https://cybertoolchain.io/tools/censys New releases and features in Censys, tracked by The Cyber Toolchain. en Mon, 02 Nov 2026 23:42:51 GMT https://docs.censys.com/changelog/november-2-2026 https://docs.censys.com/changelog/november-2-2026 Mon, 02 Nov 2026 23:42:51 GMT Censys adds Starter and Starter Pro subscription tiers, flattens credit costs to one credit per action, and adds two new Platform fingerprints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Free and Starter users now have all UI and API actions cost one credit each, replacing the previous tiered costs (lookup: 1 credit, standard search: 5 credits, advanced/regex query: 8 credits), so monthly allotments now go further.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Every Free and Starter user now gets five free Platform actions per day. • Censys adds two new subscription tiers: Censys Starter ($79/month, 500 credits, one-month rollover) and Censys Starter Pro ($599/month, 4,000 credits), purchasable from the Plan page in the Platform web console. • Censys Starter subscribers gain access to additional API endpoints including `search`, `aggregate`, and all `collections` endpoints, plus tags and comments. • Censys adds a new `Wordpress Plugin - Gravity Forms` software fingerprint to the Platform. • Censys adds a new `Cisco NX-OS` OS fingerprint to the Platform. Breaking changes: • Censys Credit packs can no longer be purchased. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/october-26-2026 https://docs.censys.com/changelog/october-26-2026 Mon, 26 Oct 2026 17:18:55 GMT Censys adds a fingerprint observation API endpoint, four new Platform fingerprints, and updates four SIEM/SOAR integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a new fingerprint observation API endpoint in the Adversary Investigation module to retrieve which TLS certificate chains an IP has presented, on which ports, and when — enabling infrastructure-change spotting and host pivoting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Updates the ServiceNow TISC integration (v1.1.0) to add the option to use the host enrichment API when enriching host assets, and updates the `ip` and `cen-rescan` commands in the Palo Alto XSOAR integration (v3.2.3) to include reputation details and network/privacy details from the IPinfo source in human-readable output, plus additional context outputs. • Adds four new software fingerprints to the Platform — `changedetection.io`, `CLIProxyAPI`, `MarkLogic Server`, and `ManageEngine OpManager` — and a new ASM risk fingerprint `Vulnerable PHP (php2shell) [CVE-2026-109618 / CVE-2026-109619]`, queryable via `risks.name: 'Vulnerable PHP (php2shell) [CVE-2026-109618 / CVE-2026-109619]'`. • Updates the SentinelOne Singularity Operations Center enrichment workflows and the Microsoft Sentinel integration (v3.0.1) to show host reputation labels and scores at the top of notes added to alerts and in comments added to incidents, respectively. • Expands the `php` fingerprint to include inferred presence from over 30 other software fingerprints in both the Platform and ASM. • Adds the Censys ARC PHP2Shell dashboard to track worldwide PHP exposure over time. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/october-19-2026 https://docs.censys.com/changelog/october-19-2026 Mon, 19 Oct 2026 20:28:18 GMT Censys adds an in-app feedback portal, reorganized UI navigation, 10 new platform fingerprints, and hundreds of new ASM CVE risks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an in-app Censys Platform Feedback Portal for submitting feedback and tracking feature requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Reorganizes the Censys Platform UI and search actions into three sections: Investigate, Defend, and Intelligence. • Moves search history to its own tab on the upper right corner of the search results page. • Renames the 'Reports' tab to 'Aggregate' in the Platform UI. • Relocates documentation, Academy, and Data Definitions resources to the Help and Feedback menu in the top right. • Adds 10 new software fingerprints to the Platform: Ahsay Cloud Backup Suite (AhsayCBS), IBM MCP Context Forge, Nextcloud Collabora Online Built-in CODE Server, OliveTin, Perforce P4 Search (formerly HelixSearch), phpBB, pyLoad, Softaculous Virtualizor, ThinkPHP, and ZITADEL. • Adds several hundred new CVE risks for JavaScript libraries and web component fingerprints to ASM. • Publishes five new Censys ARC Rapid Response advisories covering AnyDesk Linux, GitLab CI/CD, Ivanti Connect Secure, Collabora Online Built-in CODE Server, and BeyondTrust Remote Support/Privileged Remote Access. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/october-13-2026 https://docs.censys.com/changelog/october-13-2026 Tue, 13 Oct 2026 18:11:37 GMT Censys adds PQC key exchange fields on host/web endpoints, Splunk integration v1.2.0 with host enrichment API, and Sentinel log ingestion API support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `key_exchange_group` and `pqc_groups` fields to host services and web property endpoints, exposing post-quantum cryptography (PQC) key exchange group data including ML-KEM (Kyber) and hybrid exchanges like X25519MLKEM768.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Censys Splunk Platform integration v1.2.0 adds support for the get host enrichment API endpoint, configurable as the default instead of the get host API endpoint. • Censys Splunk Platform integration v1.2.0 adds a workflow action and a custom command for related infrastructure data. • Censys Splunk Platform integration v1.2.0 adds a Splunk ES adaptive response for related infrastructure data. • Censys Splunk Platform integration v1.2.0 adds new data enrichment fields for reputation score, GreyNoise, IPinfo, and Mallory. • Updates the ASM integration with Microsoft Sentinel to use the log ingestion API instead of the retired Azure Monitor HTTP data collection API. • Adds five new fingerprints to the Platform: Cudy WR3000 Router (hardware), OpenPrinting CUPS (software), OSGeo GeoNetwork (software), Midoks mdserver-web (software), and Sangoma Switchvox (software). Breaking changes: • The ASM integration with Microsoft Sentinel no longer uses the Azure Monitor HTTP data collection API (retired September 14, 2026); existing setups must migrate to the log ingestion API configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/reference https://docs.censys.com/reference Sat, 10 Oct 2026 08:16:29 GMT Censys API now supports Personal Access Tokens and Service Accounts for application authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Personal Access Token (PAT) authentication for the Censys API, enabling secure programmatic access without exposing user credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Service Accounts support to connect applications with Censys Platform APIs without using a personal user account. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/october-8-2026 https://docs.censys.com/changelog/october-8-2026 Thu, 08 Oct 2026 21:22:30 GMT Censys ASM gains screenshots, redirect chains, network logs, and expanded software fingerprints for web entities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds screenshots for every web entity in inventory, captured at the time of the most recent scan and timestamped by 'Last Updated', enabling rapid identification of exposed login pages, admin panels, and potentially compromised infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds full redirect chain visibility on web entities to detect domain takeovers or incorrect redirect destinations. • Adds network log view on web entities listing all resources loaded during a full DOM evaluation, including JS libraries, scripts, images, and stylesheets. • Adds software fingerprints with full coverage for jQuery, AngularJS, Bootstrap, WordPress, WooCommerce, and Astro to surface unknown or unauthorized web dependencies. • Adds ability to accept CVE risk instances on host and web entity assets, accepting all CVE risks associated with a given risk instance at once. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/october-5-2026 https://docs.censys.com/changelog/october-5-2026 Mon, 05 Oct 2026 20:29:51 GMT Censys adds redesigned RBAC, service accounts, GA AI investigations with six new API endpoints, and new fingerprints/risks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds six new API endpoints for AI investigations: `Investigations: Create file upload`, `Investigations: Create job`, `Investigations: Get job results`, `Investigations: Get job status`, `Investigations: Get usage`, and `Investigations: List jobs` — enabling programmatic initiation, polling, and retrieval of AI investigation reports and evidence (ZIP archive) from the Adversary Investigation module.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Investigations: Create job` endpoint that accepts indicators, previously uploaded evidence files (PDF, text, or image), or both, and returns a `job_id` for polling. • Adds `Investigations: Create file upload` endpoint that returns a URL for uploading PDF, text, or image files to use as investigation evidence. • Adds service accounts to the Platform so applications can connect to Platform APIs without requiring a personal user account. • Redesigns Platform role-based access control (RBAC) with Platform-level and module-specific roles for more granular resource access management across organization users. • Makes the AI investigations feature in the Adversary Investigation module generally available (GA). • Adds three new software fingerprints to the Platform: ASUS Control Center, FileRun, and JFrog Artifactory. • Adds a new risk fingerprint to ASM for `Vulnerable MikroTik RouterOS [CVE-2026-67279, CVE-2026-86060, CVE-2026-67276]`, detectable via `risks.name`. • Publishes two new Censys ARC Rapid Response advisories covering Citrix NetScaler ADC/Gateway Zero-Day RCE and Fortinet FortiMail Path Traversal, with Platform and ASM queries to identify exposed instances. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/september-28-2026 https://docs.censys.com/changelog/september-28-2026 Mon, 28 Sep 2026 19:57:35 GMT Censys adds AI Skills plugin for cencli-powered agents and raises AI investigator batch limit to 100 indicators.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the `censys-ai-skills` repo, a Claude plugin that exposes `cencli` commands to AI agents for asset lookups, investigations, and CensEye job execution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Raises the Adversary Investigation AI investigator batch limit from 35 to 100 indicators per submission. • Adds two new fingerprints to the Platform: `software Kiteworks PCN` and `software Kiteworks Secure MFT Server`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/september-21-2026 https://docs.censys.com/changelog/september-21-2026 Mon, 21 Sep 2026 21:56:22 GMT Censys adds ServiceNow TISC integration, 16 new platform fingerprints, and two new ASM risk fingerprints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a ServiceNow TISC integration to automatically or manually enrich IPs, web properties, and certificates in ServiceNow TISC with Censys Platform data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the ability to initiate a Censys rescan of a host or web property directly from ServiceNow TISC. • Adds the ability to retrieve scan history for an IP address from within ServiceNow TISC. • Adds the ability to initiate a CensEye automated pivoting job from ServiceNow TISC to find assets related to an IP, web property, or certificate. • Adds 16 new platform fingerprints covering Check Point Security Management and Log Server, Apache CloudStack, Apache Cocoon, Cisco Secure Email Gateway, Citrix XenMobile Server, Docker Registry Browser, GeoVision GeoWebServer, IBM WebSphere Liberty, Lucee, OpenMetadata, phpList, Plone, PrivateBin, pypiserver, Roadiz CMS, and TYPO3. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/september-14-2026 https://docs.censys.com/changelog/september-14-2026 Mon, 14 Sep 2026 18:37:51 GMT Censys adds case-insensitive regex to CenQL, 22 new protocol/app scanners, and two new ASM risk fingerprints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the (?i) case-insensitive regex operator to the Censys Query Language (CenQL), enabling case-insensitive `value=~` pattern matching in `host.services.endpoints.http.headers` and other string fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds 22 new protocol, application, and endpoint scanners to the Platform, including `UTILINET_LPP`, `ORENCO_ATRTU`, `OPW_FSC3000` (Critical Infrastructure module), `PIGEONHOLE`, `SAMSUNG_OFFICESERV`, `CISCO_SDWAN_VDAEMON`, `VANTAGE_INFUSION`, `CNORD_SECURITY_CENTER`, `VISIONHITECH_IPCAM` (Starter/Search/Core), and `OTLP_GRPC`, `NETFLIX_NRDP`, `HIKVISION_DNVRS`, `SPOTIFY_CONNECT`, `MANAGESIEVE`, `LIBP2P`, `TAURUS_STB`, `GEOVISION_AUDIO`, `BLUEMAX_NUTTCP`, `WOW_REALMD`, `THRULAY`, `STOMP`, and `CLAMAV` (all users). • Adds two new ASM risk fingerprints queryable via `risks.name`: 'Vulnerable GitLab Server (CVE-2026-85706)' (unauthenticated arbitrary file read via repository commits API) and 'Vulnerable GitLab Server (CVE-2026-87719)' (authenticated credential leak via GraphQL subscription in GitLab EE). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/september-8-2026 https://docs.censys.com/changelog/september-8-2026 Tue, 08 Sep 2026 20:41:09 GMT Censys adds interactive host distribution map, SentinelOne integration, AI asset label, and 14 new fingerprints/risks. • Adds a new `ai` label for host services and web entities in ASM to surface exposed AI-related assets — covering tools including Ollama, Flowise, Langflow, LibreChat, ComfyUI, ChromaDB Admin, BentoML, Dify, FastGPT, LiteLLM, MLflow, and others. • Adds a new SentinelOne integration to automatically or manually enrich IPs, web properties, and certificates in SentinelOne with Censys Platform data, initiate rescans, retrieve scan history for an IP, and launch CensEye automated pivoting jobs. • Adds an interactive Host Distribution world map visualization to Platform search results, with a 'Select Area' filter to spatially narrow host query results. • Adds nine new fingerprints to the Platform, including IServ, Liquidsoap, SonicWall Analytics, SonicWall Analyzer, SonicWall Global Management System, Zbtlink MQWrt Router, Dinky, RabbitMQ Management, and Zimbra Collaboration. • Adds five new ASM risk fingerprints: End-of-Life SonicWall Global Management System, End-of-Life SonicWall Analyzer, End-of-Life SonicWall Analytics, Vulnerable Cacti Server [CVE-2026-40079], and Vulnerable Zimbra Collaboration Server [CVE-2026-73570]. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/august-31-2026 https://docs.censys.com/changelog/august-31-2026 Mon, 31 Aug 2026 18:35:50 GMT Censys upgrades host reputation to ML-based scoring with SHAP explainability and adds new Forgejo/Gitea fingerprints and risks. • Introduces ML-based host reputation scores and labels — each host now receives a label (`Benign`, `Suspicious`, `Malicious`, `Honeypot`, or `Inactive`), a 0–100 score, a confidence level, and evidence for the top five signals that influenced the assessment, generated using a SHAP (SHapley Additive exPlanations) model. • Adds a new `Forgejo` software fingerprint to the Platform, enabling detection of self-hosted Forgejo Git forge instances. • Adds an `Exposed Forgejo Application` risk fingerprint to ASM, flagging exposed HTTP services running Forgejo due to the sensitive nature of source code, credentials, and CI/CD configurations they may contain. • New risks may be disabled by default in your workspace — review your risk type configuration in the ASM web console to enable them. Breaking changes: • Some data fields from the legacy reputation score method changed as a result of the new ML-based reputation release — consult the Censys documentation to identify affected fields before upgrading queries or integrations that rely on them. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/guide-to-2026-asm-web-scanning-update https://docs.censys.com/changelog/guide-to-2026-asm-web-scanning-update Mon, 31 Aug 2026 18:13:20 GMT Censys ASM gains web screenshots, full redirect paths, JavaScript library fingerprints, and JavaScript risk detection in its 2026 scanning upgrade. • Adds automatic web screenshot capture for every web entity in ASM inventory, with exact timestamps and a historical view over time to surface exposed login pages, admin panels, and potentially compromised infrastructure. • Adds full redirect path tracking to detect domain takeovers or incorrect redirect destinations across web entities. • Adds JavaScript library fingerprinting using a large number of software fingerprints to surface unknown or unauthorized JS dependencies across web assets. • Adds JavaScript risk detection to identify and flag vulnerabilities in EOL libraries and enable rapid response to JS-related incidents such as React2Shell. • Switches ASM web scanning to ActiveDNS resolution, increasing detected web entity counts by 0–10% while reducing false-positive host counts by 2–15%. • Limits web entity instances to a maximum of one per web entity, representing only the most recent active IP resolution rather than all historical resolutions. Breaking changes: • The `web_entity.instance_count` field will have significantly reduced values after migration, as each web entity will have a maximum of one instance instead of multiple historical instances — any dashboards or alerting thresholds based on instance counts will need to be reviewed. • Host counts in ASM inventory will drop by 2–15% as bare IPs that were not seen in the last 24 hours are no longer retained, and only the most recent active resolution is displayed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/reference https://docs.censys.com/reference Fri, 28 Aug 2026 14:40:08 GMT Censys API now documents concurrency and RPS limits with a 125-request burst allowance and per-IP throttling. • Documents organization-level concurrency limits (1/1/25 concurrent requests by tier) shared across all PATs and users, returning `429` on breach — the get host enrichment endpoint is exempt. • Documents a 25 RPS per-client-IP leaky-bucket rate limit (smoothed to one request every 40 ms) applied at ingress across all endpoints, returning `503` on breach. • Documents a burst allowance of 125 queued requests before throttling kicks in, allowing short spikes above the steady 25 RPS rate. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/august-24-2026 https://docs.censys.com/changelog/august-24-2026 Mon, 24 Aug 2026 23:42:38 GMT Censys adds geo_distance CenQL function, 6 KB HTTP body search, 2 new fingerprints, and 16 new protocol/app scanners • Adds `geo_distance` function to Censys Query Language (CenQL) for finding assets relative to a geographic location; currently supports `host.location.coordinates` and `host.services.ntrip` as target data objects; available to all users. • Expands searchable HTTP body size for `web.endpoints.http.body` (name-based web property endpoints) from 2 KB to 6 KB, enabling more targeted Platform queries. • Adds `MPLS_LDP` (MPLS Label Distribution Protocol, RFC 5036) scanner; available to all users. • Adds `SMUX` (SNMP Multiplexing Protocol, RFC 1227) scanner; available to all users. • Adds `IPERF3` (iPerf3 network-bandwidth measurement control protocol) scanner; available to all users. • Adds `TVT_CONTROL` (TVT proprietary remote-management/CMS control protocol for white-label DVR/NVR/IP camera firmware) scanner; available to all users. • Adds `DLT` (AUTOSAR Diagnostic Log and Trace, `dlt-daemon`, COVESA/formerly GENIVI) scanner for automotive ECU logging; available to users with access to the Critical Infrastructure module. • Adds `DUBBO` (Apache Dubbo high-performance RPC framework) scanner; available to Starter, Search, and Core users. • Adds `COMELIT_ICONA` (Comelit ICONA Bridge intercom protocol) scanner; available to all users. • Adds `FOURD_SERVER` (4D Server client-server publish protocol) scanner; available to Starter, Search, and Core users. • Adds `KNXIP` (KNXnet/IP, IP-tunneled KNX building-automation bus) scanner; available to Starter, Search, and Core users. • Adds `NRPE` (Nagios Remote Plugin Executor agent) scanner; available to all users. • Adds `REDSHIFT` (AWS Redshift, PostgreSQL-derived analytics DB) scanner; available to Starter, Search, and Core users. • Adds `MANTICORE_SPHINXAPI` (Manticore Search / Sphinx legacy binary SphinxAPI client protocol) scanner; available to Starter, Search, and Core users. • Adds `HOOSAT_HTND_GRPC` (Hoosat Network htnd full-node bidirectional-streaming gRPC API) scanner; available to all users. • Adds `TAILSCALE_DERP` (Tailscale Designated Encrypted Relay for Packets) scanner; available to Starter, Search, and Core users. • Adds fingerprint for `Bifrost` software (AI gateway unifying access to OpenAI, Anthropic, AWS Bedrock, and Google Vertex via an OpenAI-compatible API). • Adds fingerprint for `Juniper Junos OS` (modular network OS for Juniper routing, switching, and security devices). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/august-17-2026 https://docs.censys.com/changelog/august-17-2026 Mon, 17 Aug 2026 20:48:51 GMT Censys adds AI-generated ASM reports, a Kibana/Elasticsearch connector, nine new fingerprints, and two new ASM risk detections. • Adds two new ASM risk fingerprints queryable via `risks.name: "Exposed Copeland XWEB Pro Refrigeration Controller"` and `risks.name: "Exposed Payara Server Default Page"`; new risk types may be disabled by default — review risk type configuration in the ASM web console. • New Elasticsearch Kibana connector lets practitioners enrich IPs, web properties, and certificates with Censys Platform data; initiate rescans of hosts or web properties; retrieve event history for an IP address; and launch CensEye automated pivoting jobs to find assets related to an IP, web property, or certificate. • Censys Assistant in ASM can now generate custom PDF-ready reports about your attack surface; requires the organization to be migrated to the Platform for team management and the AI Features toggle enabled under Platform Organization Settings > Privacy. • Adds nine new fingerprints to the Censys Platform covering: Copeland (Dixell) XWEB Refrigeration Monitoring System (hardware), TP-Link Omada Controller ECSP adopt/transfer ports (software), D-Link DI Series Router (hardware), D-Link DWL Series Access Point (hardware), Gradio (software), JHipster (software), LimeSurvey (software), Meilisearch (software), and Payara Server (software). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/august-10-2026 https://docs.censys.com/changelog/august-10-2026 Mon, 10 Aug 2026 20:32:43 GMT Censys adds AI Investigations, 64 KB HTTP body search, bulk tag management via `cencli tags`, and nine new fingerprints. • Expands HTTP body search depth for `host.services.endpoints.http.body` and `web.endpoints.http.body` from 2 KB to the first 64 KB, enabling more targeted Platform queries across host service and IP-based web property endpoints. • Adds `tags` commands to the `cencli` CLI for managing individual and bulk tags in the Censys Platform. • Introduces AI Investigations (beta, requires Adversary Investigation module access) to automatically analyze indicators, pivot to related infrastructure, check entity history, profile web resources in parallel, and produce a ranked findings report. • Adds nine new fingerprints to the Platform: Omron PLC (hardware), HashiCorp Vault, InfluxDB, Jupyter Server, Oracle Java RMI Registry, Proxmox VE, JBoss JNP Naming Service, Synology DiskStation Manager (DSM), and Tarantool. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/august-3-2026 https://docs.censys.com/changelog/august-3-2026 Mon, 03 Aug 2026 19:00:13 GMT Censys adds OAuth login to cencli, 12 new platform fingerprints, and 3 new ASM risk detections • Adds OAuth authentication support to the `cencli` command line tool, triggered via `censys auth login`, which redirects to an authentication page to select an account and approve the connection. • Manage OAuth connections through the Connected Applications page in the Platform web console. • Adds 3 new ASM risk fingerprints: `Exposed json-server Instance` (unauthenticated CRUD REST API exposure), `Exposed PTC Windchill Application` (PLM platform reachable from public internet), and `Exposed Express Default Page` (unconfigured Express.js scaffold in production); new risk types may be disabled by default and are reviewable under risk type configuration in the ASM web console. • Adds 12 new software fingerprints to the Platform, covering Bitwarden Server, json-server, nPerf Server, Alinto SOGo, TileServer GL, FMSoft uniGUI, Vaultwarden, PTC Windchill, DevExpress, OpenJS Foundation Express, SearXNG, and Vaadin. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/july-27-2026 https://docs.censys.com/changelog/july-27-2026 Mon, 27 Jul 2026 21:12:00 GMT Censys adds OAuth MCP server setup, 10 new software fingerprints, and 23 new protocol/application scanners. • New Connected Applications page in the Platform web console lets users review and manage OAuth connections. • Adds 10 new software fingerprints covering Apple HTTPServer, Control Web Panel, Dynatrace, LinuxServer SWAG, Meteor, Microsoft ASP.NET MVC, Microsoft WCF, Oracle Mojarra, Weaver e-cology, and ZKoss ZK Framework. • Adds 23 new protocol, application, and endpoint scanners including CORTEX_XDR_P2P, DENON_HEOS, DOTNET_NEGOTIATE_STREAM, ELASTICSEARCH_TRANSPORT, GIOP, INFLUXDB, ISC_DHCP_OMAPI, JUPYTER, KCODES_NETUSB, KEYCLOAK, LANGFLOW, MYSQLX, NGINX_PROXY_MANAGER, PERFORCE_P4D, PROXMOX_VE, QDRANT_GRPC, R1SOFT_BUAGENT, SYNCTHING_BEP, SYNOLOGY_DSM, TARANTOOL, TELEXPER_TLXP, TWAMP_CONTROL, and VAULT. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/july-20-2026 https://docs.censys.com/changelog/july-20-2026 Mon, 20 Jul 2026 17:46:47 GMT Censys adds Argo CD scanner, three AI tool fingerprints, and three Microsoft SharePoint RCE risks to ASM. • Adds new endpoint scanner for Argo CD (ARGOCD), available to Starter, Search, and Core users. • Adds fingerprints for three AI/no-code tools: Anything LLM, Capacity, and Softr. • Adds three new ASM risks for Microsoft SharePoint Server covering CVE-2026-45659 (authenticated deserialization RCE, CISA KEV-listed), CVE-2026-50522, and CVE-2026-58644 (both unauthenticated deserialization RCE). • Publishes Censys ARC Rapid Response advisory for Microsoft SharePoint Server RCE [CVE-2026-50522, CVE-2026-58644] with platform, ASM, and legacy search queries to identify exposed instances. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/july-13-2026 https://docs.censys.com/changelog/july-13-2026 Mon, 13 Jul 2026 21:05:18 GMT Censys Assistant gains page-aware context and 8 new fingerprints added to the Platform. • Censys Assistant now automatically reads the current page (host, certificate, web property, search result, or collection) as context when opened, enabling deeper questions about specific assets without manually specifying them. • Adds 8 new fingerprints to the Platform: Chatto, RedHat Cockpit, D-Link DAP Series Access Point, BigBlueButton, Monospace Directus, Google Mod PageSpeed, Hugo, and Streamlit. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/july-6-2026 https://docs.censys.com/changelog/july-6-2026 Mon, 06 Jul 2026 21:04:39 GMT Censys Active DNS goes GA, adds Live Resolution, 11 new fingerprints, GOPHER scanner, and 2 new ASM CVE risk fingerprints. • Censys Active DNS is now generally available to all Censys Search and Censys Core users, enabling domain-to-host relationship mapping, infrastructure change analysis over time, and extensive DNS record review. • New Live Resolution feature lets users retrieve DNS records for domains not currently present in Censys datasets, with explicit confirmation when an FQDN does not resolve. • Adds 11 new platform fingerprints covering hardware (D-Link DCS Network Camera), firmware (Lantronix G Series), and software (Wordfence Security, Advanced Custom Fields, All in One SEO, Autoptimize, and more WordPress plugins). • New GOPHER protocol scanner added to the Platform, available to Starter, Search, and Core users. • Two new ASM risk fingerprints added for Vulnerable Cacti Server CVE-2026-39938 (unauthenticated local file inclusion / potential RCE) and CVE-2026-39955 (pre-auth SQL injection in graph_view.php) on Cacti 1.2.30 and prior. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/june-29-2026 https://docs.censys.com/changelog/june-29-2026 Mon, 29 Jun 2026 18:41:41 GMT Censys adds 16 new software/hardware fingerprints and a Gogs RCE risk detection (CVE-2026-52813) to Platform and ASM. • Adds 15 new Platform software fingerprints covering OpenVPN, Tor, TeamViewer, FreeSWITCH, OpenFlow, RTMP, Redfish, HL7, Bubble, Lovable, Replit, Synergy, EZVIZ IP Camera, GeoVision NVR, Reolink IP Camera, and Windows CE embedded OS. • New ASM risk fingerprint detects hosts running Gogs versions vulnerable to CVE-2026-52813, an unauthenticated path traversal enabling remote code execution via Git hook overwrite. • All new fingerprints are queryable in the Censys Platform; new ASM risk types may be disabled by default and must be reviewed in the ASM web console risk type configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/june-22-2026 https://docs.censys.com/changelog/june-22-2026 Mon, 22 Jun 2026 19:57:15 GMT Censys adds bulk API asset tagging, Okta SCIM provisioning, 8 new protocol scanners, and 6 new software fingerprints. • Adds bulk asset tagging via API: assign or un-assign a tag to every asset matching a CenQL query in a single operation. • Supports SCIM provisioning via Okta, enabling Platform Admins to automatically provision and de-provision Censys users from their IdP. • Adds 8 new protocol/application scanners: CLICKHOUSE_NATIVE, CLICKHOUSE_HTTP, OPENFLOW, REOLINK_BAICHUAN, RTMP, SYNERGY, WINCE_CERDISP, and WORDPRESS. • Adds 6 new software fingerprints: REDCap, Joomla, Joomla Content Editor (JCE), WooCommerce, ChromaDB Admin, and Splunk. • Adds new ASM risk fingerprint detecting Vulnerable Splunk Enterprise instances affected by CVE-2026-20253 (unauthenticated arbitrary file creation/truncation leading to RCE), queryable via `risks.name:Vulnerable Splunk Enterprise [CVE-2026-20253]`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys https://docs.censys.com/changelog/june-15-2026 https://docs.censys.com/changelog/june-15-2026 Tue, 16 Jun 2026 17:23:14 GMT Censys adds a lightweight Host Enrichment API built for high-volume SOC automation in SIEM/SOAR pipelines. • New Host Enrichment API delivers a curated, fixed subset of IPv4/IPv6 host data optimized for high-volume, automated lookups without traditional credit consumption. • Supports SIEM and SOAR integrations, enabling SOC teams to operationalize external internet data at scale. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/censys