Releasesby GlyphAccess, Cloudflare One - Sign in to Cloudflare Access with passkeys
Cloudflare Access now supports passkeys as a login method for protected applications. Users can authenticate using device-based security keys or password managers.
Friday, November 6, 20267 releases
Kubernetes Security Essentials: Consistent security posture management across your Kubernetes environments
Dynatrace KSPM now includes a default-on Security Essentials profile that monitors clusters for common misconfigurations without requiring a node-level collector. This provides a consistent security baseline across supported Kubernetes distributions.
Log Out of All Devices
Users can now log out of all devices, including desktop, CLI, and mobile apps, simultaneously from the settings menu.
Gradium adds data residency configuration in Studio
Gradium updated Studio to allow admins on paid plans to configure data residency settings under Organization controls.
Thursday, November 5, 202621 releases
Search and review audit logs with Audit Explorer
Audit Explorer is a new governance application available in beta for searching and reviewing audit.3 logs. It features search and filtering by user or resource, activity charts, standardized log details, and session tracking to support security investigations and compliance reviews.
Organization users and user groups in Organization Command Center (Preview)
Snowflake introduced organization users and user groups in public preview within the Organization Command Center.
Privilege Analysis in Database Management
Oracle Cloud Infrastructure added a Privilege Analysis tab to Database Management, enabling database administrators to analyze database privilege usage and schedule analysis policies.
Public IP address device posture attribute
The ip:publicAddress device posture attribute is now generally available. It can be used in posture checks and is visible in the Tailscale admin console.
Voice API Call resource now returns STIR/SHAKEN status
The Twilio Calls API now returns the STIR/SHAKEN attestation status for each call.
Claude Console IP allowlisting is in beta
Anthropic introduced IP allowlisting for organizations in the Claude Console. Administrators can restrict API key usage to specific IPv4 and IPv6 addresses or CIDR ranges.
GPT‑6 Cyber: Advancing the frontier of aligned cybersecurity agents
OpenAI released GPT-6 Cyber, a model specialized in identifying exploitable vulnerabilities and developing security patches while operating within authorized scopes.
Use GPT-6-Cyber to investigate vulnerabilities, reproduce them in an authorized test environment, and verify
OpenAI has released GPT-6-Cyber, a model designed to investigate vulnerabilities, reproduce them in authorized environments, and verify fixes.
Email security - Set expiration dates for Email security policies
Cloudflare Email security now allows administrators to assign expiration dates to allow or block policies for automatic removal of temporary policy rules.
Workspace token management, password rotation for HA databases, tracing in the CLI
Railway introduced centralized workspace token management in settings, audit logging for token operations, password rotation across HA database clusters, and request tracing in the CLI.
November 2026
Searchable updated permissions so Workspace Members can edit competitors, alternative names, and source classification rules previously limited to workspace admins.
App IP allowlists now support apps with serverless hosting through ASNs
Public apps without static IP addresses can now configure up to 10 Autonomous System Numbers (ASNs) and country restrictions in the Dev Dashboard IP allowlist settings.
Revoke OAuth access for your organization
Organization administrators can now revoke all existing OAuth access and refresh tokens directly from the security settings page.
Authenticate to the PlanetScale API with OpenID Connect
PlanetScale now supports authentication to its API using OpenID Connect (OIDC) from GitHub Actions and Depot CI. This allows workflows to use short-lived service tokens instead of long-lived credentials.
Amazon SageMaker AI Studio Now Supports IAM Identity Center Multi-Region Replication
Amazon SageMaker AI Studio now supports IAM Identity Center multi-region replication, allowing administrators to deploy domains in regions separate from their primary identity instance.
Secret scanning upgrades detectors, adds SpaceX as partner
GitHub secret scanning now supports SpaceX as a partner and includes a new detector for Starlink public API secrets. Additionally, existing detectors for AWS, Google, and other providers have been updated to reduce false positives.
Self-hosted Retool 4.34 and 4.0 stable updates
Patches for Retool 4.34.16 and 4.0.28 are available on the stable release channel, providing bug fixes and security updates.
Wednesday, November 4, 202619 releases
Browser Isolation, Cloudflare One - Block data entry with Browser Isolation without losing search, copy, and zoom (beta)
Cloudflare Browser Isolation added a beta keyboard policy setting that blocks text data entry while allowing search, selection, copying, printing, and zoom.
Test app network access configuration on dev stores
Shopify launched a feature preview on dev stores allowing developers to test app network access configurations and verify allowed navigation hosts and external server requests.
Daybreak Red is now available in AWS GovCloud (US-East)
Daybreak Red, featuring the GPT-5.6 Cyber model, is now available to authorized customers in AWS GovCloud (US-East) via Amazon Bedrock for cybersecurity workloads.
Eventhouse support for OneLake security (Generally Available)
OneLake security is now generally available for Eventhouse external tables. This allows for consistent object-level, column-level, and row-level access controls across Microsoft Fabric engines.
[Launched] Generally Available: Azure Database for PostgreSQL stable REST API version 2026-10-01
The Azure Database for PostgreSQL Flexible Server REST API version 2026-10-01 is now generally available, introducing new capabilities for maintenance, immutable backups, and encryption.
Log in once when your SSO provider is Google
On Business and Enterprise plans, you now log in once when your workspace enforces SSO through Google. Select Continue with Google and use a Google Workspace account on your workspace's verified domain, and Lovable does not ask you to log in again.
Vercel token scanning expands to more public sources
Vercel has partnered with Truffle Security to expand automated detection and revocation of publicly exposed Vercel tokens. Revoking exposed credentials helps prevent unauthorized access to your projects and unexpected costs from unauthorized use of services such as Vercel Sandbox and Vercel AI Gateway .
Kimi K3.1 Pro now has more ZDR providers on AI Gateway
Vercel AI Gateway expanded Zero Data Retention provider support for Moonshot AI Kimi K3.1 Pro and K3.1 Pro Highspeed models, supporting 1M token contexts and multimodal input.
Improved Commercial Release Vulnerability Accuracy for Broadcom Tanzu Spring
Snyk updated its pURL API to accurately recognize security fixes in Broadcom Tanzu Spring enterprise builds, reducing false positive vulnerability reports for commercial subscribers.
Updates to our Self-Serve Subscription Agreement, Privacy Statement, and Acceptable Use Policy
Netlify published updated legal and privacy terms taking effect December 4, 2026, introducing rules for domain verification and account consolidation under organization accounts.
TruffleHog Secrets Revocation Program
Resend partnered with TruffleHog to automatically detect and revoke exposed API keys across public code repositories, Docker Hub images, PyPI/npm packages, datasets, and mobile apps.
CodeQL 2.27.4 improves accuracy and query metadata
CodeQL 2.27.4 improves query accuracy for Java, Kotlin, Rust, and C/C++ and updates CWE metadata.
Require SSO sign-in again for your organization
Organization administrators can now revoke all active SSO sessions for their organization directly from the security settings during a suspected incident.
Ray-2.60.0
Ray 2.60.0 released shuffle v2 as default for joins and aggregations, updated Parquet task sizing from row-group metadata, added rolling update surge controls in Ray Serve, and patched security vulnerabilities.
Tuesday, November 3, 202617 releases
What's new:
- Deploy after tg login : tg beta jig deploy now works with a tg login session, so you don't need an API key to deploy a container . Expiring secrets: client.beta.jig.secrets.create and update take ttl_seconds , which sets how long a secret lives before it's deleted, from one to 14 days. Secrets return their deletion time as expires_at .
Vercel Security Review now in public beta
Vercel Security Review is now in public beta for Pro and Enterprise teams. Once enabled, every push to a connected GitHub repository is automatically reviewed for vulnerabilities, and findings are reported in the Vulnerabilities dashboard . What triggers a review Security Review runs automatically when code is pushed to a connected GitHub repository.
MCP Server: Auto-connect Claude.ai users with managed authorization (Beta)
Admins can now connect Claude to the Mixpanel MCP Server for every member at once. When members open Claude, Mixpanel is already connected, with no sign-in or consent screen. With this update: One-time setup: A Claude admin and a Mixpanel organization admin connect the two. In Claude, use the connector's Managed authorization settings.
Okta connector is available in Beta
The managed Okta connector is now available in Beta in Databricks Lakeflow Connect. Workspace admins can enable Lakeflow Connect for Okta on the Previews page . Use the connector to ingest identity and access data from Okta into Databricks, including users, groups, group memberships, app integrations, devices, policies, and administrator roles.
Dependabot version updates support Agent Package Manager
You can now keep your AI agent skills, prompts, and instructions up to date with Dependabot version updates for Agent Package Manager (APM) . Dependabot opens pull requests to update supported git dependencies declared in apm.yml and regenerates apm.lock.yaml when it’s present. This support covers version updates, not security updates.
Claude auto-connect (beta) for PagerDuty MCP Server now in Early Access
With Claude auto-connect, members with a matching PagerDuty account are connected to PagerDuty in Claude automatically, with no sign-in screen and no identity provider (IdP) configuration. Members act as themselves in PagerDuty, with the permissions they already have there.
Open Models and Regional Serving in Model Vault
Model Vault and Model Vault Encrypted now run leading third-party open models alongside Cohere's models, on fully managed, dedicated infrastructure. You can choose the right model for each task and run every one of them with the same protections.
Enterprise-managed auth for MCP
The Supabase MCP server now allows Claude to issue identity assertions for enterprise-managed authentication when an identity provider cannot.
Protect a project from abandonment cleanup
On Enterprise plans, you can now protect a project from cleanup so Lovable never marks it abandoned. A protected project is never deleted for inactivity. Enable Abandonment protection in your project's settings, or select Protect it on the abandoned project banner. Workspace admins and owners can protect any project in Security insights .
Radar - Zero Wire, a hub for investigating critical Internet vulnerabilities
Cloudflare Radar now includes Zero Wire ↗︎ , a hub for investigating critical Internet vulnerabilities and threats. Each briefing separates confirmed facts from open questions, lists remediation steps, and shows what Cloudflare observes about the threat. Briefings Briefings are grouped by urgency.
Client ID Metadata Document (CIMD) Support for Database Tools MCP Server
Database Tools MCP Server now enables users to manage MCP client access using Client ID Metadata Documents (CIMDs) in IAM Identity Domains. A Client ID Metadata Document enables an OAuth client to use the HTTPS URL of a client-hosted metadata document as its client_id. When CIMD is used, users only need the MCP server URL to configure their MCP clients.
Security Update: Multiple vulnerabilities in Next.js (November 2026)
The Next.js team has disclosed seven security vulnerabilities in Next.js, patched on November 3, 2026 in 16.4.5 and 15.5.29. The issues span cached data leaking between users, exposure of HttpOnly cookies, cache poisoning, and cross-client response injection. Several of them do not affect apps hosted on Netlify. Here's what Netlify customers need to know.
Monday, November 2, 202618 releases
Lakehouse supports the following remote catalog providers for cross-cloud data access
Lakehouse supports the following remote catalog providers for cross-cloud data access. This feature is generally available (GA). Databricks Unity Catalog on Amazon Web Services (AWS), Microsoft Azure, or Google Cloud AWS Glue Data Catalog on AWS Snowflake Horizon Catalog on AWS, Microsoft Azure, or Google Cloud Workday Data Lake on AWS or Google Cloud This...
DigitalOcean Secrets Manager is now available in public preview
DigitalOcean Secrets Manager is now available in public preview. Secrets Manager stores passwords, API keys, access tokens, and other credentials as named secrets in a DigitalOcean region. You can create and update secrets in the …
Amazon Aurora MySQL 3.14 (compatible with MySQL 8.0.46) is generally available
Starting today, Amazon Aurora MySQL-Compatible Edition 3 (compatible with MySQL 8.0) supports MySQL 8.0.46, which includes community MySQL fixes and Aurora-specific improvements.
Amazon Quick on desktop now uses your organization's existing Amazon Quick sign-in
For organizations that use Amazon Quick, the desktop application now signs users in with the same sign-in method the organization already uses for Quick on the web. Administrators no longer need to register an OIDC application in their identity provider or set up separate desktop sign-in before users can get started.
Check out GitHub code without long-lived credentials on self-hosted agents
Self-hosted agents can now use temporary, read-only GitHub App tokens for repository checkout. This eliminates the need to distribute and rotate long-lived SSH keys or personal access tokens across your agent fleet.
SECRET object tagging
With this release, you can assign tags to secrets when you create or alter a secret. You can use tags on secrets to track sensitive objects, manage governance workflows, and organize secrets consistently with other tagged Snowflake objects.
Bots - New Account Abuse Protection Dashboard
Account Abuse Protection customers in Early Access can now investigate login and sign up activity in a dedicated dashboard under Security > Account Abuse Protection . Population overview: See total login and sign up events, unique accounts, IPs and devices, top countries and ASNs, and leaked credential check results.
Redesigned Action center reviews
The review dialogs in the Action center match Lovable's current design and now show each project's owner. A security review lists each open finding with its severity. In the same review, you can ignore every open finding at once. Select a project's name to open the project in a new tab.
October 26 , November 1, 2026
- Added: Managed Service for Kubernetes® now supports dynamic resource allocation (DRA) on clusters running Kubernetes 1.34 or later. After you enable DRA on a node group , workloads can request NVIDIA GPUs through the NVIDIA DRA driver, which you need to install and maintain, and RDMA or InfiniBand™ network interfaces through DRANet, which Nebius manages.
Blocking malicious npm packages before and during installation
Vercel now checks for blocked npm packages before and during dependency installation in builds , helping prevent malicious install scripts from running. The checks use a blocklist of specific package versions selected for blocking because of malware or security vulnerabilities, with new rules typically reaching new builds within minutes.
OAuth Discovery from the Server's 401
When an MCP server answers 401 mid-session, Devin starts OAuth from the resource_metadata it advertised, including servers whose handshake is public; a URL installation saved without auth asks the server how it authenticates; and OIDC locations are tried after a non-404 at the RFC 8414 URL.
Roll back one bundle to an earlier version
Each bundle on a Deployment now records a version history, and you can roll one bundle back to a version in that history. Your project image, your Astro Runtime version, and every other bundle stay as they are. Previously, the only way to undo a change to one bundle was to roll back the whole Deployment.
Higher limits and BROWSE support for Unity Catalog secrets
A schema can now hold up to 1,000 Unity Catalog secrets, and a metastore up to 10,000, up from 100 and 1,000. The limits apply to Databricks-managed secrets and secrets backed by AWS Secrets Manager.