Important Highlights
- Add KylinSecServer6 OS baseline support (#14788)
- Add new product for Ubuntu 26.04 and a default profile (#14721)
- Create RHEL 10 STIG control file (#14826)
- Debian13 20260702 (#14851)
- DISA STIG Update RHEL 8 to v2r8 (#14986)
- DISA STIG Update RHEL 9 to v2r9 (#14987)
- Update OL8 STIG profile to DISA STIG V2R8 (#14738)
- Update RHEL 10 STIG to V1R2 (#14872)
- Update Ubuntu 24.04 STIG profile from V1R1 to V1R5 (#14854)
New Rules and Profiles
- Add new rule rsyslog_omfwd_authmode (#14911)
- Add new rule rsyslog_omfwd_streamdriver (#14887)
- Add new rule rsyslog_omfwd_tls (#14888)
- Add service disable rules for Kea DHCP server (CIS 2.1.3) (#14765)
- Add sshd_set_allow_groups rule for SSH group-based access control (#14774)
- Add sysctl persistence rules for Debian (#14768)
- Add UFW default policy rules with OVAL checks (CIS 3.3.x) (#14767)
- Adding Debian 13 CIS controls to the benchmark (#14684)
- Create new rule file_permissions_cron_not_modified (#14901)
- Create rule file_permissions_sshd_config_not_modified (#14897)
- Create rule socket_pcscd_enabled (#14902)
- Move RHEL-08-030610 to RHEL-09-653110 to use 0600 for audit files (#14991)
Updated Rules and Profiles
- Adapt audit rules for SLE16 platform (#14904)
- Adapt DHCP related rules to SLE16 platform (#14893)
- Add CIS Debian Linux 13 sections 2-4 to controls file (#14876)
- Add RHEL-08-040221, RHEL-08-040222, RHEL-08-040287 to RHEL8 STIG (#14997)
- Add slmicro6 and sle16 support for some rule (#14827)
- Check selection lines with direct attributes in aide.conf (#14883)
- controls/cis_debian13: Map remaining controls in sections 6-7 (#14877)
- Debian13 20260702 (#14851)
- DISA STIG Update RHEL 8 to v2r8 (#14986)
- DISA STIG Update RHEL 9 to v2r9 (#14987)
- Fix rsyslog rainerscript oval (#14728)
- Move RHEL-08-030610 to RHEL-09-653110 to use 0600 for audit files (#14991)
- Remove draft status from RHEL 10 OSPP profile (#14736)
- RHEL 10 STIG profile fixes (#14953)
- SLE16 fixes for sshd configuration related rules (#14439)
- Stabilization: Add missing hipaa reference to logind_session_timeout (#15045)
- Update RHEL 10 STIG to V1R2 (#14872)
- Update Ubuntu 24.04 STIG profile from V1R1 to V1R5 (#14854)
Changes in Remediations
- Adapt audit rules for SLE16 platform (#14904)
- Add slmicro6 and sle16 support for some rule (#14827)
- change to GVariant format (#14829)
- Check selection lines with direct attributes in aide.conf (#14883)
- fix: correct audit_backlog_limit definition in /etc/default/grub (#14850)
- SLE login.defs drop-in configuration fixes (#14925)
- SLE16 fixes in ansible for pcidss rules (#14972)
- Sle16 dropin hipaa fixes (#14954)
- Sle16 update sudoers related rules checks and remediations (#14698)
- Stabilization: Fix for sshd_lineinfile template to comply with newer ansible versions (#15055)
Changes in Checks
- change to GVariant format (#14829)
- Check selection lines with direct attributes in aide.conf (#14883)
- firewalld_loopback_traffic_restricted: fix OVAL check and OCIL typo (#14907)
- Fix no_invalid_shell_accounts_unlocked for unlocked user in last line of /etc/passwd (#14751)
- Fix rsyslog rainerscript oval (#14728)
- Fix typo in snmpd_use_newer_protocol OVAL check and add tests (#14881)
- grub2_bootloader_argument_absent template: fix OVAL regex (#14908)
- Make no_shelllogin_for_systemaccounts oval consistent in uid_min usage (#14975)
- no_invalid_shell_accounts_unlocked: fix OVAL check to catch valid and invalid shell accounts (#14792)
- Remove RHEVH checks from RHEL 9 and 10 OS detection (#14909)
- SLE login.defs drop-in configuration fixes (#14925)
- Sle16 update sudoers related rules checks and remediations (#14698)
- template: kernel_module_disabled, use rule_id in OVAL definition name (#14787)
Changes in the Infrastructure
- Add COVERAGE_FILE for python unit tests (#14948)
- Add SLE16 to SUSE gating (#14742)
- Ensure all products are built in CI (#14756)
- Fix test_idtranslator_translate_oval_xmldiff (#14794)
- Fix three RCE vectors in the build system (#14882)
- lint: disable yamllint line-length check (#14793)
- Prevent duplicate keys in YAML files (#14966)
- Remove compliance-trestle dependency (CVE-2026-45725) (#14743)
- Update draft-pr skill to open PRs in the browser (#14791)
Changes in the Test Suite
- Allow Automatus to connect to remote qemu (#14935)
- firewalld_loopback_traffic_restricted: fix OVAL check and OCIL typo (#14907)
Documentation
- Ensure all products are built in CI (#14756)
- lint: disable yamllint line-length check (#14793)
- Simplify build_product commands in Claude Skills (#14927)
Fixed Bugs
- Add a rationale for package_sssd_installed (#14856)
- CMP-4339: Added
documentation_complete: truetags to rules that were missing it (#14810) - Enable CIS rsyslog tailoring for RHEL 9 and RHEL 10 (#14960)
- file_permission_user_init_files_root: include /root in OCIL check (#14732)
- firewalld_loopback_traffic_restricted: fix OVAL check and OCIL typo (#14907)
- Fix overlayfs kernel mod name (#14763)
- Fix rsyslog CI issues (#14754)
- Fix rsyslog rainerscript oval (#14728)
- Fix typo in snmpd_use_newer_protocol OVAL check and add tests (#14881)
- grub2_bootloader_argument_absent template: fix OVAL regex (#14908)
- no_invalid_shell_accounts_unlocked: fix OVAL check to catch valid and invalid shell accounts (#14792)
- Remove RHEVH checks from RHEL 9 and 10 OS detection (#14909)
- Revert the bootc_build platoform change for disk_partitioning group (#14999)