Censys

No entries match these filters. Clear filters

1. November 2, 2026 (2026-11-02) Nov 2, 2026 · issue 129

   Censys adds Starter and Starter Pro subscription tiers, flattens credit costs to one credit per action, and adds two new Platform fingerprints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Free and Starter users now have all UI and API actions cost one credit each, replacing the previous tiered costs (lookup: 1 credit, standard search: 5 credits, advanced/regex query: 8 credits), so monthly allotments now go further.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Every Free and Starter user now gets five free Platform actions per day.
   • Censys adds two new subscription tiers: Censys Starter ($79/month, 500 credits, one-month rollover) and Censys Starter Pro ($599/month, 4,000 credits), purchasable from the Plan page in the Platform web console.
   • Censys Starter subscribers gain access to additional API endpoints including search, aggregate, and all collections endpoints, plus tags and comments.
   • Censys adds a new Wordpress Plugin - Gravity Forms software fingerprint to the Platform.

   +1 more show less

   • Censys adds a new Cisco NX-OS OS fingerprint to the Platform.

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Censys Credit packs can no longer be purchased.
2. announced Oct 30, 2026 · issue 127

   Censys adds Starter subscription tiers with flat one-credit pricing, daily free searches, and credit rollover⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Censys now prices every search action — lookups, standard searches, and advanced regex queries — at one credit each, replacing the previous 1/5/8-credit tiered model.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Censys adds a Starter plan at $79/month with 500 credits, 2 Collections, and 10 asset tags.
   • Censys adds a Starter Pro plan at $599/month with 4,000 credits, 4 Collections, and 25 asset tags.
   • Every registered Censys user now gets five free searches per day that do not draw from subscription credits.
   • Unused monthly subscription credits now roll over into the next billing cycle instead of expiring.

   5 details in Everything

3. announced Oct 27, 2026 · issue 123

   Censys Investigator gains an API, letting scripts, SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. playbooks, and AI agents submit indicators and retrieve full campaign-cluster reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   └──▷ TRY IT
   Upload a vendor threat-intel report and expand its indicators into a full campaign cluster, then save the CenQL query as a watched Collection.
   copy

   $ # 1. Upload the report HTML as a file
   curl -X POST 'https://api.platform.censys.io/files?org_id=<org_id>' \
     -H 'Authorization: Bearer <token>' \
     -H 'Content-Type: application/json' \
     -d '{"content_type": "text/html", "filename": "vendor-report.html", "size_bytes": 42800}'
   
   # 2. PUT the actual bytes to the returned upload_url, then run investigation
   #    (investigate() wraps the investigation submission call with file_ids=["<file_id>"], start_time="...")
   
   # 3. Turn the returned CenQL into a persistent Collection
   curl -X POST 'https://api.platform.censys.io/v3/collections?org_id=<org_id>' \
     -H 'Authorization: Bearer <token>' \
     -H 'Content-Type: application/json' \
     -d '{"name": "Investigator: ScreenConnect phishing cluster", "query": "<cenql_from_report>"}'

   Before submitting a bulk IR investigation, check remaining weekly allowance to avoid exhausting the quota mid-incident.
   copy

   $ curl -X GET 'https://api.platform.censys.io/usage?org_id=<org_id>' \
     -H 'Authorization: Bearer <token>'

   • Adds a POST /files endpoint to upload raw HTML/text (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ a vendor blog post) as investigation input, returning a file_id for use in subsequent investigation calls.
   • Adds a GET /usage endpoint to check an organisation's remaining weekly investigation allowance and next_expire_time before submitting jobs.
   • Exposes the Censys Investigator as a programmable API, accepting up to 100 IPs, domains, or file IDs per job with optional start_time and end_time window parameters, and returning a downloadable archive containing a CenQL cluster query and full infrastructure report.
   • Investigation results (CenQL cluster query) can be piped directly into POST /v3/collections to create a persistent, auto-updating watched cluster without manual re-running of hunts.
   • Each organisation receives 150 Investigator API investigations per week (up to 3 concurrent per user), with results retained for 7 days and no Censys Credits consumed.

   5 details in Everything

4. October 26, 2026 (2026-10-26) Oct 26, 2026 · issue 122

   Adds a fingerprint observation API endpoint in Adversary Investigation and a PHP2Shell ARC dashboard for tracking worldwide PHP exposure over time.

   • Adds a new fingerprint observation API endpoint in the Adversary Investigation module to retrieve which TLS certificate chains an IP has presented, on which ports, and when — enabling infrastructure-change spotting and host pivoting.
   • New detectionUpdated detectionAdds the Censys ARC PHP2Shell dashboard to track worldwide PHP exposure over time.

   2 details in Everything

   • New detection New Platform software fingerprints: changedetection.io, CLIProxyAPI, MarkLogic Server, ManageEngine OpManager
   • Updated integration Palo Alto XSOAR integration v3.2.3
   • Updated integration ServiceNow TISC integration v1.1.0
   • Updated integration SentinelOne Singularity Operations Center integration
   • Updated integration Microsoft Sentinel integration v3.0.1
5. docs update Oct 20, 2026 · issue 114

   Censys adds a Threat Hunting MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface., enabling AI agents to query Censys data via the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
6. October 19, 2026 (2026-10-19) Oct 19, 2026 · issue 114

   Censys adds an in-app feedback portal, reorganized UI navigation, 10 new platform fingerprints, and hundreds of new ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. CVE risks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Adds an in-app Censys Platform Feedback Portal for submitting feedback and tracking feature requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Reorganizes the Censys Platform UI and search actions into three sections: Investigate, Defend, and Intelligence.
   • Moves search history to its own tab on the upper right corner of the search results page.
   • Renames the Reports tab to Aggregate in the Platform UI.
   • Relocates documentation, Academy, and Data Definitions resources to the Help and Feedback menu in the top right.

   +3 more show less

   • Adds 10 new software fingerprints to the Platform: Ahsay Cloud Backup Suite (AhsayCBS), IBM MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Context Forge, Nextcloud Collabora Online Built-in CODE Server, OliveTin, Perforce P4 Search (formerly HelixSearch), phpBB, pyLoad, Softaculous Virtualizor, ThinkPHP, and ZITADEL.
   • Adds several hundred new CVE risks for JavaScript libraries and web component fingerprints to ASM.
   • Publishes five new Censys ARC Rapid Response advisories covering AnyDesk Linux, GitLab CI/CD, Ivanti Connect Secure, Collabora Online Built-in CODE Server, and BeyondTrust Remote Support/Privileged Remote Access.
   • Adds an in-app Censys Platform Feedback Portal for submitting feedback and tracking feature requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   7 more in Everything

7. October 13, 2026 (2026-10-13) Oct 13, 2026 · issue 108

   Censys adds PQCPQCCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. key exchange fields on host/web endpoints, Splunk integration v1.2.0 with host enrichment API, and Sentinel log ingestion API support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   • Adds key_exchange_group and pqc_groups fields to host services and web property endpoints, exposing post-quantum cryptographypost-quantum cryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. (PQC) key exchange group data including ML-KEMML-KEMNIST's post-quantum key-exchange standard (FIPS 203), formerly Kyber. Two parties use it to agree on a shared secret, usually alongside X25519 in a hybrid TLS handshake. (KyberKyberNIST's post-quantum key-exchange standard (FIPS 203), formerly Kyber. Two parties use it to agree on a shared secret, usually alongside X25519 in a hybrid TLS handshake.) and hybrid exchanges like X25519MLKEM768.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Censys Splunk Platform integration v1.2.0 adds support for the get host enrichment API endpoint, configurable as the default instead of the get host API endpoint.
   • Censys Splunk Platform integration v1.2.0 adds a workflow action and a custom command for related infrastructure data.
   • Censys Splunk Platform integration v1.2.0 adds a Splunk ES adaptive response for related infrastructure data.
   • Censys Splunk Platform integration v1.2.0 adds new data enrichment fields for reputation score, GreyNoise, IPinfo, and Mallory.

   +2 more show less

   • Updates the ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. integration with Microsoft Sentinel to use the log ingestion API instead of the retired Azure Monitor HTTP data collection API.
   • Adds five new fingerprints to the Platform: Cudy WR3000 Router (hardware), OpenPrinting CUPS (software), OSGeo GeoNetwork (software), Midoks mdserver-web (software), and Sangoma Switchvox (software).
   • Adds key_exchange_group and pqc_groups fields to host services and web property endpoints, exposing post-quantum cryptographypost-quantum cryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. (PQC) key exchange group data including ML-KEMML-KEMNIST's post-quantum key-exchange standard (FIPS 203), formerly Kyber. Two parties use it to agree on a shared secret, usually alongside X25519 in a hybrid TLS handshake. (KyberKyberNIST's post-quantum key-exchange standard (FIPS 203), formerly Kyber. Two parties use it to agree on a shared secret, usually alongside X25519 in a hybrid TLS handshake.) and hybrid exchanges like X25519MLKEM768.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Censys Splunk Platform integration v1.2.0 adds a workflow action and a custom command for related infrastructure data.
   • Censys Splunk Platform integration v1.2.0 adds a Splunk ES adaptive response for related infrastructure data.

   4 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The ASM integration with Microsoft Sentinel no longer uses the Azure Monitor HTTP data collection API (retired September 14, 2026); existing setups must migrate to the log ingestion API configuration.
8. docs update Oct 11, 2026 · issue 102

   Censys: New AI Investigations automates entity history checks, asset pivoting, and web resource profiling, then delivers a ranked findings report to Adversary Investigation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   └──▷ HOW TO FIND IT
   Launch an AI Investigation from the UI when you have a list of up to 100 indicators to profile and pivot on automatically.
   📍1. In the Censys platform, open the Adversary Investigation module. 2. Click New Investigation and paste up to 100 IP addresses or domain names. 3. Submit — the AI investigator runs entity history, asset pivoting, and web profiling in parallel and returns a ranked findings report.
9. docs update Oct 11, 2026 · issue 102

   Censys adds AI Investigations to automatically pivot across indicators, profile infrastructure, and deliver ranked findings reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds AI Investigations to threat hunting: an AI investigator that checks each entity's history, pivots to potentially related assets, profiles web resources, connects results, ranks findings, and produces a formatted report.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

10. docs update Oct 11, 2026 · issue 102

    Censys: Service accounts are configurable with per-module role scopes, requiring at least one module role and granting only explicitly assigned permissions.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Connect an external application (e.g., SentinelOne) to Censys Platform APIs using a service account instead of a personal token — no seat consumed.
    📍In the Censys Platform web console, go to Organization Settings › Service Accounts, click + Create service account, enter a name, assign the required module roles, and click Create service account. Copy the Client Secret immediately (shown only once), then note the Client ID and Access Token URL. In the target app, set authentication type to OAuth, grant type to client credentials, and supply the Client ID, Client Secret, and Access Token URL.
    • Service account management is available under Organization Settings > Service Accounts in the Censys Platform web console, including creation, name/role editing, secret rotation, and deletion (Platform Admin role required).

    1 detail in Everything

11. docs update Oct 11, 2026 · issue 102

    Censys: Adds six named RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. roles, including Platform Admin, API Access, and Global Search and ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. Analyst/Manager roles, each with distinct permission scopes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Assign the ASM - Manager role to a user who needs to administer ASM workspaces after accepting their invite.
    📍1. In the Censys Platform, navigate to Settings › Members. 2. Locate the user and click Manage roles. 3. Enable ASM - Manager and click Save.
    • Adds automatic role provisioning for SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. users on first login, assigning default roles based on the products the organization has licensed (Global Search - Analyst for Platform orgs, ASM - Analyst for ASM-only orgs).
    • Exposes role management through the account management API, enabling programmatic granting, editing, and revoking of user roles.

    2 details in Everything

12. docs update Oct 10, 2026 · issue 101

    Censys: Service accounts support scoped access by requiring at least one explicitly assigned module role, with no implicit permissions.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Navigate to Service Accounts in the Censys Platform console to create a non-personal API identity scoped to specific module roles for integration use.
    📍1. In the Censys Platform web console, go to Organization Settings › Service Accounts 2. Click + Create service account 3. Enter a name and select the module roles required (at least one is required) 4. Click Create service account 5. Copy the Client Secret immediately — it will not be shown again 6. Note the Client ID and Access Token URL for use in downstream app configuration
13. docs update Oct 10, 2026 · issue 101

    Censys: Service accounts are available exclusively to organizations on the Censys Search or Censys Core plans and require at least one module role assignment.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Configure a third-party app (e.g., SentinelOne) to authenticate to Censys Platform APIs using a service account instead of a personal token.
    📍In the Censys Platform web console: 1. Go to Organization Settings › Service Accounts 2. Click + Create service account 3. Enter a name and assign the required module roles 4. Click Create service account 5. Copy the Client Secret (shown only once) and note the Client ID and Access Token URL 6. In your target app, set authentication type to OAuth, grant type to client credentials, and supply the Client ID, Client Secret, and Access Token URL
14. api-docs-d91f57789f71 Oct 10, 2026 · issue 100

    Censys API now supports Personal Access Tokens and Service Accounts for application authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    • Adds Personal Access Token (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) authentication for the Censys API, enabling secure programmatic access without exposing user credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Service Accounts support to connect applications with Censys Platform APIs without using a personal user account.

    2 details in Everything

15. docs update Oct 10, 2026 · issue 100

    Censys adds two CensEye pivot analysis API endpoints for hosts, web properties, and certificates⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Adds an asynchronous CensEye pivot analysis job endpoint that extracts default pivot fields from a target host, web property, or certificate, counts matching documents per field-value pair, and returns results via a poll-then-retrieve workflow (44 credits for a host, 28 for a web property, 7 for a certificate).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a web-asset count endpoint that accepts custom field-value pair combinations — bypassing the UI defaults — and charges one credit per count condition (array of objects).

    2 details in Everything

16. docs update Oct 10, 2026 · issue 100

    Censys adds AI Investigations: automated multi-indicator analysis with parallel pivoting, ranking, and formatted reports via UI or API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    • New Investigations: Create job API endpoint lets practitioners launch AI Investigations programmatically, subject to the same 150-per-week org limit that applies to UI-started jobs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports up to 100 indicators per investigation and up to 5 concurrent AI investigations per user, with a 150-investigation-per-week org-wide ceiling across UI and API.

    2 details in Everything

17. docs update Oct 10, 2026 · issue 100

    Censys Platform adds organization-level service accounts with OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. client credentials flow for API integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Create a service account in the Censys Platform console to allow an application to authenticate to Platform APIs without a personal user account.
    📍1. Go to Organization Settings › Service Accounts 2. Click + Create service account 3. Enter a name and select the minimum required module roles 4. Click Create service account 5. Copy and securely store the Client Secret (shown only once) 6. Note the Access Token URL and Client ID for use in your application
    • Adds Platform service accounts, managed at the organization level under Organization Settings > Service Accounts, enabling applications to authenticate to Platform APIs via OAuth 2 client credentials flow without consuming a user seat.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Service account credit usage can be retrieved via the get user credit usage API endpoint, since it is not yet visible on the Credit Management page in the Platform web console.
    • Service accounts support integration with third-party tools (e.g., SentinelOne) by configuring OAuth as the authentication type, client credentials as the grant type, and supplying the client ID, client secret, and access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. URL.
    • All service account activity is recorded in the Platform audit log.

    4 details in Everything

18. docs update Oct 10, 2026 · issue 100

    Censys Platform introduces granular role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. with six named roles across platform-wide and module scopes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Grant a new team member ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. workspace administration rights and API token generation capability from the Members page.
    📍1. Navigate to Settings › Members. 2. Select the target user and click Manage roles. 3. Assign the ASM - Manager role and enable the API Access permission. 4. Click Save to apply.
    • Adds Platform Admin role covering billing, user and role management, audit log, AI privacy configuration, authentication settings, and account management APIs — does not consume a module seat.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds API Access permission granting Platform API endpoint access scoped to a user's module and role combination, enabling users to generate, edit, and delete Personal Access Tokens without consuming a seat.
    • Adds Global Search - Analyst module role as the default for new members, granting access to search, collections, history, Adversary Investigation, and Critical Infrastructure modules.
    • Adds Global Search - Manager module role with everything in Global Search - Analyst plus collection webhook and tag management for the organization.
    • Adds ASM - Analyst role for base ASM workspace access (no ASM workspace API key access, no Global Search seat consumed).

    +3 more show less

    • Adds ASM - Manager role with everything in ASM - Analyst plus ASM workspace administration (no Global Search seat consumed).
    • SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. organizations now auto-provision users on first login with default roles determined by the products the organization has access to.
    • Supports role management via the account management API in addition to the Members page UI.

    8 details in Everything

19. docs update Oct 10, 2026 · issue 100

    Censys Platform Admins can now enforce MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. org-wide and reset individual user MFA configurations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    • Enables Platform Admins to require MFA for all organization users to access the Censys Platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables Platform Admins to reset the MFA configuration of individual users in their organization.

    2 details in Everything

20. docs update Oct 9, 2026 · issue 098

    Censys adds AI Investigations: an AI-powered investigator that pivots across indicator history, related assets, and web profiles to produce a ranked findings report.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds AI Investigations, which analyzes indicators, pivots to related infrastructure, profiles web resources, checks entity history, and produces a ranked, formatted findings report — accessible from the threat-hunting page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

21. docs update Oct 9, 2026 · issue 098
    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Connect an external application (e.g., SentinelOne) to Censys Platform APIs using a service account instead of a personal user account.
    📍In the Censys Platform web console: 1. Go to Organization Settings › Service Accounts 2. Click + Create service account, enter a name, and assign the minimum required module roles 3. Copy the Client Secret (shown only once), and note the Client ID and Access Token URL 4. In the external application, set authentication type to OAuth, grant type to client credentials, and enter the Client ID, Client Secret, and Access Token URL
22. October 8, 2026 (2026-10-08) Oct 8, 2026 · issue 098

    Censys ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. adds screenshots, redirect chain analysis, and DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. network logs for web entities, plus CVE risk acceptance on hosts and web assets.

    • Adds screenshots for every web entity in inventory, captured at scan time and timestamped by Last Updated, enabling rapid identification of exposed login pages, admin panels, and compromised infrastructure.
    • Adds full redirect chain visibility on web entities to detect domain takeovers or incorrect redirect destinations.
    • Adds network log view on web entities listing all resources loaded during a full DOM evaluation, including JS libraries, scripts, images, and stylesheets.
    • Adds ability to accept CVE risk instances on host and web entity assets, accepting all CVE risks associated with a given risk instance at once.

    4 details in Everything

    • New detection Software fingerprints for jQuery, AngularJS, Bootstrap, WordPress, WooCommerce, Astro, and more
23. docs update Oct 8, 2026 · issue 097

    Censys launches AI Investigations: automated multi-entity pivot analysis with a 100-indicator limit and API support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    • Supports launching investigations via the Investigations: Create job API endpoint, in addition to the UI.
    • Caps submissions at 100 indicators per investigation, five concurrent investigations per user, and 150 investigations per week per organization (UI and API combined); investigations do not consume Censys Credits.

    2 details in Everything

24. docs update Oct 6, 2026 · issue 096
    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Create a service account scoped to the minimum required module roles so an automated pipeline can call Platform APIs without tying credentials to a personal account.
    📍1. In the Censys Platform web console, go to Organization Settings › Service Accounts 2. Click + Create service account 3. Enter a name and select the minimum required module roles 4. Click Create service account 5. Copy the Client Secret immediately — it will not be shown again 6. Note the Client ID and Access Token URL for use in your API client
25. docs update Oct 6, 2026 · issue 096

    Censys Platform introduces org-level service accounts using OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. client credentials for API access, without consuming user seats, requiring the Platform Admin role.

    • New integrationAdds Platform service accounts managed at the organization level under Organization Settings > Service Accounts, enabling applications to authenticate to Platform APIs via OAuth 2 client credentials without using a personal user account or consuming a seat.
    • Service accounts are granted access through explicitly assigned module roles, with at least one role required at creation time.
    • Service account activity is recorded in the audit log; credit usage is retrievable via the get user credit usage API endpoint.
    • Available only to Censys Search or Censys Core plan organizations; the Platform Admin role is required to create or manage service accounts.

    4 details in Everything

26. docs update Oct 6, 2026 · issue 096

    Censys adds async CensEye pivot analysis jobs and a web-asset field-value count endpoint via API⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Adds an async CensEye pivot analysis job API that extracts default pivot fields from a host, web property, or certificate and counts matching documents per field-value pair; credit cost is 44 for a host, 28 for a web property, and 7 for a certificate.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a web-asset count endpoint that accepts user-defined field-value pairs and combinations rather than the UI default fields, at one credit per count condition (array of objects).

    2 details in Everything

27. docs update Oct 6, 2026 · issue 096

    Censys adds AI Investigations: automated multi-indicator pivoting and reporting, up to 100 indicators per job via UI or API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    • Adds the Investigations: Create job API endpoint to start AI Investigations programmatically, with a limit of 100 indicators per investigation and 150 investigations per week across UI and API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces AI Investigations, which automatically checks entity history, pivots to related assets, profiles web resources in parallel, and delivers a ranked findings report — available to customers with the Adversary Investigation module at no Censys Credits cost.

    2 details in Everything

28. docs update Oct 6, 2026 · issue 096

    Censys adds AI Investigations to comprehensively analyze indicators and discover related infrastructure with ranked, formatted reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Investigate a suspicious indicator and discover related infrastructure via the Censys platform threat-hunting interface.
    📍In the Censys platform, go to Threat Hunting › AI Investigations, enter the indicator you want to analyze, and review the ranked report of related assets and findings.
29. docs update Oct 6, 2026 · issue 096

    Censys Platform adds org-level service accounts using OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. client credentials flow, managed via Organization Settings > Service Accounts, without consuming user seats.

    • New integrationAdds Platform service accounts — org-level, non-seat-consuming identities that authenticate to Platform APIs via the OAuth 2 client credentials flow, managed under Organization Settings > Service Accounts.
    • Service account activity is recorded in the audit log, and credit usage can be retrieved via the get user credit usage API endpoint.

    2 details in Everything

30. docs update Oct 6, 2026 · issue 096

    Censys Platform gains granular RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. with six named roles — Platform Admin, API Access, Global Search Analyst/Manager, and ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. Analyst/Manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    • Introduces Platform Admin role covering billing, user and role management, audit log, AI privacy configuration, authentication settings, and account management APIs — does not consume a module seat.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces API Access role granting Platform API endpoint access scoped to the user's module and role combination; users with this role can generate, edit, and delete Personal Access Tokens without consuming a seat.
    • Introduces Global Search - Analyst module role as the default for new members, granting access to search, collections, history, Adversary Investigation, and Critical Infrastructure modules.
    • Introduces Global Search - Manager module role, extending Global Search - Analyst with collection (including collection webhooks) and tag management for the organization.
    • Introduces ASM - Analyst module role for base ASM workspace access without consuming a Global Search seat.

    +3 more show less

    • Introduces ASM - Manager module role extending ASM - Analyst with ASM workspace administration, without consuming a Global Search seat.
    • Supports automatic role provisioning for SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. users on first login based on the organization's licensed products.
    • Enables role management via the account management API.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Legacy Admin and Member roles are replaced by the new role set in a September 2026 migration; existing admins map to Platform Admin plus module manager roles, and existing members map to the corresponding analyst roles — no permissions are lost but role names change.
31. docs update Oct 6, 2026 · issue 096

    Censys Platform Admins can now enforce org-wide MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. and reset individual users' MFA configurations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    • Enables Platform Admins to require MFA for all organization users to access the Censys Platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables Platform Admins to reset the MFA configuration of any individual user in their organization.

    2 details in Everything

32. October 5, 2026 (2026-10-05) Oct 5, 2026 · issue 096

    Censys adds redesigned RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., service accounts, GA AI investigations with six new API endpoints, and new fingerprints/risks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds six new API endpoints for AI investigations: Investigations: Create file upload, Investigations: Create job, Investigations: Get job results, Investigations: Get job status, Investigations: Get usage, and Investigations: List jobs — enabling programmatic initiation, polling, and retrieval of AI investigation reports and evidence (ZIP archive) from the Adversary Investigation module.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Investigations: Create job endpoint that accepts indicators, previously uploaded evidence files (PDF, text, or image), or both, and returns a job_id for polling.
    • Adds Investigations: Create file upload endpoint that returns a URL for uploading PDF, text, or image files to use as investigation evidence.
    • Adds service accounts to the Platform so applications can connect to Platform APIs without requiring a personal user account.
    • Redesigns Platform role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC) with Platform-level and module-specific roles for more granular resource access management across organization users.

    +4 more show less

    • Makes the AI investigations feature in the Adversary Investigation module generally available (GA).
    • Adds three new software fingerprints to the Platform: ASUS Control Center, FileRun, and JFrog Artifactory.
    • Adds a new risk fingerprint to ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. for Vulnerable MikroTik RouterOS [CVE-2026-67279, CVE-2026-86060, CVE-2026-67276], detectable via risks.name.
    • Publishes two new Censys ARC Rapid Response advisories covering Citrix NetScaler ADC/Gateway Zero-Day RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. and Fortinet FortiMail Path Traversal, with Platform and ASM queries to identify exposed instances.
    • Adds six new API endpoints for AI investigations: Investigations: Create file upload, Investigations: Create job, Investigations: Get job results, Investigations: Get job status, Investigations: Get usage, and Investigations: List jobs — enabling programmatic initiation, polling, and retrieval of AI investigation reports and evidence (ZIP archive) from the Adversary Investigation module.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Investigations: Create job endpoint that accepts indicators, previously uploaded evidence files (PDF, text, or image), or both, and returns a job_id for polling.
    • Adds Investigations: Create file upload endpoint that returns a URL for uploading PDF, text, or image files to use as investigation evidence.
    • Adds service accounts to the Platform so applications can connect to Platform APIs without requiring a personal user account.
    • Publishes two new Censys ARC Rapid Response advisories covering Citrix NetScaler ADC/Gateway Zero-Day RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. and Fortinet FortiMail Path Traversal, with Platform and ASM queries to identify exposed instances.

    4 more in Everything

33. October 5, 2026 Oct 5, 2026 · release notes

    Censys adds six new AI investigation API endpoints and service account support

    • Added service accounts to the Platform for application access via APIs without personal user accounts.
    • Added six new Investigations API endpoints to programmatically start, monitor, and retrieve AI investigations.
    • AI investigations feature in the Adversary Investigation module is now generally available.
    • Added three new software fingerprints (ASUS Control Center, FileRun, JFrog Artifactory) and two new risk fingerprints to ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them..

    4 details in Everything

34. September 28, 2026 (2026-09-28) Sep 28, 2026 · issue 089

    Censys adds AI Skills plugin for cencli-powered agents and raises AI investigator batch limit to 100 indicators.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Wire cencli into a Claude agent so it can autonomously look up assets and run investigations without leaving the AI workflow.
    📍Install the censys-ai-skills repo as a Claude plugin, then prompt your agent: 'Use cencli to look up all assets tagged Kiteworks PCN and run an investigation on the top 100 indicators.'
    • Adds the censys-ai-skills repo, a Claude plugin that exposes cencli commands to AI agents for asset lookups, investigations, and CensEye job execution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Raises the Adversary Investigation AI investigator batch limit from 35 to 100 indicators per submission.
    • Adds two new fingerprints to the Platform: software Kiteworks PCN and software Kiteworks Secure MFT Server.
    • Adds the censys-ai-skills repo, a Claude plugin that exposes cencli commands to AI agents for asset lookups, investigations, and CensEye job execution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    2 more in Everything

35. docs update Sep 25, 2026 · issue 085

    Censys: Includes censys-search skill for running CenQL queries, censys-view for looking up hosts, certificates, and web properties, and censys-aggregate for field aggregation (equivalent to the Report Builder).

    └──▷ TRY IT
    Install the Censys AI skills into Claude Code so you can run CenQL searches and investigations directly from your AI coding assistant.
    copy

    $ claude plugin marketplace add censys/censys-ai-skills
    claude plugin install censys

    Add Censys search and query-language skills to a custom agent or OpenAI Codex-style harness by referencing skill files from the cloned repo in your system prompt or AGENTS.md.
    AGENTS.md copy

    @censys-ai-skills/skills/censys-search/SKILL.md
    @censys-ai-skills/skills/censys-cenql/SKILL.md

    • Includes censys-enrich skill for credit-free IP enrichment intended for SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. triage workflows.

    1 detail in Everything

36. docs update Sep 25, 2026 · issue 085

    Censys launches censys-ai-skills repo, adding Claude Code and AI assistant skills for asset lookup, CenQL search, pivot analysis, and more via cencli⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Install Censys AI skills into Claude Code so your AI assistant can run CenQL searches, pivot analysis, and host lookups directly from your editor.
    copy

    $ claude plugin marketplace add censys/censys-ai-skills
    claude plugin install censys

    • Adds censys-ai-skills, a public Censys-owned GitHub repo of skills, hooks, and helper scripts for AI coding assistants (Claude Code, Cursor, Windsurf, Cline, and custom agents) that wrap cencli Platform CLI capabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Installs into Claude Code via claude plugin marketplace add censys/censys-ai-skills and claude plugin install censys; other editors load individual SKILL.md files into .cursorrules, .cursor/rules/*.md, .windsurfrules, or .clinerules.
    • Includes censys-search skill for CenQL-based searches, censys-view for host/certificate/web-property lookups, censys-aggregate for field aggregation (equivalent to Report Builder), censys-enrich for credit-free IP enrichment, censys-censeye for pivot analysis with rarity bounds, and censys-timeline for temporal analysis and change detection.
    • Includes censys-cenql reference tool covering query language syntax, field paths, operators, and known noise — consulted automatically by other skills when constructing queries.
    • Includes censys-investigate methodology skill for multi-step investigation workflows and censys-analyze for post-retrieval analysis with jq recipes, SQLite, batch certificate handling, and cross-referencing.

    +2 more show less

    • Ships shell helper scripts censys-count.sh, censys-export.sh, and censys-to-sqlite.sh in the scripts/ directory, usable on any harness with bash access.
    • Requires cencli version 1.0 or newer; censys-censeye and certificate history retrieval require access to the Adversary Investigation module.

    7 details in Everything

37. September 21, 2026 (2026-09-21) Sep 21, 2026 · issue 082

    Censys adds ServiceNow TISC integration, 16 new platform fingerprints, and two new ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. risk fingerprints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
    └──▷ TRY IT
    Find all internet-exposed Check Point Security Management or Log Servers in your ASM workspace to prioritize remediation of management-plane exposure.
    copy

    $ risks.name: "Exposed Check Point Security Management and Log Server"

    Identify assets running a version of Cisco Secure Email Gateway affected by the actively-exploited SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. vulnerability CVE-2026-76461.
    copy

    $ risks.name: "Vulnerable Cisco Secure Email Gateway [CVE-2026-76461]"

    • Adds a ServiceNow TISC integration to automatically or manually enrich IPs, web properties, and certificates in ServiceNow TISC with Censys Platform data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds the ability to initiate a Censys rescan of a host or web property directly from ServiceNow TISC.
    • Adds the ability to retrieve scan history for an IP address from within ServiceNow TISC.
    • Adds the ability to initiate a CensEye automated pivoting job from ServiceNow TISC to find assets related to an IP, web property, or certificate.
    • Adds 16 new platform fingerprints covering Check Point Security Management and Log Server, Apache CloudStack, Apache Cocoon, Cisco Secure Email Gateway, Citrix XenMobile Server, Docker Registry Browser, GeoVision GeoWebServer, IBM WebSphere Liberty, Lucee, OpenMetadata, phpList, Plone, PrivateBin, pypiserver, Roadiz CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly., and TYPO3.
    • Adds a ServiceNow TISC integration to automatically or manually enrich IPs, web properties, and certificates in ServiceNow TISC with Censys Platform data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds the ability to initiate a Censys rescan of a host or web property directly from ServiceNow TISC.
    • Adds the ability to retrieve scan history for an IP address from within ServiceNow TISC.
    • Adds the ability to initiate a CensEye automated pivoting job from ServiceNow TISC to find assets related to an IP, web property, or certificate.

    1 more in Everything

38. September 14, 2026 (2026-09-14) Sep 14, 2026 · issue 075

    Censys adds case-insensitive regex to CenQL, 22 new protocol/app scanners, and two new ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. risk fingerprints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Hunt for nginx servers advertised with non-standard casing (e.g. Nginx, NGINX) to catch assets that evade case-sensitive filters.
    copy

    $ host.services.endpoints.http.headers:(key="Server" and value=~"(?i)^nginx$" and not value="nginx")

    Query ASM for assets flagged as vulnerable to the unauthenticated GitLab arbitrary-file-read risk to prioritize patching.
    copy

    $ risks.name: "GitLab Server (CVE-2026-85706)"

    • Adds the (?i) case-insensitive regex operator to the Censys Query Language (CenQL), enabling case-insensitive value=~ pattern matching in host.services.endpoints.http.headers and other string fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds 22 new protocol, application, and endpoint scanners to the Platform, including UTILINET_LPP, ORENCO_ATRTU, OPW_FSC3000 (Critical Infrastructure module), PIGEONHOLE, SAMSUNG_OFFICESERV, CISCO_SDWAN_VDAEMON, VANTAGE_INFUSION, CNORD_SECURITY_CENTER, VISIONHITECH_IPCAM (Starter/Search/Core), and OTLP_GRPC, NETFLIX_NRDP, HIKVISION_DNVRS, SPOTIFY_CONNECT, MANAGESIEVE, LIBP2P, TAURUS_STB, GEOVISION_AUDIO, BLUEMAX_NUTTCP, WOW_REALMD, THRULAY, STOMP, and CLAMAV (all users).
    • Adds two new ASM risk fingerprints queryable via risks.name: Vulnerable GitLab Server (CVE-2026-85706) (unauthenticated arbitrary file read via repository commits API) and Vulnerable GitLab Server (CVE-2026-87719) (authenticated credential leak via GraphQL subscription in GitLab EE).

    3 details in Everything

39. September 8, 2026 (2026-09-08) Sep 8, 2026 · issue 069

    Censys adds interactive host distribution map, SentinelOne integration, AI asset label, and 14 new fingerprints/risks.

    ⤢ ⤢
    └──▷ TRY IT
    Identify hosts in your ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. workspace running end-of-life SonicWall management infrastructure before the September 2026 support deadline passes.
    copy

    $ risks.name:`End-of-Life SonicWall Global Management System`

    Review all newly added ASM risk types — including the five new fingerprints — before they appear in your risk dashboard, since new risk fingerprints may be disabled by default.
    📍In the ASM web console, go to Settings › Risk Type Configuration and review any risk types marked as disabled to enable the new End-of-Life SonicWall and Vulnerable Cacti/Zimbra risks for your workspace.
    • Adds a new ai label for host services and web entities in ASM to surface exposed AI-related assets — covering tools including Ollama, Flowise, Langflow, LibreChat, ComfyUI, ChromaDB Admin, BentoML, Dify, FastGPT, LiteLLM, MLflow, and others.
    • Adds a new SentinelOne integration to automatically or manually enrich IPs, web properties, and certificates in SentinelOne with Censys Platform data, initiate rescans, retrieve scan history for an IP, and launch CensEye automated pivoting jobs.
    • Adds an interactive Host Distribution world map visualization to Platform search results, with a Select Area filter to spatially narrow host query results.
    • Adds nine new fingerprints to the Platform, including IServ, Liquidsoap, SonicWall Analytics, SonicWall Analyzer, SonicWall Global Management System, Zbtlink MQWrt Router, Dinky, RabbitMQ Management, and Zimbra Collaboration.
    • Adds five new ASM risk fingerprints: End-of-Life SonicWall Global Management System, End-of-Life SonicWall Analyzer, End-of-Life SonicWall Analytics, Vulnerable Cacti Server [CVE-2026-40079], and Vulnerable Zimbra Collaboration Server [CVE-2026-73570].
    • Adds a new ai label for host services and web entities in ASM to surface exposed AI-related assets — covering tools including Ollama, Flowise, Langflow, LibreChat, ComfyUI, ChromaDB Admin, BentoML, Dify, FastGPT, LiteLLM, MLflow, and others.
    • Adds a new SentinelOne integration to automatically or manually enrich IPs, web properties, and certificates in SentinelOne with Censys Platform data, initiate rescans, retrieve scan history for an IP, and launch CensEye automated pivoting jobs.
    • Adds an interactive Host Distribution world map visualization to Platform search results, with a Select Area filter to spatially narrow host query results.

    2 more in Everything

40. August 31, 2026 (2026-08-31) Aug 31, 2026 · issue 060

    Censys upgrades host reputation to ML-based scoring with SHAPSHAPA Python library for explaining machine learning model predictions by assigning each input feature a contribution score, giving cyber tools interpretable output from otherwise opaque models. explainability and adds new Forgejo/Gitea fingerprints and risks.

    ⤢
    • Introduces ML-based host reputation scores and labels — each host now receives a label (Benign, Suspicious, Malicious, Honeypot, or Inactive), a 0–100 score, a confidence level, and evidence for the top five signals that influenced the assessment, generated using a SHAP (SHapley Additive exPlanations) model.
    • Adds a new Forgejo software fingerprint to the Platform, enabling detection of self-hosted Forgejo Git forge instances.
    • Adds an Exposed Forgejo Application risk fingerprint to ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them., flagging exposed HTTP services running Forgejo due to the sensitive nature of source code, credentials, and CI/CD configurations they may contain.
    • New risks may be disabled by default in your workspace — review your risk type configuration in the ASM web console to enable them.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Some data fields from the legacy reputation score method changed as a result of the new ML-based reputation release — consult the Censys documentation to identify affected fields before upgrading queries or integrations that rely on them.
41. Guide to 2026 ASM Web Scanning Update (2026-08-31) Aug 31, 2026 · issue 060

    Censys ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. gains web screenshots, full redirect paths, JavaScript library fingerprints, and JavaScript risk detection in its 2026 scanning upgrade.

    • Adds automatic web screenshot capture for every web entity in ASM inventory, with exact timestamps and a historical view over time to surface exposed login pages, admin panels, and potentially compromised infrastructure.
    • Adds full redirect path tracking to detect domain takeovers or incorrect redirect destinations across web entities.
    • Adds JavaScript library fingerprinting using a large number of software fingerprints to surface unknown or unauthorized JS dependencies across web assets.
    • Adds JavaScript risk detection to identify and flag vulnerabilities in EOL libraries and enable rapid response to JS-related incidents such as React2Shell.
    • Switches ASM web scanning to ActiveDNSActiveDNSA large-scale passive DNS dataset collected and maintained by researchers at Michigan State University, giving cyber tools a historical record of domain-to-IP mappings for threat hunting and infrastructure analysis. resolution, increasing detected web entity counts by 0–10% while reducing false-positive host counts by 2–15%.

    +1 more show less

    • Limits web entity instances to a maximum of one per web entity, representing only the most recent active IP resolution rather than all historical resolutions.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The web_entity.instance_count field will have significantly reduced values after migration, as each web entity will have a maximum of one instance instead of multiple historical instances — any dashboards or alerting thresholds based on instance counts will need to be reviewed.
    • !Host counts in ASM inventory will drop by 2–15% as bare IPs that were not seen in the last 24 hours are no longer retained, and only the most recent active resolution is displayed.
42. api-docs-998015abb817 Aug 28, 2026 · issue 058

    Censys API now documents concurrency and RPS limits with a 125-request burst allowance and per-IP throttling.

    ⤢ ⤢
    • Documents organization-level concurrency limits (1/1/25 concurrent requests by tier) shared across all PATsPATsA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. and users, returning 429 on breach — the get host enrichment endpoint is exempt.
    • Documents a 25 RPS per-client-IP leaky-bucket rate limit (smoothed to one request every 40 ms) applied at ingress across all endpoints, returning 503 on breach.
    • Documents a burst allowance of 125 queued requests before throttling kicks in, allowing short spikes above the steady 25 RPS rate.

    3 details in Everything

43. docs update Aug 25, 2026 · issue 056

    Censys Platform Audit Log gains 35 new event types covering ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. risk management, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider., PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. lifecycle, and user authentication.

    ⤢ ⤢ ⤢
    • Adds ASM-specific audit log events: ASM Exclude Created, ASM Exclude Deleted, ASM Risk Instance Accepted, ASM Risk Instance Unaccepted, ASM Risk Instance Severity Changed, ASM Risk Type Disabled, ASM Risk Type Enabled, ASM Risk Type Severity Changed, ASM Seed Created, and ASM Seed Deleted.
    • Adds SAML configuration lifecycle audit events: SAML Config Created, SAML Config Deleted, SAML Config Domain Verified, and SAML Config Updated (Platform and ASM).
    • Adds Personal Access Token audit events PAT Created and PAT Deleted (Platform only).
    • Adds user authentication and account lifecycle audit events: User Login, User Login Failed, User MFA Changed, User Password Changed, User Password Reset, User Settings Changed, User Created, User Disabled, and User Updated.
    • Adds organization and membership audit events: Organization Created, Organization Updated, Organization Deleted, Membership Created, Membership Removed, Membership Updated, Invitation Accepted, Invitation Created, Invitation Deleted, and Invitation Resent.

    5 details in Everything

44. August 24, 2026 (2026-08-24) Aug 24, 2026 · issue 056

    Censys adds geo_distance CenQL function, 6 KB HTTP body search, 2 new fingerprints, and 16 new protocol/app scanners

    └──▷ TRY IT
    Find exposed NRPE agents (Nagios Remote Plugin Executor) within 50 km of a specific data center to assess monitoring infrastructure attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
    copy

    $ services.service_name: NRPE AND geo_distance(host.location.coordinates, 37.7749, -122.4194, 50km)

    Hunt for KNX/IP building-automation endpoints near a target facility — useful for OT/ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. exposure assessments.
    copy

    $ services.service_name: KNXIP AND geo_distance(host.location.coordinates, 51.5074, -0.1278, 25km)

    Search HTTP bodies of web endpoints for a credential string or internal banner that only appears deeper than 2 KB, now reachable with the expanded 6 KB body search.
    copy

    $ web.endpoints.http.body: "Authorization: Bearer internal-" AND web.endpoints.http.body: "env=production"

    • Adds geo_distance function to Censys Query Language (CenQL) for finding assets relative to a geographic location; currently supports host.location.coordinates and host.services.ntrip as target data objects; available to all users.
    • Expands searchable HTTP body size for web.endpoints.http.body (name-based web property endpoints) from 2 KB to 6 KB, enabling more targeted Platform queries.
    • Adds MPLS_LDP (MPLS Label Distribution Protocol, RFC 5036) scanner; available to all users.
    • Adds SMUX (SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. Multiplexing Protocol, RFC 1227) scanner; available to all users.
    • Adds IPERF3 (iPerf3 network-bandwidth measurement control protocol) scanner; available to all users.

    +13 more show less

    • Adds TVT_CONTROL (TVT proprietary remote-management/CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly. control protocol for white-label DVR/NVR/IP camera firmware) scanner; available to all users.
    • Adds DLT (AUTOSAR Diagnostic Log and Trace, dlt-daemon, COVESA/formerly GENIVI) scanner for automotive ECU logging; available to users with access to the Critical Infrastructure module.
    • Adds DUBBO (Apache Dubbo high-performance RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. framework) scanner; available to Starter, Search, and Core users.
    • Adds COMELIT_ICONA (Comelit ICONA Bridge intercom protocol) scanner; available to all users.
    • Adds FOURD_SERVER (4D Server client-server publish protocol) scanner; available to Starter, Search, and Core users.
    • Adds KNXIP (KNXnet/IP, IP-tunneled KNX building-automation bus) scanner; available to Starter, Search, and Core users.
    • Adds NRPE (Nagios Remote Plugin Executor agent) scanner; available to all users.
    • Adds REDSHIFT (AWS Redshift, PostgreSQL-derived analytics DB) scanner; available to Starter, Search, and Core users.
    • Adds MANTICORE_SPHINXAPI (Manticore Search / Sphinx legacy binary SphinxAPI client protocol) scanner; available to Starter, Search, and Core users.
    • Adds HOOSAT_HTND_GRPC (Hoosat Network htnd full-node bidirectional-streaming gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. API) scanner; available to all users.
    • Adds TAILSCALE_DERP (Tailscale Designated Encrypted Relay for Packets) scanner; available to Starter, Search, and Core users.
    • Adds fingerprint for Bifrost software (AI gateway unifying access to OpenAI, Anthropic, AWS Bedrock, and Google Vertex via an OpenAI-compatible API).
    • Adds fingerprint for Juniper Junos OS (modular network OS for Juniper routing, switching, and security devices).

    18 details in Everything

45. August 17, 2026 (2026-08-17) Aug 17, 2026 · issue 049

    Censys adds AI-generated ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. reports, a Kibana/Elasticsearch connector, nine new fingerprints, and two new ASM risk detections.

    ⤢
    └──▷ TRY IT
    Hunt for newly exposed refrigeration controller management interfaces across your monitored attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
    copy

    $ risks.name: "Exposed Copeland XWEB Pro Refrigeration Controller"

    Find any Payara Server installations on your attack surface that are still showing their default, unconfigured landing page — indicating they may be running with default credentials.
    copy

    $ risks.name: "Exposed Payara Server Default Page"

    • Adds two new ASM risk fingerprints queryable via risks.name: "Exposed Copeland XWEB Pro Refrigeration Controller" and risks.name: "Exposed Payara Server Default Page"; new risk types may be disabled by default — review risk type configuration in the ASM web console.
    • New Elasticsearch Kibana connector lets practitioners enrich IPs, web properties, and certificates with Censys Platform data; initiate rescans of hosts or web properties; retrieve event history for an IP address; and launch CensEye automated pivoting jobs to find assets related to an IP, web property, or certificate.
    • Censys Assistant in ASM can now generate custom PDF-ready reports about your attack surface; requires the organization to be migrated to the Platform for team management and the AI Features toggle enabled under Platform Organization Settings > Privacy.
    • Adds nine new fingerprints to the Censys Platform covering: Copeland (Dixell) XWEB Refrigeration Monitoring System (hardware), TP-Link Omada Controller ECSP adopt/transfer ports (software), D-Link DI Series Router (hardware), D-Link DWL Series Access Point (hardware), Gradio (software), JHipster (software), LimeSurvey (software), Meilisearch (software), and Payara Server (software).

    4 details in Everything

46. docs update Aug 11, 2026 · issue 042

    Censys launches AI Investigations (beta) to autonomously pivot across indicators, cluster related infrastructure, and produce ranked reports

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Kick off an infrastructure pivot investigation from a threat-intel report drop — paste the raw indicator list and a date anchor so the agent scopes its search to the relevant activity window.
    📍In the Platform web console, go to AI Investigations. In the prompt window, paste the IP addresses and domain names from your intel report, then add: 'activity was noted on July 30, 2024.' Press Enter to start the investigation.
    • New AI Investigations feature in the Censys Platform web console autonomously analyzes IP addresses, domain names, host/port pairs, URLs, and pasted intel reports to discover related infrastructure in the Censys Internet Map.
    • Accepts historical time context in prompts — single dates, month/quarter/half-year/year ranges, or explicit closed ranges (e.g. '20 January 2025 through 5 February 2025') — to narrow the agent's focus.
    • Investigation agent pivots on shared parsed data attributes, interactively prompts the analyst in the chat window when cluster choices arise, then delivers a CenQL query targeting the discovered asset cluster for immediate use in the Platform.
    • Evidence tab provides a full audit trail of every tool call, decision tree, and pivot, with per-entry detail views (e.g. web.hostname: bancaporinternetbbmx.online) and downloadable evidence artifacts.
    • Reports tab produces up to three output files per investigation: narrative_llm (full narrative with pivot visualizations, decision trees, and recommended actions), intelligence_report.md (polished Mermaid-diagram report with cluster table, CenQL queries, and Platform links; invalid IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. appended as a separate section), and body_intelligence.md (HTTP response body analysis covering page titles, status codes, server banners, TLS certificate SANs, lure-pattern matches, and external script-src URLs).

    +1 more show less

    • Beta limits: three concurrent AI investigations per user, 150 investigations per organization per week, no Censys Credits consumed during closed beta.

    6 details in Everything

47. August 10, 2026 (2026-08-10) Aug 10, 2026 · issue 042

    Censys adds AI Investigations, 64 KB HTTP body search, bulk tag management via cencli tags, and nine new fingerprints.

    ⤢
    └──▷ TRY IT
    Search for hosts whose HTTP response body contains a specific string beyond the old 2 KB limit — useful for finding embedded tokens, framework signatures, or configuration leaks deeper in large pages.
    copy

    $ host.services.endpoints.http.body: "api_secret_key"

    • Expands HTTP body search depth for host.services.endpoints.http.body and web.endpoints.http.body from 2 KB to the first 64 KB, enabling more targeted Platform queries across host service and IP-based web property endpoints.
    • Adds tags commands to the cencli CLI for managing individual and bulk tags in the Censys Platform.
    • Introduces AI Investigations (beta, requires Adversary Investigation module access) to automatically analyze indicators, pivot to related infrastructure, check entity history, profile web resources in parallel, and produce a ranked findings report.
    • Adds nine new fingerprints to the Platform: Omron PLC (hardware), HashiCorp Vault, InfluxDB, Jupyter Server, Oracle Java RMI Registry, Proxmox VE, JBoss JNP Naming Service, Synology DiskStation Manager (DSM), and Tarantool.

    4 details in Everything

48. August 3, 2026 (2026-08-03) Aug 3, 2026 · issue 035

    Censys adds OAuth login to cencli, 12 new platform fingerprints, and 3 new ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. risk detections

    • Adds OAuth authentication support to the cencli command line tool, triggered via censys auth login, which redirects to an authentication page to select an account and approve the connection.
    • Manage OAuth connections through the Connected Applications page in the Platform web console.
    • Adds 3 new ASM risk fingerprints: Exposed json-server Instance (unauthenticated CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. exposure), Exposed PTC Windchill Application (PLM platform reachable from public internet), and Exposed Express Default Page (unconfigured Express.js scaffold in production); new risk types may be disabled by default and are reviewable under risk type configuration in the ASM web console.
    • Adds 12 new software fingerprints to the Platform, covering Bitwarden Server, json-server, nPerf Server, Alinto SOGo, TileServer GL, FMSoft uniGUI, Vaultwarden, PTC Windchill, DevExpress, OpenJS Foundation Express, SearXNG, and Vaadin.

    4 details in Everything

49. docs update Jul 28, 2026 · issue 028

    Censys launches a hosted Adversary Investigation MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, giving AI agents (Cursor, Claude Code, Continue.dev) direct access to threat-hunting APIs.

    └──▷ TRY IT
    Add the Censys Adversary Investigation MCP server to Claude Code so AI-assisted workflows can query threat-hunting data directly.
    copy

    $ claude mcp add censys-threat-hunting https://mcp.platform.censys.io/threat-hunting/mcp/

    Add the MCP server to Cursor via its config file to enable threat-hunting queries inside your AI coding environment.
    json copy

    { "url": "https://mcp.platform.censys.io/threat-hunting/mcp/" }

    • New hosted Adversary Investigation MCP server at https://mcp.platform.censys.io/threat-hunting/mcp/ enables AI coding agents to query Censys threat-hunting data.
    • Supports OAuth and HTTP header authentication for integrating the MCP server with tools like Cursor, Claude Code, and Continue.dev.
    • OAuth connections can be managed from Account Settings > Personal Settings > Connected Applications.

    3 details in Everything

50. docs update Jul 28, 2026 · docs issue 004

    Censys launches a hosted Adversary Investigation MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, giving AI agents (Cursor, Claude Code, Continue.dev) direct access to threat-hunting APIs.

    └──▷ TRY IT
    Add the Censys Adversary Investigation MCP server to Claude Code so AI-assisted workflows can query threat-hunting data directly.
    copy

    $ claude mcp add censys-threat-hunting https://mcp.platform.censys.io/threat-hunting/mcp/

    Add the MCP server to Cursor via its config file to enable threat-hunting queries inside your AI coding environment.
    json copy

    { "url": "https://mcp.platform.censys.io/threat-hunting/mcp/" }

    • New hosted Adversary Investigation MCP server at https://mcp.platform.censys.io/threat-hunting/mcp/ enables AI coding agents to query Censys threat-hunting data.
    • Supports OAuth and HTTP header authentication for integrating the MCP server with tools like Cursor, Claude Code, and Continue.dev.
    • OAuth connections can be managed from Account Settings > Personal Settings > Connected Applications.

    3 details in Everything

51. docs update Jul 28, 2026 · issue 028

    Censys Platform adds OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. Connected Apps management, letting users review and revoke third-party access to Censys APIs.

    └──▷ HOW TO FIND IT
    Audit and revoke third-party OAuth 2 app access to your Censys account after offboarding an integration.
    📍In the Censys Platform UI, go to Account Settings › Personal Settings › Connected Apps, then click the three-dot menu icon next to the connection you want to remove and select Revoke, or click Revoke All to remove all connections at once.
52. docs update Jul 28, 2026 · docs issue 004

    Censys Platform adds OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. Connected Apps management, letting users review and revoke third-party access to Censys APIs.

    └──▷ HOW TO FIND IT
    Audit and revoke third-party OAuth 2 app access to your Censys account after offboarding an integration.
    📍In the Censys Platform UI, go to Account Settings › Personal Settings › Connected Apps, then click the three-dot menu icon next to the connection you want to remove and select Revoke, or click Revoke All to remove all connections at once.
53. July 27, 2026 (2026-07-27) Jul 27, 2026 · issue 028

    Censys adds OAuth MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server setup, 10 new software fingerprints, and 23 new protocol/application scanners.

    └──▷ HOW TO FIND IT
    Connect the Adversary Investigation MCP server to your account using the new OAuth workflow instead of manual credential setup.
    📍In the Platform web console, go to Connected Applications, then follow the OAuth workflow to authorize the Adversary Investigation MCP server.
    • New Connected Applications page in the Platform web console lets users review and manage OAuth connections.
    • Adds 10 new software fingerprints covering Apple HTTPServer, Control Web Panel, Dynatrace, LinuxServer SWAG, Meteor, Microsoft ASP.NET MVC, Microsoft WCF, Oracle Mojarra, Weaver e-cology, and ZKoss ZK Framework.
    • Adds 23 new protocol, application, and endpoint scanners including CORTEX_XDR_P2P, DENON_HEOS, DOTNET_NEGOTIATE_STREAM, ELASTICSEARCH_TRANSPORT, GIOP, INFLUXDB, ISC_DHCP_OMAPI, JUPYTER, KCODES_NETUSB, KEYCLOAK, LANGFLOW, MYSQLX, NGINX_PROXY_MANAGER, PERFORCE_P4D, PROXMOX_VE, QDRANT_GRPC, R1SOFT_BUAGENT, SYNCTHING_BEP, SYNOLOGY_DSM, TARANTOOL, TELEXPER_TLXP, TWAMP_CONTROL, and VAULT.

    3 details in Everything

54. July 20, 2026 (2026-07-20) Jul 20, 2026 · issue 021

    Censys adds Argo CD scanner, three AI tool fingerprints, and three Microsoft SharePoint RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. risks to ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them..

    └──▷ TRY IT
    Identify Microsoft SharePoint servers at risk of unauthenticated RCE (CVE-2026-50522) in your ASM workspace.
    copy

    $ risks.name: "Vulnerable Microsoft SharePoint Server [CVE-2026-50522]"

    Surface SharePoint servers flagged for the CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal.-listed authenticated deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution. RCE (CVE-2026-45659) across your inventory.
    copy

    $ risks.name: "Microsoft SharePoint Server Authenticated Deserialization RCE [CVE-2026-45659]"

    • Adds new endpoint scanner for Argo CD (ARGOCD), available to Starter, Search, and Core users.
    • Adds fingerprints for three AI/no-code tools: Anything LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code., Capacity, and Softr.
    • Adds three new ASM risks for Microsoft SharePoint Server covering CVE-2026-45659 (authenticated deserialization RCE, CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.-listed), CVE-2026-50522, and CVE-2026-58644 (both unauthenticated deserialization RCE).
    • Publishes Censys ARC Rapid Response advisory for Microsoft SharePoint Server RCE [CVE-2026-50522, CVE-2026-58644] with platform, ASM, and legacy search queries to identify exposed instances.

    4 details in Everything

55. July 13, 2026 (2026-07-13) Jul 13, 2026 · issue 015

    Censys Assistant gains page-aware context and 8 new fingerprints added to the Platform.

    └──▷ HOW TO FIND IT
    Investigate an unfamiliar service on a host without copy-pasting asset details — open the Assistant directly from a host page and ask about exposed services in context.
    📍In the Platform, navigate to a host detail page, open the Censys Assistant panel, and ask 'What services on this host are unusual or potentially exposed?' — the Assistant automatically uses the current host as context.
    • Censys Assistant now automatically reads the current page (host, certificate, web property, search result, or collection) as context when opened, enabling deeper questions about specific assets without manually specifying them.
    • Adds 8 new fingerprints to the Platform: Chatto, RedHat Cockpit, D-Link DAP Series Access Point, BigBlueButton, Monospace Directus, Google Mod PageSpeed, Hugo, and Streamlit.

    2 details in Everything

56. July 6, 2026 (2026-07-06) Jul 6, 2026 · issue 014

    Censys Active DNS goes GA, adds Live Resolution, 11 new fingerprints, GOPHER scanner, and 2 new ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. CVE risk fingerprints.

    └──▷ HOW TO FIND IT
    Surface all exposed Cacti servers in your ASM workspace that are vulnerable to the newly tracked pre-auth SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. CVE.
    📍In the ASM web console, go to Risk Types configuration and enable Vulnerable Cacti Server [CVE-2026-39955], then filter your risks view with: risks.name:Vulnerable Cacti Server [CVE-2026-39955]
    Check whether a domain your team is investigating currently resolves in DNS, even if it isn't yet indexed in Censys datasets.
    📍In Censys Search or Censys Core, open the Active DNS section, enter the target FQDN, and select Live Resolution to retrieve real-time DNS records or confirm the domain does not currently resolve.
    Hunt for Wordfence Security plugin installations across the internet to identify WordPress assets in your scope.
    copy

    $ In Censys Search, run the query: services.software.product:`Wordfence Security`

    • Censys Active DNS is now generally available to all Censys Search and Censys Core users, enabling domain-to-host relationship mapping, infrastructure change analysis over time, and extensive DNS record review.
    • New Live Resolution feature lets users retrieve DNS records for domains not currently present in Censys datasets, with explicit confirmation when an FQDN does not resolve.
    • Adds 11 new platform fingerprints covering hardware (D-Link DCS Network Camera), firmware (Lantronix G Series), and software (Wordfence Security, Advanced Custom Fields, All in One SEO, Autoptimize, and more WordPress plugins).
    • New GOPHER protocol scanner added to the Platform, available to Starter, Search, and Core users.
    • Two new ASM risk fingerprints added for Vulnerable Cacti Server CVE-2026-39938 (unauthenticated local file inclusion / potential RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives.) and CVE-2026-39955 (pre-auth SQL injection in graph_view.php) on Cacti 1.2.30 and prior.

    5 details in Everything

57. June 29, 2026 (2026-06-29) Jun 29, 2026 · issue 014

    Censys adds 16 new software/hardware fingerprints and a Gogs RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. risk detection (CVE-2026-52813) to Platform and ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them..

    └──▷ TRY IT
    Identify internet-exposed OpenVPN instances in your ASM inventory to audit unexpected VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. endpoints.
    copy

    $ Platform query: software.product: OpenVPN

    Surface assets in your ASM workspace that are vulnerable to the Gogs RCE (CVE-2026-52813) for immediate patching prioritization.
    copy

    $ risks.name: "Vulnerable Gogs [CVE-2026-52813]"

    Enable the new Gogs CVE-2026-52813 risk type if it was disabled by default in your workspace.
    📍In the ASM web console, go to Settings › Risk Type Configuration and enable Vulnerable Gogs [CVE-2026-52813].
    • Adds 15 new Platform software fingerprints covering OpenVPN, Tor, TeamViewer, FreeSWITCH, OpenFlow, RTMP, Redfish, HL7, Bubble, Lovable, Replit, Synergy, EZVIZ IP Camera, GeoVision NVR, Reolink IP Camera, and Windows CE embedded OS.
    • New ASM risk fingerprint detects hosts running Gogs versions vulnerable to CVE-2026-52813, an unauthenticated path traversal enabling remote code executionremote code executionRemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. via Git hook overwrite.
    • All new fingerprints are queryable in the Censys Platform; new ASM risk types may be disabled by default and must be reviewed in the ASM web console risk type configuration.

    3 details in Everything

58. June 22, 2026 (2026-06-22) Jun 22, 2026 · issue 014

    Censys adds bulk API asset tagging, Okta SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning, 8 new protocol scanners, and 6 new software fingerprints.

    └──▷ TRY IT
    Identify all exposed Splunk instances in your ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. workspace that are potentially vulnerable to the newly tracked CVE-2026-20253 RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. flaw.
    copy

    $ risks.name:"Vulnerable Splunk Enterprise [CVE-2026-20253]"

    Confirm new ASM risk fingerprints (like the Splunk CVE risk) are enabled — they may be off by default.
    📍In the ASM web console, go to Settings › Risk Type Configuration and review newly added risk types to enable them for your workspace.
    • Adds bulk asset tagging via API: assign or un-assign a tag to every asset matching a CenQL query in a single operation.
    • Supports SCIM provisioning via Okta, enabling Platform Admins to automatically provision and de-provision Censys users from their IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
    • Adds 8 new protocol/application scanners: CLICKHOUSE_NATIVE, CLICKHOUSE_HTTP, OPENFLOW, REOLINK_BAICHUAN, RTMP, SYNERGY, WINCE_CERDISP, and WORDPRESS.
    • Adds 6 new software fingerprints: REDCap, Joomla, Joomla Content Editor (JCE), WooCommerce, ChromaDB Admin, and Splunk.
    • Adds new ASM risk fingerprint detecting Vulnerable Splunk Enterprise instances affected by CVE-2026-20253 (unauthenticated arbitrary file creation/truncation leading to RCE), queryable via risks.name:Vulnerable Splunk Enterprise [CVE-2026-20253].

    5 details in Everything

59. June 15, 2026 (2026-06-16) Jun 16, 2026 · issue 014

    Censys adds a lightweight Host Enrichment API built for high-volume SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. automation in SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents./SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. pipelines.

    • New Host Enrichment API delivers a curated, fixed subset of IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. host data optimized for high-volume, automated lookups without traditional credit consumption.
    • Supports SIEM and SOAR integrations, enabling SOC teams to operationalize external internet data at scale.

    2 details in Everything