The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
Collect a dossier on a person by username from 3000+ sites
Maigret v0.6.2 adds keyword filtering, Neo4j Cypher export, ORCID support, FlareSolverr bypass, and a threaded DNS fallback.
└──▷ GET THIS VERSION
$ git clone --branch v0.6.2 https://github.com/soxoj/maigret.git
# already have the repo? check out this version:$ git checkout v0.6.2
└──▷ TRY IT
Narrow a username search to profiles that mention specific keywords — useful for confirming identity across common-name accounts.
$ maigret johndoe --keywords hacker,security
Export OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. findings directly into Neo4j for graph-based link analysis across discovered accounts.
$ maigret johndoe --neo4j
Switch to the threaded DNS resolver when aiodns failures are causing sites to be skipped on your network.
$ maigret johndoe --dns-resolver threaded
Adds --keywords flag to filter results by matching keywords found in profile pages.
Adds --neo4j flag to export search results as a Neo4j Cypher file for graph database ingestion.
Adds ORCID as a supported site for academic researcher identity lookups.
Adds FlareSolverr integration in the web UI to bypass Cloudflare challenges.
Adds --dns-resolver threaded fallback option to recover from aiodns DNS resolution failures.
+4 moreshow less
Adds Tor site entries for Whonix Forum and Stacker News, expanding .onion coverage.
Adds archive.org and archive.is links to profile URL blocks in reports.
Makes --include-tag site filter case-insensitive, matching the existing --exclude-tag behavior.
Improves graceful Ctrl+C handling: first interrupt preserves partial results and generates reports; second interrupt exits cleanly with code 130.
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
v3.11.0 requires digital signatures on all custom JavaScript-protocol templates before Nuclei will load them.
└──▷ GET THIS VERSION
$ git clone --branch v3.11.0 https://github.com/projectdiscovery/nuclei.git
# already have the repo? check out this version:$ git checkout v3.11.0
└──▷ TRY IT
Sign a custom JavaScript-protocol template so it is accepted by Nuclei v3.11.0+ before running it against a target.
$ nuclei -sign-t /path/to/your-template.yaml
Breaking change: Custom templates using the javascript: protocol must now be digitally signed; unsigned JavaScript templates are skipped at load time and when referenced from workflows.
Enforces signature verification for JavaScript templates, extending the code-protocol signing requirement to the JavaScript protocol and its Go-backed runtime modules.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Custom templates that use the javascript: protocol must be digitally signed before Nuclei will load or execute them; unsigned JavaScript templates are skipped during template loading and when referenced from workflows.
Open-source and cloud-native Web Application Firewall (WAF)
BunkerWeb v1.6.12 adds upstream TLS verification, per-path mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with., a full logs viewer overhaul, and tightened API token security.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.12 https://github.com/bunkerity/bunkerweb.git
# already have the repo? check out this version:$ git checkout v1.6.12
└──▷ USE IT
Enforce TLS verification when BunkerWeb proxies to an internal HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. backend, supplying a custom CA bundle.
Require mTLS only on sensitive API paths while leaving public endpoints unaffected.
ini
MTLS_URL_1=^/api/admin.*
Cap scheduler thread-pool workers to limit database connection pressure in high-traffic deployments.
ini
SCHEDULER_MAX_WORKERS=4
Adds upstream HTTPS certificate verification for reverse proxy via REVERSE_PROXY_SSL_VERIFY, REVERSE_PROXY_SSL_VERIFY_DEPTH, REVERSE_PROXY_SSL_TRUSTED_CERTIFICATE, REVERSE_PROXY_SSL_TRUSTED_CERTIFICATE_DATA, and REVERSE_PROXY_SSL_TRUSTED_CERTIFICATE_PRIORITY settings.
Adds MTLS_URL_n regex setting to enforce mTLS selectively per path rather than site-wide.
Adds SCHEDULER_MAX_WORKERS to cap the job-executor thread pool and reduce database pool pressure under load.
Extends ANTIBOT_IGNORE_URI to match full request URIs including query strings.
Supports pre-hashed bcryptbcryptA deliberately slow password-hashing function, so a stolen password database takes far longer to crack by guessing. Argon2 and scrypt are newer alternatives built on the same idea. values for ADMIN_PASSWORD, enabling secret-manager and GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. workflows.
+7 moreshow less
Hardens Biscuit API token generation by binding Host header, client IP, and username as typed terms; adds optional API_ALLOWED_HOSTS allowlist.
Adds API_ACL_BOOTSTRAP_FILE bcrypt hash validation, rejecting weak or malformed values on startup.
Overhauls the UI logs viewer with syntax highlighting, severity filters with counts, in-page search, live-tail with pause, download/copy actions, local-time display, and collapsible multi-line entries.
Adds fold support for multi-line file settings (e.g., PEM certificates and keys) in the RAW config editor.
Improves BunkerNet UI status reporting with Connected / API unreachable / Not registered states, masked instance ID, and disk self-heal.
Adds Ubuntu 26.04 Resolute Raccoon as a supported Linux package target.
Updates ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. to 3.0.16 and Core Rule Set to 4.27.0.
Dalfox is a powerful open-source XSS scanner and utility focused on automation.
Dalfox v3.1.1 unifies server/MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. scan target params, consolidates debug logging, and bounds request fan-out for safer large scans.
└──▷ GET THIS VERSION
$ git clone --branch v3.1.1 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:$ git checkout v3.1.1
└──▷ TRY IT
Pipe a HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session. capture through dalfox using an explicit input type — now correctly honoured by the pipe subcommand after the parity fix.
$ cat capture.har | dalfox pipe -i har --output results.json
Debug a scan against a REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. server using the unified target parameter (replacing the old url field for server/MCP calls).
Unifies scan target parameter: Server and MCP modes now accept target (REST retains url as a backward-compatible alias).
Consolidates all debug output through a single stderr dbg_log! macro, keeping JSON/JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory./SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. stdout clean under --debug.
Aligns OOB/blind XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. lifecycle messages with the standard timestamped log format (INF/WRN/OOB), making output consistent across scan modes.
Per-parameter payload safety cap and recall-preserving DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime.-phase early-exit bound request fan-out, preventing runaway HTTP requests on wide parameter sets.
Bounds unbounded task spawning in parameter mining and cuts server hot-path lock-hold and allocations, improving reliability under load.
5 details in Everything
1 more release in this issue
· 2026-06-14 → 2026-06-21
Dalfox v3.1.0 adds blind/OOB XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session. input, external JS analysis, CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks./Trusted Types payloads, and a global rate limiter.
└──▷ GET THIS VERSION
$ git clone --branch v3.1.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:$ git checkout v3.1.0
└──▷ TRY IT
Detect stored/async XSS in a target that never reflects payloads back — catch blind execution via an interactsh OOB callback.
Replay every request captured in a proxy session (Burp/Caido/ZAP) as a scan source, feeding all recorded targets at once.
$ dalfox scan export.har --input-type har --output json -o results.json
Cap aggregate outbound rate to 20 RPS across all workers while also pulling in external JS bundles for DOM-XSSDOM-XSSA cross-site scripting vulnerability where malicious JavaScript executes entirely in the browser by manipulating the DOM, never touching the server, making it invisible to server-side input filters. analysis — useful for rate-sensitive bug-bounty targets.
Adds --blind-oob for out-of-band (OASTOASTOut-of-band Application Security Testing: a technique for detecting vulnerabilities by having a target system make DNS or HTTP callbacks to an attacker-controlled server, revealing flaws that produce no visible in-band response.) XSS detection via interactsh, catching stored and async sinks that never reflect.
Adds --input-type har to accept HAR exports from Burp, Caido, ZAP, mitmproxy, or DevTools as a scan source.
Adds --analyze-external-js to fetch and run ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text.DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime.-XSS analysis on a target's same-origin <script src> bundles (capped at 16 files / 512 KiB).
Adds --detect-outdated-libs (opt-in) to flag known-vulnerable front-end library versions as informational findings.
Adds CSP & Trusted Types awareness: emits strict-dynamic / nonce gadget payloads and adapts when a Trusted Types policy is detected.
+9 moreshow less
Adds filter-aware payload synthesis that computes exact JS breakout sequences from the observed script prefix, including escaped-quote and nested-context cases.
Adds four attribute-decode WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server.-bypass mutations (KeywordEntityEncode, SchemeBreak, EntityScheme, MultiSlash) exploiting HTML tokenizer entity decoding.
Adds size-limited WAF inspection-window bypass: detects WAFs that inspect only the first N bytes and positions payloads past the inspection window.
Adds global rate limiting via --rate-limit / -r / --rl (requests-per-second token bucket, 0 = unlimited) shared across all workers and targets.
Adds --retries / --retry-delay for optional exponential-backoff retries on HTTP 5xx and transient errors (HTTP 429 is always retried).
Adds --insecure TLS flag to make certificate validation configurable for scan, server, and mcp modes.
Adds scan_timeout whole-scan budget for server and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. modes to bound total duration of concurrent async jobs.
Extends DOM-XSS sink coverage to include Document.parseHTMLUnsafe() and window.open().
Structured outputStructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. metadata (version, targets, duration, request/finding counts, per-target WAF info) now included in SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface., Markdown, and TOML formats.
A Kubernetes controller and tool for one-way encrypted Secrets
Helm chart v2.19.0 adds ppc64le support, default Prometheus alerting rules for out-of-sync secrets, and tightened pod security defaults.
└──▷ GET THIS VERSION
$ git clone --branch helm-v2.19.0 https://github.com/bitnami/sealed-secrets.git
# already have the repo? check out this version:$ git checkout helm-v2.19.0
Adds ppc64le architecture support, enabling Sealed Secrets controller deployment on IBM POWER clusters.
Adds default PrometheusRule to the Helm chart that alerts when SealedSecrets are out of sync with their unsealed counterparts.
Updates security context defaults to comply with the Kubernetes restricted pod security standard profile.
UNIX-like reverse engineering framework and command-line toolset
Radare2 6.1.8 adds JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. decoding, new demanglers, type-lookup commands, FTAB/idd/R_DYLDCACHE_NO_DEPS, ESIL stepback, and PPC ESIL coverage.
└──▷ GET THIS VERSION
$ git clone --branch 6.1.8 https://github.com/radareorg/radare2.git
# already have the repo? check out this version:$ git checkout 6.1.8
└──▷ TRY IT
Decode a JWT token found in a binary at the current seek position to inspect its header and claims.
$ r2 /path/to/binary
> s <address_of_jwt>
> pFJ
Look up which struct in the type database matches a known size (e.g., 16 bytes) — useful when reversing packed structures with no symbols.
$ r2 /bin/ls
> aaa
> tsn 16
Resolve an unknown numeric constant to its enum name to understand protocol or syscall values at a glance.
$ r2 /bin/ls
> aaa
> ten 3
Adds pFJ command for JWT token decoding in the print subsystem.
Adds CLd command for source-baked decompiler output.
Adds tsn command to look up struct names by size.
Adds ten command for enum lookup by numeric value.
Adds idd command for binary info inspection.
+19 moreshow less
Adds R_DYLDCACHE_NO_DEPS option for shallow (dependency-filtered) dyldcache loading.
Adds FTAB extractor plugin for new binary format support.
Adds Rust, D, IBM XL, ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. ABI, and new C++ demangler support in the binary loader.
Adds r2vsql to the fallback command handler in the shell.
Adds ldmap.r2.js script to load source-line info from ldscript map files.
Adds a Pebble script for stub scans and ships PebbleOS syscall tables.
Supports hexdump/disasm address display in octal base.
Unifies asm.addr.base10/asm.addr.base36 into a single asm.addr.base config option (breaking change).
Extends all p-/p= commands with JSON output and improved bounds handling.
Renders array stack variable element accesses as name[i] in disassembly.
Adds ESIL lifecycle and stepback support in core ESIL stepping.
Adds ESIL modeling for PPC scalar floating-point load/store/arithmetic/convert ops.
Adds ESIL for PPC integer/logical/rotate/mod ops and the isel conditional-select instruction.
Models PPC XER.CA ESIL for add/subtract-with-carry and algebraic shift-right.
Supports union offsets in type member lookup.
Adds inline markdown codeblock/span rendering and table trim with ellipsis.
Adds Nix flakeNix flakeA Nix packaging construct that pins all dependencies in a lockfile and exposes a standardized interface, giving cyber tools fully reproducible builds across any machine running the Nix package manager. and dev shell support under dist/nix.
Exposes addrline DWARF info in the r2 virtual filesystem.
Ports r2preload to Windows.
24 details in Everything
└──▷ BREAKING ON UPGRADE
!The sdb_remove function has been deprecated as a duplicate of sdb_unset
!The asm.addr.base10 and asm.addr.base36 config keys are unified into asm.addr.base
!The esil.verbose config key has been removed
!The default CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. for AVR is now ATxmega128a4u
Rspamd 4.1.1 adds pluggable Neural registries, richer CSS text-hiding detection, zip-bomb limits, and new byte-analysis APIs.
└──▷ GET THIS VERSION
$ git clone --branch 4.1.1 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:$ git checkout 4.1.1
Adds pluggable feature-provider and ANN-architecture registries to the Neural module, plus a sequence output mode with SIF word selection for fasttext_embed, multi-head attention pooling in kann, and slice/concat graph transforms in lua_kann.
Enables content-negotiation in checkv3 — representation and compression now negotiated via Accept/Accept-Encoding headers.
Expands CSS text-hiding detection to cover off-screen positioning, clip, negative text-indent, and tiny fonts.
Adds opt-in zip-bomb extraction limits (size, count, ratio) to lua_archive to bound archive expansion.
New byte-distribution statistics methods in lua_text: entropy, byte mean/deviation, serial correlation, and Monte-Carlo Pi.
+2 moreshow less
Exposes a zlib/YARA-compatible CRC32 on rspamd_text, rspamd_util, and cryptobox hash objects.
Adds an explicit SOM (start-of-match) flag to the Multipattern engine.
Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.
Prowler 5.32.0 adds Kingfisher secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it., Azure resource-group scoping, Okta throttling, AWS resource caps, Neptune graph sink, and 6 new checks.
└──▷ GET THIS VERSION
$ git clone --branch 5.32.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:$ git checkout 5.32.0
└──▷ TRY IT
Validate discovered secrets against live provider APIs so only working credentials are flagged critical — useful in CI to triage real leaks from noise.
$ prowler aws --scan-secrets-validate
Scope an Azure assessment to specific teams' resource groups to cut scan time and limit result scope during a targeted review.
New secret-scanning engine: replaces detect-secrets with Kingfisher, runs fully offline, suppresses placeholder false positives, and adds --scan-secrets-validate / aws.secrets_validate for live credential verification (confirmed live secrets reported as critical).
Azure scans now support --azure-resource-group / --azure-resource-groups to scope assessments to one or more resource groups instead of the entire subscription.
Okta provider adds configurable API request throttling (--okta-requests-per-second, default 4 req/s) and retry cap (--okta-retries-max-attempts, default 5) to survive rate limits on large tenant scans.
AWS scans can now cap the number of resources analyzed per high-volume service via max_scanned_resources_per_service (global) or per-service limits: max_ebs_snapshots, max_backup_recovery_points, max_cloudwatch_log_groups, max_lambda_functions, max_ecs_task_definitions, max_codeartifact_packages.
Attack Paths gains AWS Neptune as a persistent graph sink alongside Neo4j, selectable via ATTACK_PATHS_SINK_DATABASE=neptune, enabling managed, larger-scale cross-provider graph storage.
+13 moreshow less
New AWS check stepfunctions_statemachine_encrypted_with_cmk: flags Step Functions state machines not using a customer-managed KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. key.
New AWS check waf_regional_webacl_logging_enabled: flags AWS WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. Classic Regional Web ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. without Kinesis Data Firehose logging.
New AWS check apigateway_restapi_no_secrets_in_stage_variables: scans API Gateway REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. stage variables for hardcoded passwords, API keys, and tokens.
New AWS check s3_bucket_object_public: spot-checks object ACLs for public grants (AllUsers/AuthenticatedUsers); opt in via s3_bucket_object_public_enabled config option.
awslambda_function_no_secrets_in_code adds secrets_ignore_files audit-config option to skip files by glob pattern (e.g. *.deps.json), suppressing .NET dependency-manifest false positives.
IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. privilege-escalation checks now cover AWS Bedrock AgentCore paths (Runtime, Harness, Code Interpreter, Custom Browser).
New Microsoft 365 Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. checks: entra_conditional_access_policy_explicitly_targets_azure_devops and entra_conditional_access_policy_no_exclusion_gaps, plus Entra Conditional Access group management restriction check.
Compliance frameworks can now declare ConfigRequirements on a requirement, marking it FAIL when mapped checks ran under a configuration too permissive to satisfy it — reflected in CSV, OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work., and console outputs.
New compliance frameworks added: CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. 7.0 for AWS, CIS 7.0 for M365, CIS 6.0 for Azure, CIS 5.0 for GCP, CIS Controls v8.1 universal framework, CIS 1.2 for GitHub, CIS 2.0.1 for Kubernetes.
GitHub branch-protection checks now evaluate repository rulesets in addition to branch protection rules.
API /api/v1/findings endpoint accepts full ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 8601 timestamps on filter[inserted_at__gte], filter[inserted_at__lte], filter[updated_at__gte], and filter[updated_at__lte] filters for precise time-window queries.
Prowler Cloud/Enterprise: Scan Configuration management page enables named, reusable YAML scan configs validated against a per-provider schema and attachable to one or more providers.
Prowler Cloud/Enterprise: Provider Group Filter scopes the Overview, Findings, Resources, Scans, and Providers views to a team or environment in a single click.
18 details in Everything
└──▷ BREAKING ON UPGRADE
!The detect_secrets_plugins configuration option has been removed, as it is no longer used by the new secret-scanning engine (Kingfisher).
2 more releases in this issue
· 2026-06-11 → 2026-07-02
Prowler 5.31.0 adds Linode provider, post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. AWS checks, DORA coverage for Azure/GCP/Cloudflare/Alibaba, and 30+ new checks across AWS, Azure, GCP, K8s, and M365.
└──▷ GET THIS VERSION
$ git clone --branch 5.31.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:$ git checkout 5.31.0
└──▷ TRY IT
Scan a Linode account for security misconfigurations across administration, compute, and networking services.
$ prowler linode
Run all post-quantum cryptographypost-quantum cryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. readiness checks against your AWS environment to identify gaps before the quantum migration deadline.
Assess your AWS or Azure environment against the DORA regulatory framework to produce an EU Digital Operational Resilience Act compliance report.
$ prowler aws --compliance DORA_2022_2554
New linode provider: scans Linode (Akamai Cloud) administration, compute, and networking services via prowler linode.
New AWS post-quantum cryptography checks: cloudfront_distributions_pqc_tls_enabled, apigateway_domain_name_pqc_tls_enabled, transfer_server_pqc_ssh_kex_enabled, acmpca_certificate_authority_pqc_key_algorithm (new acmpca service), and rolesanywhere_trust_anchor_pqc_pki (new rolesanywhere service).
New AWS org-wide governance checks: securityhub_delegated_admin_enabled_all_regions and config_delegated_admin_and_org_aggregator_all_regions.
New AWS ML check: sagemaker_clarify_exists verifies at least one SageMaker Clarify processing job exists per region.
Extends DORA (EU 2022/2554) compliance framework coverage to Azure, GCP, Cloudflare, and Alibaba Cloud under the DORA_2022_2554 framework identifier.
+9 moreshow less
New Azure checks across Cosmos DB (automatic failover, continuous backup, TLS 1.2, public access disabled), MySQL/PostgreSQL Flexible Servers (geo-redundant backup, HA), AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. (auto-upgrade, Container Insights, local accounts disabled, Defender), Databricks (public access, secure connectivity), Defender CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. Standard tier, NSG subnet association, DDoSDDoSDistributed Denial of Service: an attack that floods a target system with traffic from many sources simultaneously, exhausting its resources so legitimate requests cannot be served.VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. protection, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. credential expiry and strong auth, and Recovery Services vaults.
New GCP checks: cloudsql_instance_high_availability_enabled, cloudfunction_function_inside_vpc, cloudfunction_function_not_publicly_accessible, secretmanager_secret_not_publicly_accessible, and secretmanager_secret_rotation_enabled.
New Kubernetes checks for CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./memory limits and requests, fixed image tags, liveness probes, and readiness probes.
New M365 checks: entra_directory_sync_object_takeover_blocked and entra_conditional_access_policy_no_deleted_object_references.
New OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. check: identity_storage_service_level_admins_scoped (CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. 3.1 control 1.15) ensuring storage admins exclude delete permissions.
Prowler SDK now supports Python 3.13.
Optional SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties.userType attribute: when absent or blank, Prowler preserves existing user roles instead of applying a fallback role.
Prowler Cloud: flexible per-provider scan scheduling with Daily, Every 48 hours, Weekly, or Monthly cadences configurable from the Providers page.
Prowler Cloud: guided onboarding experience for new accounts with contextual empty states throughout the product.
Prowler 5.30 adds full Okta DISA STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. coverage, a universal DORA compliance framework, 8 new checks across AWS/M365/GCP/StackIT, and self-healing background task recovery.
└──▷ GET THIS VERSION
$ git clone --branch 5.30.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:$ git checkout 5.30.0
└──▷ TRY IT
Run all Okta DISA STIG V1R2 checks against your Okta tenant to assess compliance posture end-to-end.
Assess your AWS environment against DORA's five operational resilience pillars and export results in OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. format for ingestion into a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
$ prowler aws --compliance dora_aws -M json-ocsf
Run the new ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy. and SageMaker checks in isolation to validate specific FSBP and AI workload controls without a full scan.
Adds complete DISA Okta IDaaS STIG V1R2 framework coverage for the Okta provider, spanning six new services: user, authenticator, idp, network, apitoken, and systemlog with 17 new checks covering account inactivity, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. hardening, password policy, smart card, API token privilege, network zone enforcement, and log streaming.
Introduces DORA (Digital Operational Resilience Act) as Prowler's first universal compliance framework — defined once and mapped across providers — currently covering AWS checks across the five DORA pillars and exportable in OCSF Compliance Finding format for SIEM ingestion.
New AWS check sagemaker_models_monitor_enabled verifies each SageMaker monitoring schedule is in the Scheduled state to detect data and model drift.
New AWS check elbv2_alb_drop_invalid_header_fields_enabled verifies Application Load Balancers drop invalid HTTP header fields to mitigate HTTP desyncHTTP desyncAn attack technique that exploits disagreements between a front-end proxy and a back-end server about where one HTTP request ends and the next begins, letting an attacker poison the request queue and hijack other users' traffic. attacks (AWS FSBP ELB.4).
New AWS check bedrock_agent_role_least_privilege verifies Bedrock Agents run with a least-privilege IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role.
+8 moreshow less
New M365 check entra_service_principal_privileged_role_no_owners flags privileged service principals with no assigned owners.
New M365 check exchange_mailbox_primary_smtp_custom_domain verifies mailbox primary SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. addresses use a custom domain.
Splits GCP kms_key_rotation_enabled into two focused checks: one for rotation being enabled and one enforcing a maximum 90-day rotation period.
New StackIT objectstorage service adds three checks: objectstorage_bucket_object_lock_enabled (WORM protection), objectstorage_bucket_retention_policy (default retention enforcement), and objectstorage_access_key_expiration (credential expiry).
Adds support for external/custom providers, checks, and compliance frameworks without modifying core Prowler code, including discovery of external universal compliance frameworks via entry points.
Enables opt-in self-healing background task recovery via DJANGO_TASK_RECOVERY_ENABLED; safe-to-retry tasks (report summaries, cleanups) auto-resume after worker crashes while scan tasks are never blindly re-run.
Adds reconcile_orphan_tasks Django management command for on-demand recovery of orphaned background tasks.
Labels Postgres connections with application_name="<component>:<alias>" (configurable via DJANGO_APP_COMPONENT) for per-component attributability in pg_stat_activity.
Fleet v4.88.0 adds support for personal (BYODBYODBring Your Own Device: a policy allowing employees to use personal phones, laptops, or tablets for work, creating a network of unmanaged endpoints that cyber tools must monitor or enforce policy on.) Apple MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. enrollment with per-host wipe/lock permission controls.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.88.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.88.0
1 more release in this issue
· 2026-06-20 → 2026-07-02
Fleet 4.87.0 adds 963 new managed apps, Android MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. commands, Apple Business rebranding, GCS IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. auth, and a command palette.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.87.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.87.0
└──▷ USE IT
Authenticate Fleet's software-installer storage to GCS using workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. (ADC) instead of managing HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. keys — useful in GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. or environments with Workload Identity Federation.
yaml
s3_software_installers_gcs_iam_auth: true
Temporarily enable 100% trace sampling on a specific Fleet replica for a debug window without a restart.
Target a configuration profile to hosts matching a label set while explicitly excluding hosts in a separate label group — combining include and exclude filters in a single profile upload.
Adds 236 new Fleet-maintained apps for Windows, including Microsoft Office, PowerShell, PowerToys, Power BI, Git, Node.js, Python 3.13/3.14, PostgreSQL 15–18, Nessus Agent, Bitwarden, and more.
Adds 727 new Fleet-maintained apps for macOS, spanning development, security, productivity, and design tooling.
Supports issuing Lock, Wipe, and Clear Passcode MDM commands to Android hosts; Wipe is available to Fleet Free users for company-owned Android devices.
Enables deploying custom OS update configuration profiles for Apple and Windows hosts.
Adds GCS IAM authentication (via Google Application Default Credentials) for software installers S3 storage, configurable via s3_software_installers_gcs_iam_auth.
+19 moreshow less
Adds GCS IAM authentication for file carving S3 storage, configurable via s3_carves_gcs_iam_auth.
Supports validating Microsoft Entra v2 access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. during Windows MDM enrollment for applications created after July 1, 2026.
Renames Apple Business Manager (ABM) to Apple Business (AB) across the API (/api/v1/fleet/ab_tokens, /api/v1/fleet/mdm/apple/ab_public_key), GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. YAML (mdm.apple_business), and CLI (fleetctl get mdm-ab / fleetctl generate mdm-ab); old aliases still work with a deprecation warning.
Adds labels_exclude_any combined filtering with labels_include_all or labels_include_any for MDM configuration profile targeting.
Adds a Continuous option to policy automations that re-runs script and software automations on every subsequent policy failure.
Adds Self-service categories page (Premium) under Software > Library for managing custom categories per fleet.
Adds Install all (n) button per self-service category on the My device page, posting to /device/{token}/software/install_all?category_id=:id.
Adds macos_applications filter for the host software list.
Introduces Fleet Spotlight — a command palette opened with Command+K / Control+K for navigating the Fleet UI.
Adds route-aware head sampling for OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. trace export, with configurable ratios via GET/PATCH /debug/trace_sampler at runtime.
Reduces Windows MDM device management poll interval from 1 minute to 8 hours for hosts running fleetd 1.57.0+, with on-demand wake for near-real-time command delivery.
Adds Technician role ability to transfer hosts between fleets (Premium) via the Fleet UI and REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
Adds support for configuring an optional SES sender domain.
Adds end-user account type configuration options: standard for a non-admin user or none to skip end-user account creation.
Surfaces continuous_automations_enabled in GitOps YAML (readable and generated by fleetctl generate-gitops).
Hardens in-house iOS app distribution with a per-install token in manifest and package download URLs, valid for 6 hours and bound to the target host.
Adds each platform's percentage of total enrolled hosts to the Hosts enrolled card tooltip on the dashboard.
Rejects Windows MDM configuration profiles that lack at least one supported SyncML top-level element (<Replace>, <Add>, <Exec>, <Atomic>) or contain invalid <LocURI> values at upload time.
Raises the default FLEET_REDIS_HOST_CACHE_TTL from 60s to 180s and removes reverse-index GETs on host-update invalidation, reducing DB reader load and Redis CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage.
Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices
Vuls v0.39.3 switches Windows CVE detection to the vuls2 backend and expands EOL coverage for new OS versions.
└──▷ GET THIS VERSION
$ git clone --branch v0.39.3 https://github.com/future-architect/vuls.git
# already have the repo? check out this version:$ git checkout v0.39.3
Switches Windows KB-based CVE detection from gost to the vuls2 backend, now reading vuls.db built from microsoft-* sources (breaking change: gost is no longer used for Windows; a vuls.db containing microsoft-* data is required).
Surfaces MSRC Exploit Status under CveContent.Optional["exploit"] for Windows detections, maintaining parity with the previous gost output.
Adds EOL data for newly released OS versions via updated GetEOL configuration.
An open source, self-hosted implementation of the Tailscale control server
Headscale v0.29.0 adds SSH check-mode auth, policy tests, grants, Taildrive, nodeAttrs, and HA subnet router health probing.
└──▷ GET THIS VERSION
$ git clone --branch v0.29.0 https://github.com/juanfont/headscale.git
# already have the repo? check out this version:$ git checkout v0.29.0
└──▷ TRY IT
Approve a pending SSH check-mode or web auth request identified in server logs, granting the user access without re-keying.
$ headscale auth approve --auth-id <id>
Validate a policy file's tests and sshTests blocks before pushing it live, catching reachability regressions without affecting running nodes.
$ headscale policy check
New headscale auth CLI command group: approve, reject, and register subcommands manage SSH check-mode and web auth approval flows.
Supports Tailscale SSH "action": "check" rules, prompting OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. or CLI approval before granting SSH access to a node.
Evaluates the tests block in policy files (beta), asserting reachability between sources and destinations; failing tests block writes before they are applied.
Evaluates the sshTests block in policy files (beta), asserting SSH reachability with accept, deny, and check user lists per source/destination pair.
Adds support for Tailscale Grants (grants block in policy), enabling application-level controls like Taildrive file sharing and traffic steering via tagged subnet routers or exit nodes.
+12 moreshow less
Introduces autogroup:danger-all as a source-only ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. target resolving to all IPs (0.0.0.0/0 and ::/0), replacing the prior behavior of wildcard *.
New nodeAttrs policy block distributes Tailscale node capabilities (e.g., disable-captive-portal-detection, nextdns:<profile>, drive:share, drive:access) to matched nodes.
Adds randomizeClientPort as a top-level policy file field (replaces removed randomize_client_port server-config key).
New auto_update.enabled config option sets the tailnet-wide default for client auto-update via CapMap.
Taildrive file-sync is now configurable through policy using drive:share, drive:access nodeAttrs and tailscale.com/cap/drive grants.
Hostname sanitisation now uses Tailscale's MagicDNS rules, supporting hostnames with apostrophes, special characters, and non-ASCII characters.
GivenName collision suffix changed from random 8-char hash to monotonic numeric suffix (laptop, laptop-1, laptop-2, …), matching Tailscale SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally..
BREAKING: proto:icmp now covers only ICMPv4; use proto:ipv6-icmp or protocol 58 for ICMPv6.
BREAKING: autogroup:self destinations now reject tags, hosts, and IPs as sources, matching Tailscale validation.
BREAKING: Headscale enforces a strict sequential upgrade path — skipping minor versions (e.g., 0.27 → 0.29) and downgrading are blocked.
BREAKING: randomize_client_port server-config key removed; headscale refuses to start if the old key is present — move it to the policy file.
Raises minimum supported Tailscale client version to v1.80.0.
17 details in Everything
└──▷ BREAKING ON UPGRADE
!MagicDNS GivenName collision suffix changed from 8-char random hash (laptop-abc12xyz) to monotonic numeric suffix (laptop, laptop-1, laptop-2, …); MagicDNS names change on upgrade for any node whose previous label was a random-suffix form
!Empty or all-non-ASCII hostnames now fall back to the literal node instead of invalid-<rand>
!Wildcard (*) in ACL sources and destinations now resolves to the Tailscale CGNAT range (100.64.0.0/10) and ULA range (fd7a:115c:a1e0::/48) instead of all IPs (0.0.0.0/0 and ::/0); policies relying on * to match all IP addresses must switch to autogroup:danger-all (source only) or explicit CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges (destinations)
!Policies using tags, hosts, or IP addresses as sources for autogroup:self destinations now fail validation
!proto:icmp now only includes ICMPv4 (protocol 1); ICMPv6 must be specified explicitly as proto:ipv6-icmp or protocol number 58
!Skipping minor versions (e.g. 0.27 → 0.29) is blocked; upgrades must proceed one minor version at a time, and downgrading to a previous minor version is blocked
!The randomize_client_port server-config key was removed; headscale refuses to start when the old key is present — the toggle must be moved to the policy file as the top-level randomizeClientPort field
!Minimum supported Tailscale client version is now v1.80.0
Inspect full public keys of all peers when diagnosing connectivity — useful when truncated keys are ambiguous.
$ sudo innernet --verbose list <interface>
Manually pin a peer's advertised endpoint (e.g. behind a NAT or load balancer) so other peers connect to the correct address.
$ sudo innernet override-endpoint <interface>
Adds --host-suffix CLI option to client and server to override the default <interface>.wg hostname suffix.
Adds override-endpoint command to the client, enabling manual peer endpoint specification without going through the server.
Prints full WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. public keys (instead of truncated 10-char versions) when the global --verbose flag is used.
Introduces new innernet-client-core Rust library crate exposing create_peer_and_invitation(), set_listen_port, redeem_invite, and fetch APIs for programmatic integration.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The Rust libraries innernet-client-core, innernet-server, and innernet-shared have semver-incompatible API changes requiring a major version bump for consumers of these crates
Windsurf is an AI-powered code editor that helps developers write, edit, and navigate code faster using intelligent autocomplete and agentic AI assistance.
└──▷ TRY IT
Check the live status of all connected MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers mid-session to verify tool availability before delegating a task.
$ /mcp
Review current ACU consumption without leaving the chat interface — useful for tracking usage against quota during a long autonomous session.
$ /usage
Edits produced in autonomous (Devin Local) mode now generate reviewable diffs instead of silent changes.
THE CYBER TOOLCHAIN