The Cyber Toolchain — issue 078, September 18, 2026

Adds a max_scans entitlement field to appliance licenses, capping the total number of full scans that may start over the life of the license; the cap is checked at scan start, including restarts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Set via max_scans: 500 in the license configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

max_scans: 500

Adds exclude.authors trust-rule support for bot pull requests on GitHub, so bot accounts like renovate[bot] are now reviewed alongside GitLab and Bitbucket, where this was already supported. Configured via the exclude.authors list in .hacktron/config.yaml.

exclude:
  authors:
    - renovate[bot]
    - my-internal-bot

Pins a GitLab Whitebox Scan to a specific tag or commit SHA instead of the tip of a branch, entered in the Tag or commit field when starting a new scan.

Rebuilds the findings table and detail drawer with a unified header tray offering Severity, Status, Remediate, Copy markdown, and Mark as duplicate actions, plus previous/next navigation and a full-page collapse control.

Adds license detail and expiry warnings to organization settings on appliances — showing licensee, expiry date, days remaining, seat count, and covered products — with a 30-day-out banner and scan blocking after the grace deadline.

Findings gain an OWASP Top 10:2025OWASP Top 10:2025A ranked list of the ten most critical web application risk categories, maintained by the Open Worldwide Application Security Project, used by cyber tools to prioritize detection, testing, and remediation coverage. category, settable from the overflow menu and visible/filterable in the findings table and drawer, plus a CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. identifier and plain-language fix recommendation shown in the detail view where the scan engine supplies them.

Adds a download button in the triage header to pull a scan's context documents — threat model, architecture notes, and uploaded files — without leaving the findings view.

Consolidates Account and Settings into a single Personal settings page with sections for Profile, Security, Connected accounts, Preferences, Sessions, and Organizations.

hf mfdes eload, hf mfdes esave and hf mfdes eview load, save and view a DESFire card dump in emulator memory; hf mfdes esave --keep preserves applications and files a reader deleted rather than omitting them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ hf mfdes dump walks the whole PICC and writes a hf-mfdes-<UID>-dump.json image, auto-loading any hf-mfdes-<UID>-keys.json found, and hf mfdes view prints a saved dump file with no device attached.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ hf mfdes dump

$ hf mfdes view

$ hf mfdes esave --keep

hf mfdes sim now answers a wide range of DESFire EV1 commands from a card image in emulator memory: ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 7816 SELECT by DF name or file ID, SetConfiguration (disable FormatPICC, switch to random UID, set a user-defined ATS), ReadSignature, GetKeyVersion, ChangeKeySettings (enciphered, master key only), ChangeKey (plain and XORed key frame, reflected in hf mfdes esave output), ChangeFileSettings (plain or enciphered depending on access right), CreateFile/DeleteFile for all five EV1 file flavours, CreateApplication/DeleteApplication, FormatPICC, and GetDFNames/GetISOFileIDs. hf mfdes etest drives the same simulation over USB with no RF, letting testers inject RndB and a random UID.

hf mf view now shows which VIGIK fields are RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. signed, decodes Urmet Captiv card number fields and data regions, and decodes Hexact sector 9 and 11 payload cross-checked against sectors 0 and 15 and the UID; hf mf view --selftest also checks the Hexact payload decoder in both directions.

hf mfu cchk and hf mfu aeschk are merged into a single hf mfu chk command that auto-detects UL-C vs UL-AES.

hf 14b view now decodes MyKey / COGES keys stored on SRIX4K tags, and hf 14b view --selftest runs the MyKey parser's self-tests.

hf mfdes chk now checks every key number an application declares, not only those named in a file's access rights, and can run with no arguments, falling back to the bundled dictionary the way hf mfdes detect does.

Adds status_code check creation to the --submit fallback: when a claimed profile returns 2xx and the unclaimed probe returns non-2xx, that signal is now preserved.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds a Vanilla engine, a MediaWiki engine, a MediaWikiJson engine, a DiscourseJson engine, a Lemmy engine, and a shared Mastodon engine using the accounts/lookup urlProbe, expanding structured detection across forum, wiki, and federated platforms. Moves 395 Discourse sites to the DiscourseJson engine and 164 wikis to MediaWikiJson engines for more reliable profile detection.

Adds --input-file flag to read identifiers from a file, one per line, instead of listing them all on the command line.

Adds --dns-resolver support inside --self-check and --submit so custom resolvers are respected during site validation.

Adds ubuntu-26.04 and ubuntu-26.04-arm as fully supported runs-on values for GitHub Actions on x64 and arm64.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ The ubuntu-latest label migrates from Ubuntu 24.04 to Ubuntu 26.04, rolling out gradually between October 19 and November 19, 2026; workflows depending on tools or packages changed between the two versions may break automatically during that window unless pinned to ubuntu-24.04 or explicitly set to ubuntu-26.04/ubuntu-26.04-arm.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

jobs:
  build:
    runs-on: ubuntu-26.04-arm
    steps:
      - uses: actions/checkout@v4
      - run: make test

jobs:
  build:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - run: make test

A new REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. lets you create, read, update, and delete actor and event rules — including workflow path conditions — at the enterprise, organization, and repository level for policy-as-code governance. Adds workflow file targeting to scope rules to specific files (e.g. deploy.yml) instead of a whole repo, an Insights view to audit how rules evaluate and enforce (including in evaluate/shadow mode), and evaluate mode itself is now GA for previewing impact before enforcement. A default rule disabling pull_request_target on public repositories with no applicable event policy runs in evaluate mode now and auto-enforces on November 2, 2026; repos that need the trigger must explicitly allow it via Settings > Actions > Policies before then.

Adds totals_by_skill, totals_by_custom_agent, totals_by_mcp, totals_by_slash_cmd, and totals_by_plugin arrays to enterprise and organization Copilot usage metrics API reports, each listing up to five most-active items with an interaction_count. Also adds distinct_skill_use_count, distinct_custom_agent_use_count, distinct_mcp_use_count, distinct_slash_cmd_use_count, and distinct_plugin_use_count fields counting how many different CLI customization items were used; all fields appear in per-user and aggregate 1-day reports, per-user 28-day reports, and day_totals entries in aggregate 28-day reports.

Adds a copilot_feature_engagement object to enterprise and organization 28-day aggregate reports, exposing active-user totals and a totals_by_feature breakdown covering code completion, agent edit, passive Copilot code review, active Copilot code review, Copilot cloud agent, Copilot CLI, and Copilot app. Also adds a users_in_phase_28d field to AI adoption phase reporting, exposing the full rolling 28-day phase population alongside the existing total_engaged_users count, so the impact dashboard can show how many active users engaged with each feature on at least two days in the period.

Adds save_merge_request to open and update merge requests, list_merge_requests supporting group-scope queries, and get_merge_request, which returns diffs, conflicts, or approvals via the include param, with diffs defaulting to stats-level detail unless detail: full_patch is passed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Adds save_merge_request_review covering the full review flow — line-level or summary comments, thread replies, discussion resolution, full review submission, Duo review trigger, and approve/unapprove — and accept_merge_request, which merges immediately by default, waits for checks with strategy: merge_when_checks_pass, or joins a merge train with add_to_merge_train_when_checks_pass.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Call the `accept_merge_request` MCP tool with:
{
  "merge_request_iid": 42,
  "project_id": 123,
  "strategy": "merge_when_checks_pass"
}

Adds Export usage data from the GitLab Credits dashboard or GitLab Flex month overview, delivering a background-generated export by email with a secure download link, covering up to 31 days across three files: a daily summary, a per-event file, and a manifest. The per-event file surfaces Event ID, timestamp, event type, product and flow type, session identifier, User ID, Namespace ID, Project ID, credits consumed (quantity and unit), LLM call count, token totals, models used, Flex capability, and subscription name, enabling per-team showback and session-level spike investigation. A one-time namespace-to-cost-center mapping lets these monthly per-event exports automatically reflect finance cost structure without manual reconciliation.

⤢ ⤢

Adds the Credit caps page (at Settings > GitLab Credits > Credit caps for group Owners, or Admin > GitLab Credits > Credit caps on Self-Managed) to set a flat per-user GitLab Credits cap for all users in a billing period, with per-user overrides that can go above or below the flat cap, and a master toggle controlling whether overrides apply. Adds GitLab Flex capability-level controls letting admins mark each capability Restricted, Usage cap, or Unlimited against the shared reservation, so one capability's overage cannot drain credits needed by others. Adds email notifications to admins from the GitLab Credits dashboard at 50%, 80%, and 100% of credit usage, and again when the subscription cap is reached.

⤢

Adds save_pipeline MCP tool to run, retry, cancel, or rename a CI/CD pipeline, and get_job MCP tool, which returns a job by default and, with include: ["log"], streams the job trace paginated via byte_offset and byte_limit (512 KB per page).

Call the `get_job` MCP tool with:
{
  "job_id": 987654,
  "include": ["log"],
  "byte_offset": 0,
  "byte_limit": 524288
}

The /goal slash command in GitLab Duo CLI lets developers describe an outcome and a done-condition in a single prompt; the agent iterates locally without turn-by-turn supervision until the goal is met or a configured iteration limit is reached. A /goal run can be stopped at any point and a new goal issued mid-session, giving developers a clear intervention point without abandoning the workflow.

$ /goal Fix the failing tests in spec/models/user_spec.rb. Continue until all tests pass locally and CI is green.

$ /goal Fix the failing tests. Ensure CI is fully green and the fix is reviewed by Duo Developer.

Adds three selectable hosted open weight models to GitLab Duo Agent Platform: Kimi K3 (Moonshot AI) at 1.82 calls per credit, optimized for large codebases and long-running agent sessions; GLM 5.3 (Z.ai) at 5 calls per credit, tuned for long-horizon coding tasks with extended context accuracy; and MiniMax M3 (MiniMax) at 8 calls per credit, designed for high-volume, multi-step agentic work at scale. All three are served through Fireworks AI under a zero data retention policy that discards model input and output immediately after each response. Top-level group owners can set a per-feature default model and curate which models teams can select from, with settings applying consistently across all child groups and projects.

Adds a Created trigger action for merge requests in GitLab Duo Agent Platform, configurable under AI > Triggers in project settings, so flows or external agents run the moment an MR is opened and diffed.

Adds list_vulnerabilities (Ultimate only) filterable by severity and report type with cursor pagination, get_vulnerability for full single-vulnerability detail, and save_vulnerability (Ultimate only), which consolidates dismiss, confirm, revert to detected, update severity, and create a linked issue into a single tool.

Adds a per-developer GitLab Credits view under User settings showing a daily consumption chart with product filter and date range controls, scoped to the individual user's own events.

Extends MCP server tool governance to GitLab MCP server tools alongside GitLab Duo Agent Platform tools in the same group and project settings, with a per-tool mode: read-only tools default to Always allow, write/delete tools default to Always ask.

Adds get_work_item, list_work_items, and save_work_item MCP tools covering issues, epics, and all supported work item types, superseding get_issue and create_issue. Adds save_note to comment on a work item or merge request and reply inside an existing thread, superseding create_merge_request_note and create_workitem_note.

SonarQube Cloud extends its zero-configuration automatic analysis — previously exclusive to GitHub and Azure DevOps — to GitLab, scanning every merge request and main-branch commit without editing .gitlab-ci.yml.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Coverage spans 20+ languages including C#, Java, and Python; onboarding is done by linking a GitLab account with repository and metadata read permissions and using Import repositories in SonarQube Cloud.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SonarQube adds analysis of R source files and embedded R code inside R Markdown documents, with 82 rules covering key sections of the lintr rule set plus additional Sonar-developed rules. It imports lintr problem reports directly into SonarQube's centralized findings view, adds Cobertura test coverage import for R projects, and extends secrets detection, code metrics, syntax highlighting, and copy-paste duplication analysis to R. Existing quality profiles, quality gates, PR decoration, and branch analysis now apply to R codebases on both Cloud and Server.

Snyk API & Web now supports uploading your organization's internal Root CA certificate, so certificates it issues are trusted during DAST scans alongside the public trust store.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ To use it, go to organisation settings in the Snyk Web UI, navigate to Add a custom CA certificate, and upload your Root CA file so subsequent scans verify certificates against it.

snyk test now reports an unreadable .snyk policy file as error code SNYK-POLICY-0002 with a descriptive message instead of an unspecified error.

The new --all-groups flag scans for key exchange groups on all supported TLS protocols, not just the one negotiated in the handshake, e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ sslscan --all-groups <target>:443.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ sslscan --all-groups <target>:443

Adds a new mermaid renderer, selected with --renderer mermaid, that visualizes tree-structured plugin output such as process trees and VAD trees as Mermaid diagrams embeddable directly in Markdown and GitHub.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ vol -f /cases/memory.raw --renderer mermaid windows.pstree

Replaces --dump-page and --dump-size with --show-all-dirty-pages and --hexdump-size in Linux malfind, giving finer control over dirty-page enumeration output; scripts or workflows using the old flags will break.

Adds Software::parse_cache_interval, Software::found_cache_interval, and Software::max_software_cache_size tunables to the software framework for finer control over version-detection caching, letting operators cap cache size and intervals to reduce memory use and log churn in high-volume environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

redef Software::max_software_cache_size = 5000;
redef Software::parse_cache_interval = 1min;
redef Software::found_cache_interval = 5min;

Adds a new ssl_extension_encrypted_client_hello event in the TLS analyzer to report on Encrypted Client Hello (ECH), and adds ech_kdf_id and ech_aead_id fields to ssl.log — reporting HPKE KDF and AEAD identifiers from the TLS 1.3 ECH extension — via the protocols/ssl/ssl-log-ext.zeek policy script.

$ @load protocols/ssl/ssl-log-ext

Replaces the MD5-hashed auth_ticket and new_ticket fields in kerberos.log with auth_ticket_sha256 and new_ticket_sha256 via protocols/krb/ticket-logging.zeek; the protocols/krb/md5-ticket-logging.zeek policy script restores the original MD5 fields.

Replaces the host_key fingerprint field in ssh.log with a new host_key_fingerprint field using SHA256 in the same format as ssh-keygen -l; the protocols/ssh/md5-host-key-logging.zeek policy script restores the old field.

Adds a new declarative zeek.conf cluster configuration file consumed by Zeek's systemd generator to produce systemd unit files for orchestrating Zeek clusters, including multi-machine deployments.

Zeek 9 switches the default cluster communication backend from Broker to ZeroMQ, enabling direct worker-to-worker eventing, cluster-wide event publishing, and single-point cluster event tapping; scripts or packages that rely on Broker-specific eventing must re-enable the Broker backend explicitly.

⤢

Adds opcode and opcode_name fields to dns.log to support DNS notifications (RFC 1996); removable via the protocols/dns/disable-opcode-log-fields.zeek policy script.

Adds a new multicast_participants.log (via the protocols/conn/multicast-participants.zeek policy script) reporting multicast speakers based on IGMPIGMPA network-layer protocol used by IPv4 hosts and routers to manage multicast group membership, letting routers know which hosts want traffic for a given multicast address. activity, and logs multicast DNS transactions as separate transactions since they occur on separate network flows.

Ships Spicy 1.17.0 with a control-flow-graph-based optimizer delivering 20–60% microbenchmark performance improvements and adds Windows (MSVC) build support.

Adds DCF intra-cluster enforcement for EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves., enabled per-cluster from CoPilot under Security > Distributed Cloud Firewall > Settings > Intra-Cluster, supporting Calico, Cilium, Antrea, AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. CNI (v1.14+), Weave Net, and Canal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds independent gateway instance sizing, allowing a single instance to be resized from CoPilot at Cloud Fabric > Gateways > (transit or spoke) > gateway group > Instances without affecting HA or the group default size; surfaces a Multiple Sizes label when a group has diverged.

Adds the Security > Egress > Overview tab (requires Controller 8.0 and DCF enabled) showing an Egress Security Score card for VPC/VNets and a breakdown of Unprotected, Monitored, Partially Protected, Protected, No Egress, and Unknown states. Adds an Egress Security Score Explained dialog (via Learn More) detailing how the score is calculated, and a Manage VPC/VNets shortcut that navigates directly to the Egress VPC/VNets tab for remediation.

⤢ ⤢ ⤢

Adds DCF Spoke Local Breakout, recording the egress path taken in every DCF log entry; requires Single IP SNAT (or customized SNAT), the 10.1 gateway image, and a supported instance size on Aviatrix Transit (FireNet) and AWS TGW centralized topologies.

Adds DCF Quick Time-to-Value dashboard with a system-defined, Aviatrix-managed read-only threat intelligence ruleset (defaults to Watch Mode) and ten Recommended Security Control cards covering ToR traffic, sanctioned-country traffic, cleartext legacy protocols, cryptomining pools, and outbound proxy/relay; requires Controller 8.2+ and CoPilot 4.37.

The FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. build of VPN Client 3.0.2 requires the VPN gateway's UserVPN CA to use an RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. key of at least 2048 bits; gateways on Controller versions earlier than 8.2, or Controller 8.2 whose UserVPN CA has not been rotated, may use a 1024-bit key (generated on Aviatrix 7.1 or earlier) that the FIPS 140-3 module will reject, preventing the client from verifying the gateway server certificate.

Adds Security > Distributed Cloud Firewall > IPS > Rule Feeds (labeled ET Pro in CoPilot) as a Premium IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. feed applied alongside custom Suricata rulesets, with traffic actions governed by severity thresholds in the active IPS Profile.

Adds VRF for multi-tenancy with end-to-end propagation across transit-to-transit peering, BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes.-spoke-to-transit peering, and intra-group backup links; enabled by a Controller feature flag (off by default) plus per-attachment opt-in, supporting up to 200 network domains.

Adds DCF for Private Kubernetes Clusters (Preview), enabled per cluster in CoPilot or Terraform, supporting EKS, AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations., and GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.; requires an Aviatrix spoke gateway in the same VPC with a security-group rule allowing TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 443 to the Kubernetes API server.

Adds Flexible Gateway Deployment (private subnet, no public IP), enabled per gateway group at creation time on AWS (including GovCloud) and Azure, via CoPilot and Terraform.

Adds DCF East-West Layer 7 inspection for AWS, with symmetric routing enabled per spoke group in CoPilot or Terraform, also reducing cross-AZ data transfer cost and latency.

Adds GCP Global VPC Regional Spoke Egress (Phase 2), letting operators choose which regions egress locally vs. through FireNet, with both modes coexisting in the same Global VPC; the CoPilot Egress page now shows Global VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules. in a nested tree displaying each region's egress mode.

Adds ten new DDoS protection challenge metrics to the Historical Stats API and Real-Time Analytics API, covering challenge and token creation, validation outcomes, and Private Access Token (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) challenges issued during DDoS protection rule enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds a count_scan section to the fuzzy worker config with tunable pass interval (default 4 hours), SCAN COUNT (default 1000), and duty cycle (default 10%), replacing the broken <prefix>_count Redis counter with a periodic SCAN-based keyspace walk; sampled statistics from this are configured via stats_sample and reported under <prefix>_stats, /fuzzystat, and rspamadm fuzzystat.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Per-source IP tracking is restored via worker-level and per-key max_ips_per_key/max_ips (now lazy and off by default for the default key), with ips_inserted and ips_overflow fields, and a table exceeding eight times its eviction cap in an hour is dropped and flagged. Fuzzy storage key policy now applies after decryption so a valid customer key is no longer dropped by an IP ban, and health monitoring is added via fuzzy_check.ping_storage_all and the /plugins/fuzzy/status endpoint, with per-server liveness marks, down badges, and an on-demand Check button in the WebUI.

max_ips_per_key = 1024;

$ curl -s http://localhost:11334/plugins/fuzzy/status | python3 -m json.tool

$ rspamadm fuzzystat

max_ips_per_key = 256;

key {
  id = "<your-key-id>";
  max_ips = 64;
}

Replaces the old multipattern/hyperscan TLD lookup with a longest-suffix hostname matcher against the effective TLDs file, honouring ! exception rules that were previously skipped. Exposed to Lua as rspamd_tld_lookup(), url:get_public_suffix() with match flags, and the get_public_suffix selector transform, supporting wildcards, exceptions, and ICANN/private splits. Two-pass URL discovery in free text now uses a static matcher plus dot-anchored suffix probing, eliminating the old 10,500-pattern hyperscan database (previously 1.3s to compile, 6.5MiB serialised); RBLRBLA DNS-based blocklist of IP addresses known to send spam or host malicious traffic, maintained by various operators, used by cyber tools to reject or flag connections from listed sources at lookup speed. URL composition maps are now matched via rspamd_tld_lookup instead of per-TLD regexp buckets. filter = "top" in multimap now returns the full public suffix (e.g. co.uk, com.au) instead of only the last label, and a host that is itself a public suffix resolves to the whole host — map files must be audited and updated before upgrading.

$ grep -rn 'filter *= *"top"' /etc/rspamd/local.d/ /etc/rspamd/override.d/

$ rspamadm lua -e 'print(require("rspamd_util").get_tld("www.city.kobe.jp"))'

Replaces per-class symbol schedulers with one execution plan computed at cache initialisation, viewable via rspamadm configdump -d and rspamadm configdump -e, and introducing suppressed and skipped item states. Prefilters can now legitimately depend on filters, and invalid register_dependency() edges (e.g. a connfilter depending on a filter in the wrong stage) are rejected at configuration time instead of silently accepted; ignore_passthrough filters now apply correctly after a pre-result so task:set_pre_result() no longer skips the filters stage.

$ rspamadm configdump -e

Adds SVG attachment content extraction with smuggling-indicator symbols SVG_CONTENT, SVG_SCRIPT, SVG_FOREIGN_OBJECT, SVG_DATA_URI, SVG_FORM, controlled via a new lua_content { svg { ... } } config block for per-task budget and timeout. Adds XLSX/PPTX extraction in the bounded OOXML pipeline covering shared strings, worksheets, Excel 4.0 macrosheets, DrawingML, slide notes, and auto-executing Auto_Open defined names, surfaced as OOXML_MACROS, OOXML_OLE_OBJECT, OOXML_REMOTE_TEMPLATE, OOXML_EXTERNAL_DATA. Adds bounded DOCX extraction with the core rewritten in C++, flagging unprocessable attachments instead of silently ignoring them.

Adds ucl.untrusted_parser(), parser:set_limits(), and parser:get_limits() Lua APIs for bounded parsing of untrusted network replies, covering checkv3, controller, and proxy body parsers. Enforces depth 64, 1 million elements, 1KB keys, 16MB strings (individually overridable via max_string_length), and min(96*inlen+256KB, 64MB) of tree; requests exceeding these limits are now rejected rather than accepted.