Find and fixSupport informationChangelog2025

2025

Last updated: Oct 1, 2026

December

Release 52

(SAST) New rules:

  • F014 Java Spring Observable Time Discrepancy
  • F045 Java CSS Injection
  • F086 Java Download of Code Without Integrity Check
  • F107 Java LDAP Query Injection
  • F268 Java Unsafe Local File Access
  • F014 Go Unsafe Reflection
  • F022 Go gRPC Insecure Server Connection
  • F201 Dart Resource Updated By URL Data

Release 51

(SAST) New rules:

  • F014 Scala Spring Expression Language Injection
  • F280 Java Session Fixation
  • F063 Dart Absolute Path Traversal
  • F332 Dart Sensitive Information Exposure in Cleartext Channel
  • F360 Java Clickjacking
  • F385 Dart Use Hardcoded Cryptographic Key in Client

Release 50

  • (AI-SAST) SQL Injection: Added SQL Injection vulnerability detection to the AI scanner.
  • (AI-SAST) XSS: Added Cross-Site Scripting (XSS) vulnerability detection to the AI scanner.
  • (ASPM) Add filtering options to the files table: Added dynamic filter options to the Files table, with filters for task actions and file types. These options make search more accurate and navigation easier. The table shows only the filters that apply to the available data.
  • (ASPM) Enable file deletion in design map: Updated the permissions in Design Map to let the intended roles delete files: User, Group Manager and Vulnerability Manager.
  • (MCP) Using scanners through MCP: Added MCP tools that help AI agents run the SAST and SCA scanners through Docker. The tools give the steps to configure and run the scanners.
  • (SAST) New rules:
    • F014 C# Unsafe Reflection
    • F355 Scala Inclusion of Functionality from Untrusted Control Sphere
    • F020 C# Insecure Data Storage
    • F372 Scala Cleartext Transmission of Sensitive Information
    • F316 C# Buffer_Overflow
    • F297 Java Unsafe Input SQL Injection

Release 49

  • (ASPM) Environments table improvements: Secrets alerts, CSPM icons and "Is Production" column: Added warnings for missing secrets and improved the CSPM icons to match the new design. Renamed "Is Production" to "Deployment stage" with clearer status labels.
  • (ASPM) Add input and visualization of RASP controls in app mobile environments: Added RASP input for mobile environments with updated filenames and visual indicators in the environments table. The environment alert notification reports all RASP changes.
  • (ASPM) Add filtering options to the environments table: Added filters for Git root, status, deployment stage, and environment type to the Environments table. These filters make search faster and more accurate.
  • (DB) Database updates for SCA vulnerabilities mitigation options: SCA vulnerabilities show information about the effect of a patch. This information tells you that a minimal update can add new issues or breaking changes.
  • (DB) Research team advisories on vulnerabilities page: Advisories that Fluid Attacks discovered have the tag "Discovered by Fluid Attacks." The tag shows if the source is the Fluid Attacks pentesters, the Fluid Attacks scanner, or external pentesters who report through Fluid Attacks.
  • (SAST) New rules:
    • F014 Scala Unsafe Reflection
    • F211 JS ReDos User Input
    • F211 TS ReDos User Input
    • F052 JS Unsafe MD5 Encryption
    • F052 TS Unsafe MD5 Encryption
    • F201 Scala Resource Injection
    • F107 Scala LDAP Query Injection
    • F404 Scala Command Injection
  • (Reachability) New rule: Python CVE-2024-24762.

November

Release 48

Release 47

Release 46

Release 45

October

Release 44

Release 43

  • (SAST) New rules:
    • F100 Scala SSRF through unvalidated URL
    • F008 C# .config Request Validation Disabled
    • F100 Scala Unvalidated External URL Enables SSRF
    • F100 SSRF via urllib.request.urlopen in Django
    • F100 Python SSRF by interpolation of client input into URL
    • F039 C# Inexplicit Anonymous Access in .NET endpoint
    • F404 JavaScript Node JS Command Injection
    • F404 Java Command Injection
    • F016 Go SSL/TLS Insecure Encryption
    • F148 Go TLS Insecure Skip Verify
    • F008 C# Request Validation Disabled
  • (Reachability) New rules:

Release 42

Release 41

Release 40

  • (ASPM) Priority: Platform users can see a Priority column. This column combines multiple criteria, such as CVSSF, KEV, EPSS, Reachability, and the cost to fix. It helps users know which vulnerabilities to fix first.
  • (ASPM) Improve UX for multi-select filters with long option names: Made changes to prevent an overflow of the UI when it shows multiple filters with long option values.
  • (ASPM) Approval tables improvements: Rows change from action buttons to status tags, with clear undo options and feedback messages. Checkboxes with 'Approve All' / 'Reject All' controls support bulk actions.
  • (DB) Fixes section UI improvements: Added Fixes landing, category, and internal pages with cards, filters, and breadcrumbs.
  • (DB) Compliance section UI improvements: Added Compliance landing, category, and internal pages with cards, filters, and breadcrumbs.
  • (IDE Plugin) From KB to db.fluidattacks.com: All references to vulnerability information in the Fluid Attacks VSCode/Cursor extension point to db.fluidattacks.com.
  • (SAST) New rules:
    • F096 Java ObjectMapper Insecure Deserialization
    • F008 Kotlin Spring Boot Reflected XSS
    • F156 Java Open Redirect
    • F027 Ruby Dangerous File Upload
    • F027 JS Express Dangerous File Upload
    • F027 TS Express Dangerous File Upload
    • F156 PHP Symfony Insecure Redirect
    • F027 Php Unsafe File Upload
    • F107 PHP LDAP injection
    • F183 PHP Debug Enable
    • F297 GORM SQL Injection
    • F130 PHP Cookies Secure Disabled
  • (Reachability) New rules:

September

Release 39

  • (DB) Homepage improvements: Added top bar, navigation, and homepage UI improvements.
  • (DB) Weaknesses section UI improvements: Added Weaknesses landing, category, and internal pages with cards, filters, and breadcrumbs.
  • (DB) Requirements UI improvements: Added Requirements landing, category, and internal pages with cards, filters, and breadcrumbs.
  • (SAST) New rules:
    • F297 Dart Raw SQL Injection
    • F297 PHP Laravel Raw SQL Injection
    • F297 Swift SQL Injection
    • F297 Scala Tainted SQL Injection
    • F297 Python SQL Injection
    • F008 Flask Reflected XSS
    • F404 Python Asyncio Subprocess command injection
    • F007 Scala CSRF Headers Bypass
    • F134 Kotlin Insecure CORS Origin

Release 38

  • (ASPM) Package imports view with transitivity grouping: From the Locations column in Packages, users can open a second view. This view shows the detailed locations of each dependency, grouped by transitivity.
  • (IDE Plugin) Custom Fix in the IntelliJ integration: The IntelliJ plugin supports Custom Fix. With this feature, developers can get tailored remediation guides from AI.
  • (ASPM) Integrated KEV Information into Package details: The details of vulnerabilities that SCA finds show if they are in CISA's Known Exploited Vulnerabilities (KEV) catalog. Clients can also use this parameter as a filter to prioritize remediation better.
  • (SAST) New rules:
    • F007 Ruby Missing CSRF Protection
    • F007 Python Django No CSRF
    • F007 PHP Symfony CSRF Protection
    • F007 Php WP Plugins CSRF Audit
    • F404 Python OS Command Injection
    • F100 Kubernetes Host Probes SSRF

Release 37

Release 36

August

Release 35

  • (ASPM) Renamed "Surface" section to "Inventory": Renamed Surface to Inventory, moved Packages to the first tab in Inventory, and grouped technical attributes in a Surface tab.
  • (ASPM) Enhanced Last commit filter in Inventory: In the Inventory → Surface → Lines subtab, users can copy the full commit hash from the Last commit column. They can then use this parameter as a filter.
  • (ASPM) Deprecated "Black" service: The platform no longer lets users add groups with the "Black" service (black-box testing) or change existing groups to this service. This change has no effect on current clients who use this service.
  • (ASPM) Redesigned Packages section: Enhanced Packages as a new inventory view of dependencies. The view supports audits, SBOM generation, risk insights, and compliance, and includes updated columns and filters.
  • (SAST) New rule: F164 Swift Insecure KeyChain ACL.

Release 34

  • (ASPM) Deleted "Download analytics" button: The feature to download a PNG image of the graphs and figures in the Analytics sections is no longer available.
  • (ASPM) Replace weaknesses count with vulnerabilities count in the Groups section: In the "Groups of your organization" section, clients can see the open vulnerabilities of their groups. Thus, they can immediately see which groups have more open vulnerabilities.
  • (ASPM) Agent rename to CI Gate in emails: Replaced "CI Agent" with "CI Gate" in all platform notifications.
  • (DB) Search feature: A search feature helps clients navigate the Fluid Attacks Database.
  • (SAST) New rules:
    • F016 Swift Weak TLS Configuration
    • F008 Swift WebView LoadHTMLString XSS
    • F060 JavaScript Insecure postMessage Wildcard
    • F060 TypeScript Insecure postMessage Wildcard
    • F014 Swift Deprecated WebView Usage
    • F434 JavaScript Client-Side Template Injection
    • F434 TypeScript Client-Side Template Injection

Release 33

  • (ASPM) Remove "Weekly trend" from the Compliance section: Removed the weekly trends indicator from Compliance to make the section clearer.
  • (ASPM) Agent rename to CI Gate: In the DevSecOps section, the name of the 'Agent' is 'CI Gate'. This name aligns with the purpose of the Agent and with the configuration of the security gates.
  • (SAST) New rules:
    • F021 Kotlin XPath Injection
    • F297 Kotlin SQL Injection
    • F404 Kotlin Code Injection
    • F096 Kotlin Insecure Deserialization
    • F014 Ruby on Rails Mass Assignment
    • F052 Swift Weak Hash Algorithm

Release 32

  • (ASPM) Updated empty states in vulnerabilities table: Updated the empty states in the columns of the Vulnerabilities table to make them consistent and easy to understand.
  • (ASPM) Added Undeterminable to dependency type filters: The dependency type filters of the vulnerabilities table have an "Undeterminable" option.
  • (ASPM) Added "Fix with AI" filter: In the Vulnerabilities sections, clients can use the "Fix with AI" attribute as a filter. Thus, they can easily find the vulnerabilities that have an available fix from AI.
  • (DB) Moved database page to db.fluidattacks.com: All the vulnerabilities, security requirements, fixes, and standard details of Fluid Attacks are in its Database. This change makes the information easier to find and use.
  • (SAST) New rules:
    • F100 Kotlin SSRF From Untrusted URL
    • F014 PHP Arbitrary File Read
    • F404 Ruby Command Injection via Open3
    • F008 Ruby Reflected Cross-Site Scripting
    • F297 Ruby SQL Injection
    • F404 Ruby Code Injection via eval
    • F017 PHP Insecure Session Configuration (use_only_cookies)

July

Release 31

Release 30

Release 29

  • (ASPM) Vulnerability and risk exposure summary: In vulnerabilities, added the number of open security issues, those that have available fixes with AI, and the total risk exposure share of the group.
  • (ASPM) UI improvements in Group status and Plan columns: Improved the Group status and Plan columns in the Groups section with tags that have colors. The tags make the columns easier to read and help users quickly recognize the status (subscribed, suspended, or free trial) and the active plan.
  • (ASPM) Enable opening weaknesses in new tabs: Enhanced navigation in Vulnerabilities. Users can open each weakness in a new tab.
  • (Fixes) Support for new files: The custom fix and suggested fix features support these file types: .html, .yaml (Helm, CloudFormation, Docker Compose), .xml (Android), and .json (ARM).
  • (SAST CLI) Improvements in scanner output: The console output is much easier to read and clearer. Also added the CVSS v4 score.
  • (SAST) New rules:
    • F100 Go Net HTTP SSRF
    • F405 Go Insecure File Permissions
    • F021 Go XMLPath XPath Injection
    • F100 Python HTTP Request SSRF
    • F405 Python Insecure File Permissions
    • F020 Swift Insecure Data No File Protection

Release 28

  • (ASPM) Added 'Copy' button in location column: Users can copy the vulnerability URL directly from the Location column with a new "Copy" button.
  • (ASPM) Editing of "connection types" and "production_environments?": After users add an environment, they can edit its connection type and production status.
  • (ASPM) Improved visibility of treatments: Added colors to the treatments in the Locations table to help users identify them more quickly.
  • (ASPM) Improved readability and implemented brand colors in report: Updated the Executive Summary chart with a larger font that is easier to read. Also changed the colors of the report to align with the brand colors that Fluid Attacks chose.
  • (SCA) UV package manager support: Added support for the UV package handler. The scanner can detect and report uv.lock dependencies.
  • (SAST) New rules:
    • F106 Python PyMongo NoSQL Injection
    • F008 Python Insecure MARKUP XSS
    • F083 Java JAXP Insecure SAXTransformerFactory XXE
    • F083 Java JDOM2 Insecure SaxBuilder XXE
    • F083 Java DOM4J Insecure SaxReader XXE
    • F083 Java Insecure XML Validator XXE
    • F083 Java Insecure XSLT Transformer Factory
    • F100 Java SSRF From Untrusted URL
    • F004 Java EL Injection From HTTP Request
    • F096 Swift Foundation Insecure NSKEYEDUNARCHIVER

Release 27

  • (ASPM) Persistent filters by default: Each table of the platform saves its filters.
  • (ASPM) Added Git root exceptions: Added dedicated exception handling when users add Git repositories. This change makes the error flows better.
  • (SAST) New rules:
    • F004 JavaScript Engine Code Injection
    • F268 Swift WebKit Unsafe Local File Access
    • F372 Swift Network Framework Insecure TCP Connection
    • F094 XML JS/TS CryptoJS Insecure Use Of CBC Mode
    • F134 Yaml Spring Insecure Cors Wildcard

June

Release 26

  • (ASPM) Queued Git root cloning: Re-enabled the 'Queued' status for Git roots in scope. This change makes the status clearer and lets clients use this status as a filter.
  • (ASPM) OWASP Top 10 for LLMs report: Users can include the OWASP Top 10 for LLMs standard in their reports of noncompliance from the Compliance section.
  • (SAST) New rules:
    • F372 Swift Insecure HTTP
    • F097 JQuery Reverse Tabnabbing
    • F134 YAML AWS SAM Insecure Cors
    • F134 Properties Spring Insecure Cors Wildcard
    • F447 Gradle Missing Checksum Verification
    • F359 Dockerfile Hardcoded Credentials CHPASSWD
    • F264 XML .NET Weak Encryption Algorithm
    • F134 XML Java EE Insecure Cors Wildcard

Release 25

  • (ASPM) CVSS 4.0 is mandatory: After this release, all SAST, SCA, CSPM, and DAST reports include the CVSS 4.0 score.
  • (ASPM) Migrated tables to new design: Improved UX and usability for these tables: Trusted devices, and Groups (in Portfolios).
  • (MCP) Answering questions using Knowledge Base: The MCP server of Fluid Attacks can answer the questions of users with the information in the Knowledge Base.
  • (DB) OWASP Top 10 for LLMs verification: Fluid Attacks checks if you obey this new standard.
  • (SAST) New rules:
    • F264 Java Weak Crypto In SecretKeyFactory
    • F094 Java Spring Weak CBC Cipher Suites
    • F134 YAML Insecure Cors Header
    • F405 YAML Insecure File Permissions for other
    • F359 Build.Gradle Hardcoded Credentials
    • F157 Terraform Azure NSG Allows Unrestricted SSH Access
    • F157 Terraform Azure NSG Allows Unrestricted SMTP Access
    • F157 Terraform Azure NSG Allows Unrestricted RPC Access
    • F157 Terraform Azure NSG Allows Unrestricted PostgreSQL Database Access

Release 24

  • (ASPM) Migrated tables to new design: Improved UX and usability for these tables:
    • Execution details (in DevSecOps)
    • Credentials management window
    • Subentries to new entry (Mailmap section)
    • Treatment acceptance (in Locations)
    • Update verification (in Locations)
    • API token window
    • Records preview (in Locations)
    • Update affected reattacks (in Locations)
  • (SAST) New rules:
    • F332 Java Spring Datasource No Encryption
    • F359 Package.json NodeJS Git Credentials Exposure
    • F380 Dockerfile Curl No Checksum
    • F380 Dockerfile Wget No Checksum
    • F183 Android Debuggable Enabled
    • F134 Swift Vapor Insecure CORS Header
    • F016 Nginx Insecure SSL Protocols
    • F134 Ruby On Rails Insecure CORS Header
    • F043 Nginx Insecure CSP Inline Script
    • F135 Nginx Insecure Cors Header
    • F129 Python Flask Insecure Cookie Samesite None
    • F129 Python Django Insecure Cookie Samesite None
    • F216 Log Exposed Username in Path
    • F134 PHP Laravel Insecure Cors Configuration
    • F037 Spring Prometheus Endpoint Exposure
    • F359 Java Spring Hardcoded Credentials
    • F149 Java Spring Insecure SMTP

Release 23

  • (ASPM) Enhanced the Surface table (Ports): Enhanced the user experience in the Surface section (Ports) with filter, sort, search, and pagination options.
  • (SAST) New rules:
    • F129 JS Express Insecure Cookie Samesite
    • F129 TS Express Insecure Cookie Samesite
    • F043 JS Insecure CSP Inline Script
    • F313 JS Insecure TLS Reject Unauthorized in False
    • F313 TS Insecure TLS Reject Unauthorized in False
    • F043 Kotlin Insecure CSP Inline Script
    • F134 JS Lambda Insecure Cors
    • F134 TS Lambda Insecure Cors
    • F338 Kotlin Hardcoded Salt Bytes
    • F094 JS SSH2FTPClient CBC Cipher Used
    • F094 TS SSH2FTPClient CBC Cipher Used
    • F135 C Sharp Insecure SameSite Cookie Configuration

May

Release 22

  • (SCA) Reporting Docker images vulnerabilities: The Vulnerabilities table shows the vulnerabilities found in Docker images.
  • (MCP) AI Agent to production.
  • (SAST) New rules:
    • F395 Kotlin Hardcoded Init Vector
    • F135 CSharp ASP.NET Insecure Cookie Samesite None
    • F134 JS Express Insecure CORS Header with Wildcard Origin
    • F134 TS Express Insecure CORS Header with Wildcard Origin
    • F395 Java Static IV in Base64 Scenarios
    • F134 CSharp Insecure Use of Wildcard CORS Configuration
    • F134 CSharp Insecure Cors Header via HttpWebRequest
    • F125 CSharp ASP.NET Directory Browsing Enabled
    • F078 CSharp ASP.NET AllowInsecureHTTP in True
    • F043 Java Insecure CSP Inline Script
    • F368 Java Host Key Checking
    • F134 Java Insecure Cors Modifier
    • F134 Java Spring Insecure Cors
    • F129 Java Spring Cookiegenerator SameSite
    • F129 Java Spring Insecure Cookie Samesite None
    • F130 Java Spring Cookiegenerator Secure
    • F060 Java JSCH StrictHostKeyChecking Disabled
    • F052 Java Insecure Cipher Mode
    • F134 Dart Shelf Insecure CORS Header

Release 21

  • (ASPM) Package details: Added a new section to the vulnerability modal. The section has the fields 'Dependency', 'Dependency type', 'ID', '%EPSS', 'Stage', 'Reachability', 'Version status', 'Affected version', 'CPEs', 'Namespace' and 'Advisory URLs'.
  • (ASPM) 'Potential' tag: Added the new 'Potential' tag. It lets customers identify the dependencies that their code imports but that have a vulnerability with no confirmed reachability.
  • (SAST) New rules:
    • F134 Go Gin Insecure CORS Header
    • F359 Python Hardcoded Credentials in PyMySQL

Release 20

Release 19

  • (ASPM) Enhanced tables for IP roots and URL roots: Enhanced the user experience in the Scope section with filter, sort, search, and pagination options.
  • (ASPM) Enhanced the Surface table (languages): Enhanced the user experience in the Surface section (Languages) with filter, sort, search, and pagination options.
  • (ASPM) Authorization improvements: Updated the permissions of the User role: this role cannot remove environments from the scope. Only the higher-level roles can do this action: Group Manager and Vulnerability Manager.
  • (ASPM) Inherited vulnerabilities filtering: Added filters for 'Inherited' vulnerabilities: dependency type ('Direct' or 'Transitive'), EPSS, package manager, stage ('Run' or 'Build'), and reachability.
  • (SAST) New rules:
    • F006 C Sharp Token Validation Bypassed via Unsafe Delegates
    • F061 C Sharp Insecure DLL loading

April

Release 18

  • (Design Map) Correlate threats: Clients can correlate the threats identified in their security designs with the vulnerabilities that Fluid Attacks reports.
  • (IDE) Cursor IDE extension: The development teams of Fluid Attacks clients can check reported vulnerabilities, request reattacks, make fixes with artificial intelligence, and request treatments. They can do all of this in the Cursor IDE.
  • (ASPM) Enhanced the Integrations table: Enhanced the user experience in the Integrations section with filter, sort, search, and pagination options.
  • (ASPM) Enhanced the Surface table (packages): Enhanced the user experience in the Surface section (packages) with filter, sort, search, and pagination options.
  • (ASPM) Enhanced Scope tables: Enhanced the user experience in the Scope subsections with filter, sort, search, and pagination options.
  • (MCP) Fluid Attacks' Model Context Protocol: Launched a new integration that lets users query real-time security data from Fluid Attacks. Users write natural language prompts in AI tools, such as Claude, or VS Code with Copilot as the agent. The setup is minimal and does not use complex commands.
  • (SAST) Architecture improvements in Fluid Attacks' scanner: The Fluid Attacks APK scanner is a separate CLI with its own Docker image. This change gives a cleaner architecture and a better separation of concerns.
  • (SAST) New rules:
    • F089 C Sharp Insecure Deserialization Of Untrusted XML in .NET DataTable
    • F260 C Sharp Memory Corruption Risk Due to Serialization of Pointers
    • F007 C Sharp Lack of ViewState association with session in ASP.NET Web Forms (CSRF)
    • F115 C Sharp Insertion of Untrusted Certificate into Root Store
    • F130 C Sharp Insecure Cookie Transmission via Unset Secure Flag in ASP.NET Core

Release 17

  • (ASPM) Upgrade plan flow from Talk to a Pentester: The 'Talk to a Pentester' feature is available only in the Advanced plan. If clients with the Essential plan try to use this feature, they can easily request an upgrade from the dialog.
  • (ASPM) Upgrade plan flow from Reattack: This change is for clients who downgraded to the Essential plan and want to reattack vulnerabilities that RE, SCR, and PTaaS found before. When these clients try to use the feature, they can easily request a plan upgrade from the dialog.
  • (ASPM) Enhanced the Vulnerabilities table: Enhanced the user experience in the Vulnerabilities section with filter, sort, search, and pagination options.
  • (ASPM) Enhanced Logs tables: Enhanced the user experience in the Logs subsections with filter, sort, search, and pagination options.
  • (SCA) Change displayed technique for types 431 and 120: Vulnerability types 431 and 120 accurately display 'SAST' as the technique that detected them.
  • (SAST) New rules:
    • F056 JS/TS Insecure gRPC Communication via createInsecure
    • F125 C Sharp Insecure Configuration: Directory Browser Middleware Exposes Filesystem
    • F140 C Sharp Insecure Corrupted State Exception (CSE) Catching in .NET
    • F204 JS/TS Mass Assignment via Object.assign in Express
    • F323 C Sharp XML External Entity (XXE) via Insecure DTD Processing in XmlReaderSettings
    • F422 C Sharp Server-Side Template Injection (SSTI) in Razor

Release 16

(SAST) New rules:

  • F115 JS Improper CSRF Middleware Order
  • F115 TS Improper CSRF Middleware Order
  • F002 JS Uncontrolled Error Object Allocation via Ajv allErrors Option
  • F002 TS Uncontrolled Error Object Allocation via Ajv allErrors Option
  • F014 C Sharp Insecure Random Number Generator for Cryptographic Key Generation

Release 15

  • (ASPM) Enhanced flow for upgrading to paid plans: Improved the flow to make it easier for free trial users to upgrade their plan.
  • (ASPM) Management options in credentials table: A single button gives access to the options to edit and remove credentials, for a cleaner look.
  • (ASPM) Columns in Surface table: Added new filters and a new columns UI to make data filters easier to use.
  • (SBOM) Support of packages.swift: The SBOM includes packages.swift files.
  • (SAST) New rules:
    • F068 JS Missing Path In Session Cookie
    • F068 TS Missing Path In Session Cookie
    • F146 PHP MySQL Query Injection
    • F134 Go Gin Framework Insecure CORS
    • F006 JS JWT Token Forgery
    • F006 TS JWT Token Forgery
    • F134 Koa Framework Insecure CORS
    • F431 Swift Package Missing Package Lock

Release 14

  • (ASPM) Improved Acceptance section in Policies: Simplified the process to request acceptance policies with an improved user interface. The treatment statuses, the temporary and permanent acceptances, and the functionality and tables of the section are clearer.
  • (ASPM) Improved reattack flow and messages: Improved the user flow to request a reattack from three to two clicks and implemented detailed error messages.
  • (ASPM) Updated PDF available in the free trial: Updated the PDF about plans and prices linked in the banner shown to free trial users.
  • (Reachability) New rules:
  • (SAST) New rules:
    • F085 Flutter Framework Sensitive Information Stored in SharedPreferences
    • F332 Ruby OpenURI Request
    • F130 PHP Laravel Cookie Insecure
    • F183 JS Struts Debug Mode enabled in production
    • F371 JS Angular Use Of Insecure InnerHtml
    • F371 TS Angular Use Of Insecure InnerHtml
    • F008 PHP Laravel Reflected XSS
    • F151 Ruby NET Telnet Request

March

Release 13

  • (ASPM) Moved existing filters to a new design: Implemented a new filter design in the Logs section of the organization and the Scope section of the groups. This design makes data filters easier to use.
  • (Agent) Ignoring SCA findings when breaking the build: The Agent receives a flag (--inherited). With this flag, users select if they want to ignore the vulnerabilities that the SCA scans report when the Agent breaks the build. The value of the flag specifies if they are used in development (build), production (run), or all stages (all).
  • (Reachability) New rules:
  • (SAST) New rules:
    • F157 Helm Insecure Ingress Egress
    • F134 Ruby On Rails Insecure CORS
    • F008 React Native WebView JS Enabled
    • F097 Vue JS Reverse Tabnabbing

Release 12

###Release 11

Release 10

February

Release 9

Release 8

  • (ASPM) Column management: Users can show or hide columns as they prefer and change their positions with drag-and-drop. Users can save their personalized configurations for future use. Also, the first column stays fixed and locked. It is always on the screen, and users cannot disable it. Thus, users always have access to critical information.
  • (ASPM) Rename user manager: The User Manager at the organization level became the Organization Manager. At the group level, the User Manager became the Group Manager. Thus, each role name aligns with its scope.
  • (Reachability) New rule: Python CVE-2022-22817.

Release 7

Release 6

  • Fluid Attacks becomes an AWS partner: AWS officially lists Fluid Attacks as a company that uses AWS technologies in its processes to help businesses secure their cloud environments.
  • (ASPM) Updated terminology for vulnerabilities column: The Groups section shows "X types open" and not "X types found", because this text is more accurate.
  • (ASPM) Eliminated "Unauthorized access" window: Removed the window that opens when the session of a user expires. After this change, the platform sends the user to the login page.
  • (ASPM) Renamed Agent's executions report: Renamed the report from "forces_execution.csv" to "FluidAttacks_DevSecOpsAgent.csv".
  • (ASPM) Column management: Users can customize the columns in the Locations, Vulnerabilities and To do tables. This makes navigation simpler.
  • (ASPM) Added banner for free trial users: A banner tells free trial users that automated tools usually detect 30% of the risk exposure of a system.
  • (ASPM) Testing your production environment: You can also add the production environment of the system that Fluid Attacks tests as a second environment. Then this environment also gets the continuous security tests of Fluid Attacks. This option is available only in the Advanced plan.
  • (SCA) Malware advisories: Updated the scanner to report malware advisories in finding F488 - Use of software with malware.
  • (SAST) New rules: F002 Python Asymmetric Denial of Service.

January

Release 5

  • (ASPM) Inherited to surface: Renamed the Inherited section, which contained all the package-related information, to Packages. Also moved it into the Surface section.
  • (ASPM) UI improvements for Treatment modals: Updated Treatment modals to have less intrusive alerts.
  • (ASPM) Add policy information to DevSecOps and Members tab (Organization and Groups): Added informative banners that display the configured policies in the DevSecOps and Members sections.
  • (SBOM) Amazon Elastic Container Registry (ECR): The Fluid Attacks scanner supports Docker images from AWS Elastic Container Registry (ECR).
  • (SAST) New rules:
    • F004 JavaScript Arbitrary Command Injection
    • F004 Typescript Arbitrary Command Injection
    • Java CSFRHandler Hardcoded Password
    • F183 Java Debug Mode Enabled
    • F359 Java Hardcoded Password in SetPassword
    • F359 Java Key Manager Factory Hardcoded Password
    • F359 Java PBEKeySpec Kerberos Hardcoded Secret
    • F359 Java KeyStore Hardcoded Password
    • F390 JavaScript Prototype Pollution
    • F390 Typescript Prototype Pollution
  • (Reachability) New rule: Python CVE-2020-28975.

Release 4

Release 3

  • (ASPM) Added Type column in Packages: Added a new column to the Dependency Detail table that identifies if a dependency is direct or indirect.
  • (ASPM) Added Environment column in Packages: Added a new column to the Dependency Detail table that identifies the stage that uses a dependency: development ('Build') or production ('Run').

Release 2

(SAST) New rule: F149 Java Insecure SMTP SSL.

Release 1

  • (ASPM) Improved mutation to add CSPM environments: Previously, one mutation added all environments (APK, URL, or CSPM) to a Git root, and this could cause inconsistencies. Added a new mutation only for CSPM environments. This change makes the process more accurate and less prone to errors.
  • (SAST) New rules:
    • F130 Java Cookie Serializer Secure
    • F344 Java Wicket String Escaping
    • F159 Java Dangerous Permission
  • (SLA) Enhanced accuracy SLA: Fluid Attacks offers a 90%+ F2 score for risk exposure and a 90%+ F0.5 score for the number of vulnerabilities.

2026

Explore the 2026 Fluid Attacks changelog: MCP Secure Context, Fraud Risk View, new SCA lockfile support, and SAST rules.

2024

Explore the 2024 Fluid Attacks changelog: malware package tagging, SBOM export, Jira Security integration, and new SAST rules.

On this page

DecemberRelease 52Release 51Release 50Release 49NovemberRelease 48Release 47Release 46Release 45OctoberRelease 44Release 43Release 42Release 41Release 40SeptemberRelease 39Release 38Release 37Release 36AugustRelease 35Release 34Release 33Release 32JulyRelease 31Release 30Release 29Release 28Release 27JuneRelease 26Release 25Release 24Release 23MayRelease 22Release 21Release 20Release 19AprilRelease 18Release 17Release 16Release 15Release 14MarchRelease 13Release 12Release 10FebruaryRelease 9Release 8Release 7Release 6JanuaryRelease 5Release 4Release 3Release 2Release 1