https://cybertoolchain.io/tools/lynis New releases and features in Lynis, tracked by The Cyber Toolchain. en Thu, 25 Jun 2026 08:55:17 GMT https://github.com/CISOfy/lynis/releases/tag/3.1.7 https://github.com/CISOfy/lynis/releases/tag/3.1.7 Thu, 25 Jun 2026 08:55:17 GMT Lynis 3.1.7 expands EOL database with CachyOS, NixOS, AlmaLinux, openSUSE Leap, and updated RHEL/Ubuntu/Alpine/Fedora dates. • Adds CachyOS to the OS end-of-life database (with corrected OS detection support). • Adds NixOS EOL data to the end-of-life database. • Adds AlmaLinux to the EOL database. • Adds openSUSE Leap to the EOL database. • Adds EOL dates for Alpine 3.22 and 3.23. • Adds EOL dates for Ubuntu 25.10 and 26.04. • Updates RHEL 8 EOL date and adds RHEL 9 and 10 dates. • Adds and updates Fedora EOL dates including Fedora 43. • Adds Debian 13 EOL date. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lynis https://github.com/CISOfy/lynis/releases/tag/3.1.6 https://github.com/CISOfy/lynis/releases/tag/3.1.6 Thu, 23 Oct 2025 12:02:38 GMT Lynis 3.1.6 adds CachyOS/macOS Tahoe/OpenMandriva support, NFLOG iptables detection, and improved Wazuh agent detection. • Adds notice to screen output when a platform's end-of-life state is unclear. • Supports three new platforms: CachyOS, macOS Tahoe, and OpenMandriva Lx. • FIRE-4586: Accepts NFLOG as a valid logging target when auditing iptables firewall rules. • MALW-3280: Improved detection of the Wazuh agent. • ACCT-9634: Defines a default auditd log file location for accounting checks. • Releases older than 6 months are now flagged as old (previously the threshold was higher), surfaced directly in screen output rather than as a generic suggestion. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lynis https://github.com/CISOfy/lynis/releases/tag/3.1.5 https://github.com/CISOfy/lynis/releases/tag/3.1.5 Tue, 29 Jul 2025 07:24:07 GMT Lynis 3.1.5 adds OpenWrt support, Bitdefender detection on Linux, and openSUSE Tumbleweed-Slowroll recognition. • Adds full audit support for OpenWrt, including HostID and HostID2 generation on that platform. • Detects Bitdefender antivirus installations on Linux during security audits. • Recognizes openSUSE Tumbleweed-Slowroll as a distinct distribution. • Extends kernel module checks to also scan under `/usr/lib/modules.d`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lynis https://github.com/CISOfy/lynis/releases/tag/3.1.4 https://github.com/CISOfy/lynis/releases/tag/3.1.4 Tue, 28 Jan 2025 12:01:37 GMT Lynis 3.1.4 adds macOS Sequoia support and powerpc64le authentication checks. • Adds macOS Sequoia to the list of recognized platforms for auditing. • Supports powerpc64le architecture in the authentication section. • Updates the end-of-life (EOL) database with new entries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lynis https://github.com/CISOfy/lynis/releases/tag/3.1.3 https://github.com/CISOfy/lynis/releases/tag/3.1.3 Mon, 16 Dec 2024 09:23:57 GMT Lynis 3.1.3 adds detection for four new Linux distributions including Fedora Linux Asahi Remix and Garden Linux. • Adds OS detection for Buildroot, Fedora Linux Asahi Remix, Garden Linux, and Peppermint OS. • Adds links to blog posts and articles within suggestions to provide context for missing control information. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lynis https://github.com/CISOfy/lynis/releases/tag/3.1.2 https://github.com/CISOfy/lynis/releases/tag/3.1.2 Thu, 26 Sep 2024 13:39:01 GMT Lynis 3.1.2 adds macOS FileVault encryption test, Wazuh integration, and seven new OS detections. • Detects seven new Linux/OS platforms: ALT Linux, Athena OS, Container-Optimized OS (Google), Koozali SME Server, Nobara Linux, OSMC, and PostmarketOS. • New test CRYP-7932 checks macOS FileVault full-disk encryption status. • New test FILE-6398 checks whether the JBD (Journal Block Device) kernel driver is loaded. • New test FINT-4344 checks whether the Wazuh agent is running. • New test PKGS-7305 queries macOS applications in /Applications and CoreServices. • Adds Wazuh as a recognized malware scanner, antivirus, and rootkit detection tool (MALW/LOGG checks). • Adds ESET Endpoint Antivirus detection to MALW-3200. • Adds Microsoft Defender Antivirus detection to MALW-3291. • Adds version numbers to Homebrew package output in PKGS-7303. • Extends Slackware support with installed-package querying via functionPackageIsInstalled(). • Adds 'prosecute' and 'report' to LEGAL_BANNER_STRINGS for legal banner checks. • Adds inetd package and service name for Ubuntu 24.04 to INSE-8000. • Extends CONT-8104 to detect errors (not only warnings) in docker info output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lynis https://github.com/CISOfy/lynis/releases/tag/3.1.1 https://github.com/CISOfy/lynis/releases/tag/3.1.1 Sun, 17 Mar 2024 10:32:39 GMT Lynis 3.1.1 adds ArcoLinux detection and Redis path updates • Adds `Detection of ArcoLinux` to support the ArcoLinux distribution Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lynis https://github.com/CISOfy/lynis/releases/tag/3.1.0 https://github.com/CISOfy/lynis/releases/tag/3.1.0 Mon, 11 Mar 2024 10:01:28 GMT Lynis 3.1.0 adds translation support, new OS detections, and SentinelOne integration capabilities. • Adds `STATUS_NOT_ACTIVE` variable to translation files for localizing inactive status messages • Adds Indonesian language translation pack Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lynis https://github.com/CISOfy/lynis/blob/master/CHANGELOG.md https://github.com/CISOfy/lynis/blob/master/CHANGELOG.md Thu, 03 Aug 2023 00:00:00 GMT Lynis 3.0.9 adds plocate file locations, newer MongoDB auth format support, and SSH compression logic update. • `FILE-6410` check now includes `plocate` locations for system database queries • `DBS-1820` updated to recognize the newer style format for Mongo authorization settings • `SSH-7408` test logic refined to only evaluate Compression if sshd version is < 7.4 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lynis https://github.com/CISOfy/lynis/releases/tag/3.0.7 https://github.com/CISOfy/lynis/releases/tag/3.0.7 Tue, 18 Jan 2022 13:28:06 GMT Lynis 3.0.7 adds OpenRC service manager support and detection for RHEL 6, Funtoo Linux, Garuda Linux, and arch-audit • `openrc` is now supported as a service manager, expanding platform coverage beyond systemd and SysVinit. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lynis