: it imports modules by server path over SSH or pserver for full scans, scheduled scans, dependency analysis, and secrets scanning.

ZeroPath adds team import from GitHub and Bitbucket — covering Bitbucket Cloud workspace groups and Bitbucket Server project groups — to sync repository permissions and access control.

ZeroPath adds severity labels following CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. rating bands — Critical (9.0+), High (7.0+), Medium (4.0+), Low (0.1+) — applied to existing findings without requiring a rescan.

ZeroPath adds an optional tag and repository scope parameter to monthly, organization summary, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. compliance, and SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. reports, stated on the report cover, and a separate scope control at the top of Supply Chain that narrows every tab to a selected set of repositories, teams, and tags.

Settings now has grouped navigation with Workspace, Security, and Connections sidebar sections; scanner settings expose the same five categories — General, Full scans, Pull requests, Dependencies, Remediation — at organization, tag, and repository scope.

ZeroPath adds Gerrit project support: it imports projects for full scans and scans each open change on new patch sets, posting findings as a review message on the patch set.

The Assistant gains a Plan first mode: it proposes an editable plan before execution and offers to save the approved plan as a schedule, trigger, or playbook.

ZeroPath adds Wiz export support that marks already-resolved dependency findings as resolved in Wiz and sends unassessed findings as new records.

On secret findings, the explanation ZeroPath generates for a dismissal is withheld from API responses; only a reviewer's own note is returned.

Aikido adds new resource to manage default PR checks and new resource to manage PR check settings to the Aikido Terraform provider, alongside the API - Manage defaults PR checks for new repos endpoint to control default PR check configuration for new repos programmatically.

Aikido adds the API - Report export for PCI and DORA compliance endpoint to export compliance reports programmatically, and the API - Listing & handling inbox requests endpoint to manage inbox requests via the API.

Dependabot's GITHUB_TOKEN now automatically requests the packages: read permission and sends that token when pulling from *.pkg.github.com and ghcr.io, removing the need for PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.-based registry entries in dependabot.yml. Dependabot reuses existing Manage Actions access grants on package settings pages to authenticate with private GitHub Packages registries, covering every GitHub Packages ecosystem Dependabot supports.

A new Assign to Copilot bulk action lets you select up to 25 standard Code Quality findings and have Copilot fix them agentically on a branch, validate its own changes, and open a pull request for review. Available for repositories with GitHub Code Quality enabled on GitHub Team and GitHub Enterprise Cloud, including data residency, governed by the existing enterprise GitHub Code Quality policy with no separate policy to manage.

A new required reviewers rule for repository rulesets supports pattern matching on branches, files, and folders, and a configurable minimum number of reviews per team.

Administrators can centrally control sandbox enablement, filesystem and network access, proxy settings, developer-tool access, and macOS Keychain access via managed restrictions that override user settings. Visible under GitHub Copilot > Sandbox when the Editor Preview feature flag is on or a managed setting is configured; currently in public preview.

⤢

The new /ide command in GitHub Copilot CLI (public preview) connects a terminal session to JetBrains IDE context, including selections, diagnostics, and file references. Shell commands can consume IDE terminal environment variables and the project's configured Python interpreter, and can activate the project's local Python virtual environment.

⤢

Repository rulesets now support bypass by individual users, allowing administrators to add specific accounts, such as a service account, to a bypass list without creating a dedicated role or team.

A new unified portal at help.github.com consolidates support, entitlements, docs, learning, community, and account resources into a single entry point, with Copilot-powered search across all portal content available without sign-in, and product status and announcements surfaced directly within the portal.

GitLab Duo Self-Hosted can now register model deployments on Microsoft Foundry using the azure/<deployment-name> model identifier format, supporting GPT, Claude, Llama, and Mistral families served through Azure-hosted endpoints via the AI Gateway. Per-feature model assignment lets admins assign a different deployment (e.g. duo-chat, duo-code-gen, duo-code-completion) to each Duo feature instead of one global model, and Foundry deployments support Microsoft Entra identity, Azure RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., network isolation, and Azure Policy while keeping inference data inside the organization's own Azure tenant.

⤢ ⤢ ⤢ ⤢

New ci_spec_include_own_context feature flag (GitLab 19.4) makes include locations in a CI config file resolve against the repository and ref of the file that declares them, rather than the file that included them.

Fix for SCA analyzes vulnerable dependencies identified in SCA scans and suggests safe upgrade paths. The veracode fix sca CLI command (Limited Availability) generates remediation patches; running Fix for SCA via the CLI requires the --remote flag, which executes in a backend sandbox with full source access for automated CI pipelines, scheduled jobs, and SCM workflows. SCM integration (Fix in SCM) scans a repository, generates patches, and opens merge requests automatically, and GitHub Workflow Integration now also supports Fix for SCA, generating fixes for vulnerable dependencies directly in GitHub.

$ veracode fix --remote

$ veracode fix sca

Azure DevOps Workflow Integration v2.4.3 adds a custom agent pool name parameter in veracode.yml to specify the agent pool used for pipeline execution. The veracode.yml config also supports debug: true for verbose troubleshooting output and analysis_branch to run scheduled scans against a specific branch rather than the repository default.

debug: true

analysis_branch: main-security-scan

The Get Lesson Progress API adds an updatedAfter parameter to support incremental data loads and an excludeNotStarted=true parameter to filter out lessons that have not been started. The response now includes stack and updated_on fields, and surfaces a Not Started status when both start_time and end_time are null.

Adds six new OWASP Top 10:2025 secure coding eLearning courses covering .NET, Java, JavaScript, PHP, Python, and general software security awareness, with captions in English, Spanish, French, Portuguese, and Chinese. Adds the complete OWASP Top 10:2025 Security Labs lab series (A01–A10), including two new categories, A03 Software Supply Chain Failures and A10 Mishandling of Exceptional Conditions. Adds a Container Security in Docker Security Labs lesson track spanning Capabilities, Users, Virtualization, Networking, Resources, Orchestration, and Inventory topics. Adds OWASP API Top 10 2023 Security Labs lessons, upgrading coverage from the 2019 list and adding three new categories (API 6, API 7, API 10) in Java, Node, and .NET. Adds five assessment quiz eLearning courses (User and application setup, Static Analysis, Dynamic Analysis, Scan and fix in your IDE, SCA agent-based scanning — Skills assessment) in English, Portuguese, and Spanish.

The default Security Labs URL has changed from https://securitylabs.veracode.com/ to https://securitylabs.veracode.com/security-labs/; organizations using SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. with the old URL must update their SSO configuration.

GitHub Workflow Integration v2.0.0 enables install, configuration, and credential updates for the GitHub Integration directly from the Veracode Platform, eliminating manual GitHub Marketplace steps; adds autopackaging support for Apex, VB6, and Perl; and adds the ability to schedule Static Analysis, SCA, and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scans for GitHub organizations directly from the Platform. v2.1.1 adds a new uninstallation workflow on the Platform for removing the Veracode app from GitHub organizations.

Fix for SAST provides interactive, in-editor remediation in Eclipse, JetBrains, Visual Studio, and VS Code IDEs, and via the Veracode CLI (Fix in CLI) for both interactive use and automated scripting in CI pipelines. COBOL is now supported, with automated fix suggestions for CWE-78, CWE-209, CWE-248, CWE-489, and CWE-252, available in the CLI and in Visual Studio Code, Visual Studio, and JetBrains IDEs.

Java API Wrapper v26.2.18.0 implements a configurable retry mechanism for the Veracode Platform Applications API (appsec/v1/applications) to handle transient failures, timeouts, and network issues.

33 deprecated eLearning courses (OWASP 2017, OWASP Top 10 2021, Secure Coding for .NET/Java/JavaScript/PHP/Python — 6 courses each, Secure Coding for Python — 3 courses) are no longer available as of June 2026; certification levels have been updated to reference the replacement OWASP Top 10:2025 courses. OWASP Top 10 (2021) Security Labs lessons are also no longer available as of June 2026.

Security Labs user and team management is now integrated into the Veracode Platform, with authentication routed through Veracode IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access.; administrators manage users and teams from the Platform under Security Training. Adds team search capability for Security Labs administrators and managers, and in-app guidance in Security Labs for creating campaigns and using reporting.

--sbom spdx2.3 (also --sbom spdx) writes a timestamped .spdx.json SBOM in SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 2.3 format. Findings attach as SECURITY external references of type advisory, with severity and fix command recorded in a package annotation; package licenses are sourced from the npm lockfile at no network cost, while pnpm, Yarn and Bun dependencies resolve to NOASSERTION. The output emits supplier, filesAnalyzed: false and DEPENDENCY_OF relationships to satisfy all seven NTIA minimum elements.

$ cve-lite /path/to/project --sbom spdx2.3

$ cve-lite . --sbom spdx

$ cve-lite . --sbom spdx

--sbom cyclonedx (alias for the existing --cdx) now emits CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. spec version 1.6 instead of 1.4, using the 1.6 tools.components object form with publisher in place of the deprecated 1.4 array of {vendor, name, version}. This is a breaking change: any CI pipeline or tooling that diffs SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., asserts on specVersion, or parses metadata.tools will need updating.

$ cve-lite . --sbom cyclonedx --sbom-inventory-only

--sbom-inventory-only emits an SBOM without the vulnerability overlay, producing a pure component inventory; it requires --sbom and is intended for diffing, archival and attestation workflows where finding details should not be exposed.

$ cve-lite /path/to/project --sbom spdx --sbom-inventory-only

$ cve-lite . --sbom cyclonedx --sbom-inventory-only

The generic_high_entropy_secret detector no longer reports secrets whose assigned variable ends with checksum, with no loss of recall. The n8n MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Access Token and n8n API Key detectors now recognize hosts given as a container service name or as a scheme-less hostname, and reject unreachable private IP hosts. Recall for HashiCorp Vault AppRole Authentication credentials was also improved.

Adds --emit flag to validate_sample_data.py to generate sample_data values directly from a test extraction image, e.g. python admin/scripts/validate_sample_data.py --emit extraction.zip --key my_test_image.

$ python admin/scripts/validate_sample_data.py --emit extraction.zip --key my_test_image

Adds MMKV decryption support via a vendored mmkv_parser, with correct varint header handling and a new MMKV - Recovered Records artifact.

Scopes TikTok IM, Pitaya, and WatchHistory artifacts to TikTok-owned containers, preventing false matches from files with identical names in other app containers.

Adds 25+ new app parsers including Nest, August/Yale, Google Home, myQ, Samsung Family Hub, Coinbase Wallet, Spotify, TextNow, Zoom chat, Brave, Notion, GETTR, Houseparty, CoverMe, Skout, Private Photo Vault, IFTTT, LG ThinQ, New York Times, GPS Tracks/GPX, and Foursquare Pilgrim.

UAC adds 18 new artifact definitions under files/applications/ai_tools/ covering session data, configuration, and credentials for AI coding tools: amp.yaml, claude_code.yaml (session logs, config, credentials, pre-edit file history, tool results, auto-memory, plans, shell snapshots, hook scripts, IDE lock files), claude_desktop.yaml (transcripts, config, credentials, storage, skill/plugin definitions, app logs), codebuff.yaml, codex.yaml (OpenAI Codex CLI logs, config, auth, SQLite state/thread-history/log DBs with WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites./SHM sidecars, AGENTS.md, rules, shell snapshots, installation_id, excluding tmp/cache), copilot.yaml (OTELOTELAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. usage logs, config, token store, session workspace metadata, plans/checkpoints, session store DB with WAL/SHM, VS Code Copilot Chat transcripts, agent-mode edit snapshots, extension session store), cursor.yaml, droid.yaml, gemini.yaml (chat logs, config, OAuth credentials, TOML commands/policies, GEMINI.md/memory, project root markers, excluding downloaded binaries/shadow git checkpoints/browser profile), goose.yaml, hermes.yaml, kilo.yaml, kimi.yaml, kiro.yaml (global config, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., agents, steering, prompts, skills, sessions, CLI/IDE data), openclaw.yaml, opencode.yaml (session data, config, credentials, SQLite WALSQLite WALA write-ahead logging mode for SQLite databases where changes are written to a separate log file before the main database, allowing concurrent reads during writes and faster commit performance./SHM sidecars, logs, JSONC config, agent/command definitions, state directory, excluding node_modules/cloned repos/snapshots), pi_agent.yaml, and qwen.yaml (OAuth credentials). Most support linux and macos.

$ ./uac -a ./artifacts/files/applications/ai_tools/* -p ir_triage /tmp

Adds files/system/macos_privilegedhelpertools.yaml to collect macOS PrivilegedHelperTools, which may be used for persistence.

$ ./uac -a ./artifacts/files/system/macos_privilegedhelpertools.yaml /tmp

Adds files/system/trash.yaml to collect the entire Trash directory contents on freebsd, linux, macos, netbsd, and openbsd.

$ ./uac -a ./artifacts/files/system/trash.yaml /tmp

Adds live_response/network/rmsock.yaml to identify process ownership for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. network connections, associating PIDs with network activity on AIX systems where lsof is unavailable.

Extends live_response/network/netstat.yaml to include netstat -Aan on aix; extends live_response/process/fstat.yaml to include fstat -n on freebsd, netbsd, netscaler, and openbsd; and extends live_response/process/ps.yaml to include richer ps -eo output with lstart, etime, and pcpu/pmem columns across linux, macos, freebsd, netbsd, netscaler, openbsd, aix, and solaris.

Adds tuning of multiple Logstash pipelines directly in SOC, including exposed log.level and log.format settings.

PolarProxy can run as a local SOCKS and/or HTTP proxy that relays outgoing connections through an upstream proxy via --connect socks4:HOST:PORT or --connect socks5:HOST:PORT (or a plain HOST sinkhole), enabling use cases like decrypting your own HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic before forwarding it through Tor with --connect socks5:127.0.0.1:9050. TLS is decrypted and re-encrypted by default unless --bypass is set, which uses PolarProxy purely as a protocol converter; HTTP proxy mode now decrypts and re-encrypts TLS traffic regardless of port.

$ PolarProxy --socks 1080 --connect socks5:127.0.0.1:9050 --nontls allow --pcapoverip 57012 --writeall

$ PolarProxy --socks 1080 --connect socks5:127.0.0.1:9050 --nontls allow --pcapoverip 57012 --writeall

$ PolarProxy --socks 1080 --connect socks5:127.0.0.1:9050 --nontls allow --pcapoverip 57012 --writeall

Supports uppercase PP_-prefixed environment variables as an alternative to all command-line arguments (e.g. PP_SOCKS mirrors --socks), suited for systemd, Docker, Podman, Kubernetes, and Helm deployments; --helpenv prints all supported variables. Ships a docker-compose.yml for musl builds or a systemd unit file installed via install-polarproxy-service.sh for non-musl Linux builds, both paired with a polarproxy.env configuration file.

# polarproxy.env
PP_SOCKS=1080
PP_PCAPOVERIP=57012
PP_IDLETIMEOUTCLIENT=120
PP_IDLETIMEOUTSERVER=120

$ PolarProxy --helpenv

PP_SOCKS=1080
PP_CONNECT=socks5:127.0.0.1:9050
PP_IDLETIMEOUTCLIENT=120
PP_IDLETIMEOUTSERVER=120
PP_NONTLS=allow

$ PolarProxy --helpenv

Adds --idletimeoutclient <seconds> and --idletimeoutserver <seconds> to close connections idle beyond a configurable period (no timeout by default) on the client and server sides, preventing zombie connections in long-running deployments. Adds --tlstimeout <seconds> (default 30 s) for a dedicated TLS-handshake deadline, complementing the existing --timeout <seconds> TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it.-handshake flag.

$ PolarProxy --socks 1080 --tlstimeout 10 --idletimeoutserver 120 --idletimeoutclient 120

$ PolarProxy --socks 1080 --idletimeoutclient 120 --idletimeoutserver 300

$ polarproxy --idletimeoutclient 60 --idletimeoutserver 120

Adds --log-file to write logs to a file, with automatic rotation when the active log reaches --log-max-size MiB (default: 100 MiB); rotated logs are timestamped and stored beside the active log. Adds --log-compress to gzip-compress rotated archives (default: true), --log-max-age to prune archives older than a given number of days (default: 14; 0 disables age pruning), and --log-max-backups to cap the number of retained archives (default: 20; 0 disables count pruning).

$ azurehound start --log-file /var/log/azurehound/azurehound.log --log-max-size 50 --log-max-backups 30 --log-max-age 7 --log-compress

A new guide documents using Cloudsmith as a pull-through cache for Chainguard Free containers, by setting the upstream Proxy URL to https://cgr.dev/chainguard with Mode set to Cache and Proxy, and for Chainguard Production containers by setting Proxy URL to https://cgr.dev/ and authenticating with a pull token generated via chainctl auth configure-docker --pull-token. A new --ttl flag on that command controls pull token lifetime (e.g. --ttl=24h; default 30 days), and Production images can then be pulled via docker.cloudsmith.io/<cloudsmith-organization>/<cloudsmith-repository>/<chainguard-registry>/IMAGE.

$ chainctl auth configure-docker --pull-token --ttl=168h

$ docker pull docker.cloudsmith.io/chainguard-example/chainguard-private/chainguard.edu/python:3.9-dev

Introduces Chainguard Catalog Starter, a free standalone plan letting teams choose and pull up to five non-FIPS container images (including dependent Helm charts) without a paid subscription, pullable through third-party registries such as JFrog Artifactory and usable in CI/CD. New chainctl starter init, chainctl starter request-access, chainctl starter add-images, and chainctl starter status commands handle signup, joining an org, selecting images, and checking registry path, provisioning status, and quota usage; users are assigned the limited_owner role granting Console browsing, image pulling, and pull token creation.

$ chainctl starter init

$ chainctl starter add-images python nginx

$ chainctl starter status

Adds Go 1.27 support to the go and go-fips container images, and introduces a new go-openssl-fips image that selects its FIPS-validated cryptographic module at deployment time rather than compile time — letting one artifact satisfy both the OpenSSL FIPS provider and Go Cryptographic Module requirements, with CNSA 2.0 readiness, without recompilation. Go 1.26 and earlier remain supported until end-of-life.

$ FROM cgr.dev/chainguard/go-openssl-fips:latest AS build
RUN go build -o /app ./...

FROM cgr.dev/chainguard/go-openssl-fips:latest
COPY --from=build /app /app
ENTRYPOINT ["/app"]

The --kube-contexts fleet mode in kubescape scan now supports framework, control, and workload scan targets across multiple clusters, not just full scans. Kubescape also adds cross-cluster control matrix and fleet report types to aggregate posture across a fleet of clusters.

$ kubescape scan framework nsa --kube-contexts cluster-prod,cluster-staging,cluster-dev