https://cybertoolchain.io/tools/snyk New releases and features in Snyk, tracked by The Cyber Toolchain. en Thu, 29 Oct 2026 09:00:00 GMT https://updates.snyk.io/snyk-api-and-webs-security-checks-now-cover-extra-hosts/ https://updates.snyk.io/snyk-api-and-webs-security-checks-now-cover-extra-hosts/ Thu, 29 Oct 2026 09:00:00 GMT Snyk API & Web now runs security header, cookie attribute, and SSL/TLS checks against every Extra Host configured on a target⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Snyk API & Web now applies security header, cookie attribute, and SSL/TLS checks — including 'HSTS header not enforced' and 'Missing Content Security Policy header' — to every Extra Host configured on a target, not just the primary target URL endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Breaking changes: • Scans of targets with Extra Hosts configured will now report new security header, cookie attribute, and SSL/TLS findings for those hosts — existing targets may show new findings on their next scan even if nothing on the target has changed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/announcing-snyk-cli-v1-1308-1/ https://updates.snyk.io/announcing-snyk-cli-v1-1308-1/ Wed, 14 Oct 2026 14:22:00 GMT Snyk CLI v1.1308.1 adds a 'Pending Ignore Request' status and filter to the Project Issues page, plus API support for pending ignore status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `pending` as a reportable ignore status in the issues API, enabling programmatic distinction between open, pending, and ignored findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a 'Pending Ignore Request' status indicator on the Project's Issues page and in issue details when a finding is awaiting Ignore Approval Workflow review. • Adds a 'Pending Ignore' filter to the Issues list alongside the existing Open and Ignored filters, so reviewers can triage the pending-approval queue without scanning every issue. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/ads-installer-now-available-as-a-packaged-binary/ https://updates.snyk.io/ads-installer-now-available-as-a-packaged-binary/ Fri, 02 Oct 2026 07:41:56 GMT Snyk adds signed macOS .pkg and Windows .msi ADS installers plus a new Snyk API & Web DAST scanning capability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds signed macOS `.pkg` and Windows `.msi` packaged installers for the ADS (Agent Supply Chain Security) agent, downloadable from the Settings page in Evo, eliminating the need to wrap a downloaded file in a custom script.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • The ADS installer registers a scheduled job on the host machine so Agent Supply Chain Security scans run on their own schedule without requiring MDM. • Introduces Snyk API & Web, a new dynamic application security testing (DAST) scanning capability supporting web targets, API targets (Postman Collection, RAML, Bruno Collection in OpenCollection format), and authentication methods including basic auth, login form, login sequence, two-factor authentication, OpenAPI, Postman, GraphQL, and mutual TLS. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/snyk-for-jira-moves-from-atlassian-connect-to-forge/ https://updates.snyk.io/snyk-for-jira-moves-from-atlassian-connect-to-forge/ Wed, 23 Sep 2026 13:12:36 GMT Snyk: Introduces Evo by Snyk with an MCP Server surface for agentic security use cases. • Migrates Snyk for Jira from Atlassian Connect to Forge, Atlassian's current cloud app platform, ahead of Atlassian's December 2026 end-of-support deadline. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/evo-mcp-server-now-available/ https://updates.snyk.io/evo-mcp-server-now-available/ Wed, 23 Sep 2026 07:43:31 GMT Snyk's Evo gains an MCP server so Claude, Codex, or Cursor can query your AI asset estate and manage policies in-agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the Evo MCP Server (GA), letting any MCP client — Claude, Codex, Cursor — query discovered AI assets across code, developer machines, and pentest targets, inspect asset relationships (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ which MCP servers an agent uses), and read or write policies without leaving the agent. • Adds `snyk fix --agentic` CLI command, which applies and verifies vulnerability fixes. • Adds DNS TXT record verification as a method to confirm domain ownership for Snyk API & Web targets. • Adds Snyk Studio, which embeds security directives into AI-assisted development workflows. • Adds an IDE Plugin Compatibility Matrix documenting compatible Snyk CLI version ranges for each IDE plugin version released in the past 12 months. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/announcing-snyk-cli-v1-1307-3/ https://updates.snyk.io/announcing-snyk-cli-v1-1307-3/ Fri, 18 Sep 2026 12:26:23 GMT Snyk CLI v1.1307.3 adds per-project .snyk policy resolution; API & Web gains custom internal CA upload for DAST scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for uploading your organization's internal Root CA certificate in Snyk API & Web, so certificates it issues are trusted during DAST scans alongside the public trust store.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • `snyk test` now reports an unreadable `.snyk` policy file as error code `SNYK-POLICY-0002` with a descriptive message instead of an unspecified error. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/snyk-assist-in-ui/ https://updates.snyk.io/snyk-assist-in-ui/ Sat, 05 Sep 2026 07:37:26 GMT Snyk Assist brings an AI-powered support and guidance assistant — including vulnerability lookups and support case creation — directly into the Snyk UI. • Adds Snyk Assist, an AI-powered assistant accessible from the top right of every page in the new Snyk UI, answering product, setup, and troubleshooting questions grounded in Snyk documentation, release notes, and support knowledge articles — available on Team, Ignite, and Enterprise plans. • Enables read-only account information retrieval via Snyk Assist: issue summaries by severity, issue triage and single-issue detail, projects and import targets, collections and container images, scan settings, integrations and their connectivity status, members and their roles, and a project's current ignore rules — scoped to the current organization and group using your existing permissions. • Allows Snyk Assist to look up known vulnerabilities for a package or specific package version against the Snyk Vulnerability Database without leaving the UI. • Allows Snyk Assist to suggest and create a support case from within the conversation, returning the case ID and link, and to capture unsupported capabilities as feature requests. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/repo-content-sync/ https://updates.snyk.io/repo-content-sync/ Mon, 31 Aug 2026 16:00:00 GMT Snyk Repo Content Sync (GA) automatically creates and deactivates Projects as manifest, Dockerfile, and IaC files are added, moved, or removed from monitored branches. • Introduces Repo Content Sync (GA for Enterprise plans): Snyk automatically creates Projects for newly merged manifest, Dockerfile, and IaC configuration files, and deactivates Projects whose files are removed or renamed — no manual re-import required. • Repo Content Sync is on by default for Enterprise organizations with no configuration required; organizations already opted in through Snyk Preview retain their existing setting. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/organization-scoped-access-in-evo/ https://updates.snyk.io/organization-scoped-access-in-evo/ Wed, 26 Aug 2026 09:08:59 GMT Snyk Evo now scopes repository, asset, and issue visibility to a user's Snyk Organizations via existing role hierarchy. • The `Tenant Viewer` role now grants scoped read-only access to assets and issues limited to the Organizations the user belongs to, replacing the previous full-Tenant visibility. • The `Tenant Member` role now carries no Evo access, enabling administrators to withhold Evo without removing a user's broader Snyk platform access. • New users default to `Tenant Member` on join, requiring an explicit role change to gain any Evo access. • Organization names now appear alongside repositories in Evo, disambiguating the same repository imported into multiple Organizations. • Assets without an assigned Organization — currently all Agent Supply Chain Security and Continuous Offensive Security data — are hidden from scoped users. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/new-snyk-ui/ https://updates.snyk.io/new-snyk-ui/ Mon, 24 Aug 2026 14:05:05 GMT Snyk rolls out a redesigned UI with unified navigation, Cmd/Ctrl+K command search, and Dark Mode. • Adds `Cmd/Ctrl+K` navigation search to jump directly to any page or setting without menu-hunting. • Introduces Dark Mode (System/Light/Dark) selectable from the user account menu, consistent across all pages. • Replaces the classic multi-scope sidebar with a single breadcrumb bar supporting one-click scope switching via per-level drop-downs for Tenant, Group, and Organization. • Consolidates all settings-related pages into a single context-aware Settings hub, with the left sidebar condensed to core areas: Analytics, Inventory, Projects, Issues, Policies, and Settings. • Users can toggle freely between classic and new navigation via the user account menu. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/model-risk-score-evo-ga/ https://updates.snyk.io/model-risk-score-evo-ga/ Wed, 19 Aug 2026 17:47:09 GMT Evo by Snyk replaces Risk Index with a 0–1,000 impact-weighted model risk score and adds Continuous Offensive Security (COS) capability. • Introduces Continuous Offensive Security (COS) in Evo by Snyk, a new offensive scanning capability covering Targets, Scans, and Findings and Reports — with dedicated docs for defining target scope, configuring authentication, managing targets, monitoring scans, and interpreting results. • Replaces the previous Risk Index with a new model risk score (0–1,000) that combines attack success rate with impact weighting, tested across prompt injection, data exfiltration, and insecure code generation attack categories. • Adds four severity bands to the model risk score: low (0–249), medium (250–499), high (500–749), and critical (750–1,000) for at-a-glance triage. • Maps model risk findings to OWASP LLM Top 10, OWASP Agentic Security, MITRE ATLAS, and NIST AI 600-1/100-2e2025 compliance frameworks via new Framework mappings documentation. • Enables custom policies in Evo scoped to specific attack categories or goals, in addition to automatically applied default policies across common attack categories. • Adds a `snyk fix` CLI command (new docs page added at `commands/fix.md`). • Introduces a Remediation Agent capability (new docs at `agent-security/remediation-agent/remediation-agent.md`). Breaking changes: • Policies built on the old Risk Index remain visible but no longer evaluate under the new model risk score — existing Risk Index-based policies must be reviewed and recreated against the new model risk score to keep enforcement active. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/ntlm-authentication-in-snyk-api-and-web/ https://updates.snyk.io/ntlm-authentication-in-snyk-api-and-web/ Thu, 06 Aug 2026 10:57:27 GMT Snyk API & Web adds NTLM v2 authentication support, enabling authenticated DAST scans of Windows-protected internal applications. • Adds NTLM v2 authentication support for Web targets in Snyk API & Web, configurable via Target Settings > Authentication tab in the Basic Auth / NTLM module, with fields for username, password, domain, and workstation — enabling authenticated scans of Windows-protected internal applications without separate tooling. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/atac/ https://updates.snyk.io/atac/ Tue, 28 Jul 2026 16:02:53 GMT Snyk DAST gains AI-powered authenticated scan setup and native Bruno collection support for API targets. • Adds Automatic Target Authentication Configuration for DAST: AI-driven setup automatically generates login sequences, handles 2FA, and maps CSS selectors, with natural-language instructions for complex scenarios. • Supports native Bruno collection imports for API Targets — upload via ZIP or folder without converting to Postman or OpenAPI formats first. • Syncs Bruno collection environments automatically and warns when variables are missing required secret values during import. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/announcing-snyk-cli-v1-1306-0/ https://updates.snyk.io/announcing-snyk-cli-v1-1306-0/ Thu, 09 Jul 2026 12:30:00 GMT Snyk CLI v1.1306.0 adds a new `snyk doctor` diagnostic command, broader Java/JVM and .NET container scanning, and MCP breakability evaluation on by default. • New `snyk doctor` command diagnoses common CLI problems by generating a diagnostic report for your system or analyzing debug log output. • Container scans now detect the Java runtime version across a wider range of JVM base images. • Container scans can now find vulnerabilities in .NET application dependencies. • The breakability evaluation tool in the Snyk MCP Server is now enabled by default and no longer requires an experimental flag. • Shows a warning when a request is automatically retried due to rate limiting, improving visibility into throttled scans. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/snyk-open-source-ecosystem-coverage-update/ https://updates.snyk.io/snyk-open-source-ecosystem-coverage-update/ Sun, 28 Jun 2026 00:00:00 GMT Snyk Open Source adds native `uv` package manager support and private dependency scanning for Go. • Adds `uv` package manager support in SCM integrations, enabled for Groups and Organizations through Snyk Preview. • Adds support for Go private dependencies via Broker or direct connections Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/snyk-code-july-release-c-rules-java-library-coverage-and-javascript-insecure-transmission/ https://updates.snyk.io/snyk-code-july-release-c-rules-java-library-coverage-and-javascript-insecure-transmission/ Fri, 26 Jun 2026 15:00:00 GMT Snyk Code adds 6 new C++ rules, broader C++ native detection, expanded Java library coverage, and a JS/TS Insecure Transmission rule. • New C++ rule: Log Forging (CWE-117, high) — detects untrusted user input reaching logging sinks, enabling log forgery or corruption. • New C++ rule: Improper Privilege Management (CWE-269, high) — flags unverified privilege-dropping calls that may leave processes running with elevated privileges. • New C++ rule: Missing Authorization (CWE-862/CWE-732) — detects world-writable/world-executable file permissions and root UID/GID passed to privilege-escalation or file-ownership functions. • New C++ rule: SSL/TLS Certificate Verification Bypass (CWE-295, medium) — detects disabled certificate verification across OpenSSL, Qt, mbedTLS, libcurl, Boost.Asio, libpq, and libpqxx. • New C++ rule: Insecure TLS Configuration (CWE-327, high) — detects enablement of outdated TLS versions and other insecure TLS settings. • New C++ rule: Sensitive Cookie Without Secure Attribute (CWE-614, low) — flags cookies missing the Secure attribute, exposing them to MitM attacks. • New JavaScript/TypeScript rule: Insecure Transmission (CWE-319) — detects cleartext transmission beyond HTTP, with initial coverage for Redis clients (@redis/client, ioredis, redis) connecting over non-TLS redis:// URLs. • Extended C++ native detection for Code Injection (CWE-94) across dlopen, LoadLibrary, Lua, CPython, Duktape, and QuickJS. • Extended C++ native detection for Insecure Storage (CWE-922) across sqlite, realm, leveldb, rocksdb, lmdb, and Qt. • Extended C++ native Insecure Cipher (CWE-327) coverage across OpenSSL, Botan, libsodium, libtomcrypt, libgcrypt, Crypto++, and mbedTLS. • Expanded Java library detection coverage for Azure SDK (com.azure:azure-core), Logback (ch.qos.logback:logback-classic), Reactor Netty HTTP (io.projectreactor.netty:reactor-netty-http), Apache Kafka clients (org.apache.kafka:kafka-clients), and Jackson (jackson-databind, jackson-core). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/snyk-code-july-release-c-rules-java-library-coverage-and-javascript-insecure-transmission/ https://updates.snyk.io/snyk-code-july-release-c-rules-java-library-coverage-and-javascript-insecure-transmission/ Fri, 26 Jun 2026 00:00:00 GMT Snyk Code announces C++ rules, broader Java library coverage, and JavaScript Insecure Transmission detection for the July 13, 2026 release. • Adds six new C++ detection rules: Log Forging, Improper Privilege Management, Missing Authorization, SSL/TLS Certificate Verification Bypass, Insecure TLS Configuration, Sensitive Cookie Without Secure Attribute, and expands native C++ coverage for Code Injection, Insecure Storage, and Insecure Cipher. • Adds new `Insecure Transmission` rule-key for JavaScript/TypeScript to detect cleartext transmission over insecure transports (e.g., non-TLS Redis URLs), separate from existing `HttpToHttps` logic. • Expands detection coverage for Java libraries including Azure SDK, Logback, Reactor Netty HTTP, Apache Kafka clients, and Jackson. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://snyk.io/blog/governing-ai-agents-inside-execution-loop/ https://snyk.io/blog/governing-ai-agents-inside-execution-loop/ Tue, 23 Jun 2026 04:00:00 GMT Snyk Evo ADS launches agent behavior governance in Open Preview to observe, detect, and block risky AI agent actions in real time. • New agent behavior governance capability (Open Preview) integrates directly into the agent execution loop via PreToolUse and PostToolUse APIs to evaluate actions before and after execution. • Session-aware behavioral monitoring tracks the full sequence of agent actions — shell commands, file reads/writes, network requests, MCP tool invocations, and external API calls — across an entire workflow rather than in isolation. • Continuous behavioral risk detections identify emerging threats from patterns of agent actions (e.g., sensitive file access combined with network exfiltration) that traditional artifact-based security misses. • Real-time governance actions let organizations choose to log findings silently, block policy-violating actions outright, steer agent behavior by injecting security guidance into the workflow, or require explicit human approval before high-risk operations proceed. • Human-in-the-loop checkpoints can be configured to pause agent execution and request user approval before sensitive, unusual, or high-impact operations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://snyk.io/blog/agentic-development-security-ads/ https://snyk.io/blog/agentic-development-security-ads/ Tue, 23 Jun 2026 04:00:00 GMT Snyk launches Agentic Development Security (ADS) to govern AI agent supply chains, behavior, and generated code in real time. • New Evo ADS platform continuously discovers and inventories MCP servers, tools, skills, and external services used by AI agents, evaluating each against security signals such as permissions, provenance, known vulnerabilities, and organizational policy. • Introduces policy-based controls to identify and block unapproved, restricted, or high-risk MCP server components, with remediation guidance surfaced directly to development teams. • Adds agent behavior governance operating inside the execution loop — evaluating requested actions against session context, user intent, and policy before they execute, blocking high-risk actions and intercepting policy violations in real time (currently in Open Preview). • Enables secure-at-inception checks for AI-generated code via asynchronous, lightweight hooks embedded directly into AI coding workflows, scanning for vulnerabilities, insecure dependencies, infrastructure misconfigurations, and secrets before code reaches a repository or CI pipeline. • Optimizes token consumption in AI coding environments by injecting security findings into the agent context window only when actionable issues are detected in newly generated code — clean scans incur zero additional context overhead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://snyk.io/blog/secure-developer-program/ https://snyk.io/blog/secure-developer-program/ Thu, 18 Jun 2026 04:00:00 GMT Snyk offers full AI Security Platform free to open source maintainers, plus a new Remediation Agent for merge-ready fixes. • Launches Secure Developer Program giving qualifying open source maintainers free access to the full Snyk AI Security Platform, including Snyk Open Source, Snyk Code, Snyk Container, and Snyk IaC. • Introduces Snyk Remediation Agent (open preview in the CLI for design partners) that pairs frontier-model reasoning with Snyk's intelligence layer to produce validated, merge-ready fixes for SCA and SAST issues. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/snyk-learn-lesson-roundup-whats-new-in-june/ https://updates.snyk.io/snyk-learn-lesson-roundup-whats-new-in-june/ Wed, 17 Jun 2026 12:00:00 GMT Snyk Learn adds three new AI security lessons on agentic RCE, memory poisoning, and inter-agent communication. • New AI-Sec lesson: Unexpected Code Execution (RCE) — covers how agentic systems can be tricked into executing unauthorized code. • New AI-Sec lesson: Memory and Context Poisoning — explains how corrupted agent memory can silently alter AI reasoning and decisions. • New AI-Sec lesson: Insecure Inter-Agent Communication — teaches exploitation of weak communication protections between agents. • Expanded OWASP Top 10 lesson coverage now available in Python, Rust, and Ruby. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/automatically-close-obsolete-fix-open-source-prs-with-help-from-snyk-now-generally-available/ https://updates.snyk.io/automatically-close-obsolete-fix-open-source-prs-with-help-from-snyk-now-generally-available/ Tue, 16 Jun 2026 04:00:00 GMT Snyk now auto-closes stale Open Source Fix PRs by default, with a configurable daily closure limit. • Enables automatic closing of obsolete Open Source Fix PRs for all organizations by default, triggered during recurring tests when the targeted dependency is removed, transitively updated, or manually fixed. • Adds a configurable maximum number of obsolete PRs Snyk will close per day, giving teams rate control over automated closures. • Allows administrators to opt out of automatic PR closure via the organization settings page. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/automatically-close-obsolete-fix-open-source-prs-with-help-from-snyk-now-generally-available/ https://updates.snyk.io/automatically-close-obsolete-fix-open-source-prs-with-help-from-snyk-now-generally-available/ Tue, 16 Jun 2026 00:00:00 GMT Snyk now auto-closes obsolete open source fix PRs by default and allows configuring the daily limit. • Enables automatic closing of outdated Open Source Fix Pull Requests by default for all organizations • Adds a configuration option to set the maximum number of obsolete PRs Snyk will close per day Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/assess-secure-at-inception-effectiveness-with-the-prevention-report-early-access/ https://updates.snyk.io/assess-secure-at-inception-effectiveness-with-the-prevention-report-early-access/ Wed, 03 Jun 2026 00:00:00 GMT New Prevention report in Early Access tracks proactive vulnerability fixes across IDE, CLI, and MCP surfaces. • Adds the Early Access `Prevention` report to track vulnerabilities developers proactively remediate in Snyk Code and Secrets before pull requests or production. • Introduces a `Fix-by-Developer` leaderboard to identify developers who squash vulnerabilities earliest in the lifecycle. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/snyk-code-june-update/ https://updates.snyk.io/snyk-code-june-update/ Thu, 28 May 2026 00:00:00 GMT Snyk Code announces expanded .NET crypto detection and PHP SQL injection interfile analysis for June 15, 2026. • Adds TLS vulnerability detection (CWE-326) for .NET HTTP and network stacks including ServicePointManager, HttpClientHandler, WinHttpHandler, SocketsHttpHandler, Kestrel, and SslStream. • Broadens Insecure Cipher coverage (CWE-327) for .NET C# and VB to include BouncyCastle third-party library support and flags algorithms such as PAKE, Triple DES, DES, Skipjack, RC4, RC2, MD-5, and SHA-1. • Expands weak-key-size detection (CWE-326) for .NET native standard-library types (ECDHE, ECDH, ECDSA, RSA, AES GCM, HMAC-SHA1/2/3) and adds third-party support for DH, DHE (BouncyCastle), AES-XTS (BouncyCastle), and CMAC-AES (BouncyCastle). • Enables PHP SQL injection interfile taint flow detection through wrapper classes where the sink is defined in a wrapper class (caller → wrapper → mysql_query). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/more-flexibility-when-exporting-table-data-to-csv-with-snyk-api-and-web/ https://updates.snyk.io/more-flexibility-when-exporting-table-data-to-csv-with-snyk-api-and-web/ Wed, 20 May 2026 00:00:00 GMT Expanded field selection for table data export in Snyk API & Web • Extends flexibility of the existing `Download CSV` feature for external analysis and custom reporting. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/announcing-snyk-cli-v1-1305-0/ https://updates.snyk.io/announcing-snyk-cli-v1-1305-0/ Wed, 20 May 2026 00:00:00 GMT Snyk CLI v1.1305.0 adds SBOM generation resilience, parallel container monitoring via env var, and experimental MCP breakability tool. • Adds `--allow-incomplete-sbom` flag to `snyk sbom` command to generate output even when individual projects fail resolution • Adds `SNYK_REQUEST_CONCURRENCY` environment variable to configure parallel dependency request concurrency for `snyk container monitor` • Adds an experimental breakability evaluation tool to the Snyk MCP Server Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/snyk-studio-introducing-asynchronous-hooks-based-guardrails-for-ai-agents/ https://updates.snyk.io/snyk-studio-introducing-asynchronous-hooks-based-guardrails-for-ai-agents/ Mon, 11 May 2026 00:00:00 GMT Snyk Studio introduces asynchronous hooks-based guardrails in Early Access, with automated installation for supported agentic development environments. • Adds a new hooks-based guardrail architecture to Snyk Studio that runs security scans asynchronously in the background, replacing the previous rules-based model. • Adds an automated installation script that configures `/snyk-fix`, `/snyk-batch-fix`, MCP server, and secure dependency health check skills on supported Agentic Development Environments (ADEs). • Enables MDM-based distribution of the Snyk Studio hooks installation script for enterprise-wide deployment on Windows and Mac. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/snyk-learn-lesson-roundup-whats-new-in-may/ https://updates.snyk.io/snyk-learn-lesson-roundup-whats-new-in-may/ Mon, 11 May 2026 00:00:00 GMT Snyk Learn adds AI Secure Development learning path, Evo interface lesson, and 'Feedback' button on learn.snyk.io • Launches the 'AI Secure Development' learning path with new lessons on prompt engineering, AI app development, and securing autonomous workflows. • Adds 'Navigating the Evo Interface' lesson to familiarize users with the unified agentic interface in Evo by Snyk. • Adds a new 'Feedback' button on learn.snyk.io (login required) to share feedback and topic suggestions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/new-analytics-overview-widgets/ https://updates.snyk.io/new-analytics-overview-widgets/ Fri, 08 May 2026 00:00:00 GMT New Analytics Overview widgets for PR checks and Snyk Studio Agentic Scans activity. • Adds 'Total PR checks' widget to the analytics overview dashboard • Adds 'PR Check success rate' widget to the analytics overview dashboard • Adds 'Agentic Scans' metric widget from Snyk Studio to the analytics overview • Adds 'Developers running agentic scans' metric widget to the analytics overview Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/expanded-container-jvm-support/ https://updates.snyk.io/expanded-container-jvm-support/ Thu, 30 Apr 2026 00:00:00 GMT Snyk Container begins a gradual GA rollout of JVM detection beyond OpenJDK 8 through file fingerprinting in CLI and Container Registry integrations. • Adds container vulnerability scanning for Eclipse Temurin and Adoptium OpenJDK distributions that follow the `/opt/java/openjdk/release` layout. • Automatic detection of Java versions in containers using the `/opt/java/openjdk/release` layout, requiring no manual configuration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/identify-cisa-kev-vulnerabilities-for-compliance/ https://updates.snyk.io/identify-cisa-kev-vulnerabilities-for-compliance/ Wed, 22 Apr 2026 00:00:00 GMT New CISA KEV filter available in UI issue filters for compliance prioritization • Adds a new 'CISA KEV' filter to the UI issue filters on any page where they are available • Enables isolation of vulnerabilities within the CISA KEV catalog with a single click Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/announcing-repo-monitor-configuration/ https://updates.snyk.io/announcing-repo-monitor-configuration/ Wed, 15 Apr 2026 00:00:00 GMT Snyk introduces Repo Monitor Configuration in Early Access for centralized Group Inventory monitoring, bulk repository imports, and on-demand retesting. • Adds Repo Monitor Configuration to the Group-level Inventory page for centralized management of repository coverage and monitoring settings • Enables view of monitoring status for all products and identification of health status and required actions in a single view • Provides bulk import of repositories from the Group Inventory page into specific Snyk Organizations • Adds on-demand retesting trigger for specific repositories directly from the Group Inventory page • Introduces actionable error resolution guidance for testing failures due to integration issues or entitlements Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/repo-content-sync-in-early-access/ https://updates.snyk.io/repo-content-sync-in-early-access/ Mon, 13 Apr 2026 00:00:00 GMT Snyk introduces Repo Content Sync in Early Access for Enterprise customers through Snyk Preview, automating project creation and deactivation as SCM files change. • Enables native, automated synchronization between Source Code Management (SCM) tools and Snyk to eliminate manual re-imports • Automatically detects new files and creates corresponding Snyk projects for manifest, Docker, or configuration files added in the SCM • Automatically deactivates Snyk projects when associated manifest files are deleted from the connected SCM Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/native-graphql-scanning-for-snyk-api-and-web/ https://updates.snyk.io/native-graphql-scanning-for-snyk-api-and-web/ Fri, 10 Apr 2026 00:00:00 GMT Snyk adds native GraphQL scanning to API & Web with introspection schema fetching and dedicated auth settings • Adds GraphQL as a supported DAST API target type in Snyk API & Web • Enables schema ingestion directly from an introspection endpoint alongside existing URL or file upload options Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/announcing-native-uv-support-for-the-snyk-cli/ https://updates.snyk.io/announcing-native-uv-support-for-the-snyk-cli/ Thu, 09 Apr 2026 00:00:00 GMT Snyk introduces native `uv` support in Early Access for CLI `test`, `monitor`, and `sbom` workflows, enabled through Snyk Preview. • Extends `uv` scanning support to the Snyk IDE extensions, MCP server, and GitHub Actions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/test-target-configuration-for-smoother-scans-with-snyk-api-and-web/ https://updates.snyk.io/test-target-configuration-for-smoother-scans-with-snyk-api-and-web/ Thu, 09 Apr 2026 00:00:00 GMT New Test configuration option in UI to validate target settings before DAST scans. • Adds `Test configuration` option to the Scan dropdown menu and Target Settings page to verify accessibility and configuration of a target before running a full DAST scan. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/announcing-snyk-cli-v1-1304-0/ https://updates.snyk.io/announcing-snyk-cli-v1-1304-0/ Wed, 08 Apr 2026 00:00:00 GMT Snyk CLI v1.1304.0 adds `snyk aibom test` command for AI-BOM validation • `snyk aibom test` command for generating and validating AI-BOMs against tenant policies • Agent Red Teaming scanned output now includes a vulnerability summary with exhaustive and eager modes • Extended support for Java runtime binary scanning in container scans Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/snyk_package_health_check-for-snyk-studio-is-now-available-in-full-profile/ https://updates.snyk.io/snyk_package_health_check-for-snyk-studio-is-now-available-in-full-profile/ Tue, 07 Apr 2026 00:00:00 GMT snyk_package_health_check MCP tool is generally available by default for npm, PyPI, Maven, NuGet, and Golang. • `snyk_package_health_check` is now included in the Snyk Studio Full (default) profile for MCP workflows, enabling AI agents to evaluate open-source packages before they are added to a project. • Provides package health guidance across Security, Maintenance, Community, and Popularity, with outcomes Healthy, Review recommended, Not recommended, or Unknown/insufficient data. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/pr-check-report-is-now-generally-available/ https://updates.snyk.io/pr-check-report-is-now-generally-available/ Tue, 07 Apr 2026 00:00:00 GMT PR check report GA adds date-filtered adoption metrics, optimized UI tables, and Export API access for PR scanning data. • PR check report moves to general availability • Adds Snyk Code errors to the error PR checks • Updates display of source code manager (SCM) icons in the PR scanning adoption by organization table Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/automatically-close-obsolete-fix-open-source-prs-with-help-from-snyk/ https://updates.snyk.io/automatically-close-obsolete-fix-open-source-prs-with-help-from-snyk/ Mon, 06 Apr 2026 00:00:00 GMT Snyk introduces opt-in Early Access for automatic obsolete Open Source Fix PR closure through Snyk Preview, initially limited to five PRs per day. • Adds automatic closing of Open Source Fix PRs during recurring tests if targeted vulnerabilities are no longer present. • Adds automatic comments on closed PRs listing the specific resolved issues for team context. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/introducing-unified-navigation-a-faster-way-to-secure-your-application-stack/ https://updates.snyk.io/introducing-unified-navigation-a-faster-way-to-secure-your-application-stack/ Mon, 06 Apr 2026 00:00:00 GMT Snyk introduces Unified Navigation with grouped menu and context-aware shortcuts. • New 'Grouped Navigation' reorganizes the menu by security work type to reduce hunting time. • Context-Aware Shortcuts adapt visible items to the current task, reducing clicks from 8+ to 2-3. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/active-security-incident-assessment/ https://updates.snyk.io/active-security-incident-assessment/ Fri, 03 Apr 2026 00:00:00 GMT New Active Security Incident Assessment banner in the Zero Day report tracks exposure and remediation progress. • Adds an Active security incident assessment banner to the top of the Zero Day report for high-severity zero-day events. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/snyk-learn-lesson-roundup-whats-new-in-april/ https://updates.snyk.io/snyk-learn-lesson-roundup-whats-new-in-april/ Wed, 01 Apr 2026 00:00:00 GMT Snyk Learn adds OWASP Top 10 for Agentic Applications lessons and expanded Ruby/Rust coverage. • Adds `Agentic 01 - Agent goal hijack`, `Agentic 02 - Agent tool misuse`, `Agentic 03 - Identity and privilege abuse`, and `Agentic 04 - Agentic supply chain vulnerabilities` lessons for the new OWASP Top 10 for Agentic Applications. • Adds `Cross-origin resource sharing` lesson to the security lessons catalog. • Adds `Snyk Billing and Credit Usage` lesson explaining credit tracking in the Billing module. • Updates coverage across ~50 lessons for Ruby. • Updates coverage across 30 lessons for Rust. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/track-your-monitored-projects-with-a-new-analytics-widget/ https://updates.snyk.io/track-your-monitored-projects-with-a-new-analytics-widget/ Tue, 31 Mar 2026 00:00:00 GMT New 'Projects Monitored' KPI widget added to Snyk dashboards for tracking monitored project counts. • Adds a new `Projects Monitored` KPI widget in the Widget selector that tracks the total number of projects being continuously monitored. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/updates-to-finding-management-permissions-at-snyk-api-and-web/ https://updates.snyk.io/updates-to-finding-management-permissions-at-snyk-api-and-web/ Mon, 30 Mar 2026 00:00:00 GMT Snyk API & Web adds `Change Finding State` permission for granular control of finding state and review status. • `Change Finding State` permission introduced for changing a finding's state and review status • `Change Finding` permission scope reduced to managing assignees, labels, and notes Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/improved-license-policy-behavior-for-newly-added-licenses/ https://updates.snyk.io/improved-license-policy-behavior-for-newly-added-licenses/ Sun, 29 Mar 2026 00:00:00 GMT Newly supported licenses in Snyk Open Source now default to severity=None instead of inheriting the 'Unknown' policy setting. • `severity` for newly added licenses now defaults to `None`, preventing unexpected findings. • Newly supported licenses no longer inherit the severity level configured for the `Unknown` license type in License Policies. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/snyk-code-ruby-interfile-ga/ https://updates.snyk.io/snyk-code-ruby-interfile-ga/ Thu, 26 Mar 2026 00:00:00 GMT Snyk Code announces default interfile data flow analysis for all Ruby projects from April 7, 2026. • Enables interfile data flow analysis across multiple files in all Ruby Projects to detect vulnerabilities spanning file boundaries • Refreshes the Ruby on Rails ruleset to improve coverage of modern development patterns Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/snyk-code-cobol-support-now-available-in-snyk-preview/ https://updates.snyk.io/snyk-code-cobol-support-now-available-in-snyk-preview/ Thu, 26 Mar 2026 00:00:00 GMT Snyk Code adds COBOL scanning support in Snyk Preview for CICS constructs • Integrates COBOL vulnerability data with the existing Snyk web UI for unified management Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk https://updates.snyk.io/snyk-api-and-web-mcp-server/ https://updates.snyk.io/snyk-api-and-web-mcp-server/ Tue, 24 Mar 2026 00:00:00 GMT Snyk API & Web MCP Server adds IDE-native security workflows via the Model Context Protocol for onboarding, scanning, and triaging. • Adds support for the Model Context Protocol (MCP) to enable natural language interactions with Snyk directly from AI-native IDEs • Enables automated onboarding and configuration of new Snyk targets within the IDE without manual menu navigation • Provides AI-assisted generation and implementation of authentication scripts required for deep web (DAST) scans Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk