Zypheron Desktop

Changelog

What shipped, in order. Security-relevant changes are marked.

Versions

v1.5September 2026 v1.4.2August 2026 v1.4.1August 2026 v1.4.0July 2026 v1.3.0June 2026 v1.2.0June 2026 v1.1.0May 2026

v1.5

September 19, 2026Unreleased

Unreleased cycle after 1.4.2. Workspace @mentions in chat, Network Map overhaul, AD and cloud collectors on one graph, and persisted C2 sessions. Packaged downloads remain 1.4.2 until this cuts.

Chat & Workspace References

Sidebar composer with live @mentions for hosts, AD nodes, cloud assets, findings, and code artifacts
Clicking a reference in a past message routes to the originating workspace and focuses the entity
Local OCR on attached screenshots (tesseract) folds extracted text into the prompt for non-vision models
Draft attachment lifecycle with session-scoped promote and a 7-day stale-purge sweep

Network Map

Subnet grouping by /24 with an explicit Internet boundary node and topology / exposure / attack-path / trust overlays
IPv6 and dual-stack rendering, with OS fingerprint and MAC in the inspector
BloodHound and SharpHound computer nodes projected onto the map with risky-edge overlays
Right-click: open in terminal as $T, or add the host to the in-memory scope store

AD, Identity & Cloud

Live BloodHound, SharpHound, and ROADrecon collectors with ingest into the AD graph
Kerberoast, AS-REP roast, and hash-crack panels driven from the identity workspace
Heuristic cloud importer for Azure Resource Graph, AWS Resource Explorer, GCP asset export, generic JSON, and BloodHound-azure
Bidirectional AD to cloud pivot for hybrid identity paths

Tools, RE & C2

Multi-engine reverse-engineering picker: Ghidra, radare2, IDA Pro, Binary Ninja
130+ tool inventory with ATT&CK-aware filters and send-to-terminal handoff
Desktop session persistence for Metasploit and Sliver, with explicit POST payloads on each session op

v1.4.2

August 14, 2026Current

Patch release for Linux users with Ollama detection fixes, tighter tool execution behavior, and refreshed packages.

AI & Local Models

Fixed Ollama model detection so local model availability is reported more reliably in the desktop app
Improved the handoff between AI-assisted tasks and tool execution so queued actions stay easier to trace

Tooling & Findings

Hardened nmap execution paths for more consistent scanner runs
Added stronger finding provenance and confidence handling around tool-generated results

Security & Build

Kept the desktop dev-mode bypass disabled in the packaged release
Published refreshed Linux AppImage, .deb, and .rpm builds with an updated 1.4.2 release feed

v1.4.1

August 12, 2026

AI chat gets sharper reasoning, key AI pentesting issues resolved, and Docker support lands for containerized workflows.

AI & Reasoning

Improved AI chat quality — clearer answers, better context handling
Better AI reasoning across multi-step tasks and tool chains
Resolved several AI-driven pentesting issues affecting scan accuracy and follow-through

Platform

Added Docker support for running Zypheron in containerized environments

Security & Build

Verified the desktop dev-mode bypass is compiled out of the release build before packaging
Rebuilt and repackaged the Linux AppImage, .deb, and .rpm from a clean production build
Refreshed the Linux auto-update feed with new package hashes and sizes

v1.4.0

July 26, 2026

Tightens the approval gate around every AI-driven action and simplifies how you connect model providers.

Security & Approvals

Pen-test approval gate now links straight to the evidence it references, and hands off to the AI tool-run bridge on approval
Closed a replay gap that let an approved action fire more than once
Hardened the approval gate release path against edge cases in step ordering
Every IPC handler payload, including the last unvalidated raw handlers, is now validated at the boundary before it reaches the main process
Concurrent scan queue ships with an ROE unrestricted-scope toggle for engagements that call for it
Real sign-in is required by default; the developer bypass mode used during builds no longer ships

Workspace

New Compliance tab with ATT&CK Navigator import
Local Ollama can now be deployed via Kubernetes and Helm
Attack Surface and Cloud Architecture maps simplified for faster scanning of large graphs
Refreshed topology device icons; steadier network map controls under rapid updates
Tooltips added across icon-only controls, plus purpose hints on each workspace section

Billing & Onboarding

Provider key entry moved inline into each model row, so there is one less screen to enter a key
Model labels simplified; redundant provider-credential summary removed
Trial gate and data resets hardened against edge-case bypasses
Pricing and trial access updated; advanced data controls condensed into one panel

v1.3.0

June 12, 2026

Findings sync live to the web dashboard, and terminals can run inside a Docker context.

Dashboard & Findings

Findings auto-push to the linked engagement the moment they're created or updated, including ones surfaced by scanner runs
New Open dashboard button jumps straight to the live web dashboard
Device linking accepts /join/{token} invite links directly

Terminal & Tools

Terminal sessions can now run inside a Docker container context
Tool arsenal prompts wired directly into the AI chat, no separate panel needed

Network Map

Fixed the map intermittently disappearing during rapid topology changes; rebuilds now debounce and tolerate transient faults

v1.2.0

June 10, 2026

Introduces the paid tier, and pulls Active Directory and cloud recon into one connected pipeline.

Active Directory & Cloud

Credential scrubber, stricter BloodHound collector schemas, and full BloodHound CE parity
Network map now surfaces next-actions and Auto-Doc suggestions directly on cloud privilege-escalation paths
Findings sync to the web dashboard with engagement linking

Reliability

Parsers guarded against uncaught throws and duplicate port entries
Fixed a bug where the database provider wasn't mounting on launch

Access

Zypheron Desktop moves behind account-based access with a 14-day no-card trial, then $35/mo or $350/yr. Zypheron Cloud remains the $149/mo team reporting plan.
Manual device-link fallback with configurable endpoints for non-standard network setups

v1.1.0

May 28, 2026

AI copilot starts reasoning across the attack chain instead of one finding at a time.

AI Copilot

AI attack-chain bridge connects related findings into a single reasoning path
AD-aware next-action suggestions, gated by ROE before any command auto-runs
BloodHound AD polish across Attack Surface, AI Assist, and Auto-Doc
Tighter handoff between Auto-Doc, AI Assist, and the Report Builder with less re-entering the same draft

Evidence & Reports

New evidence kinds that auto-emit from findings, plus an evidence vault and exploit generation
Report view got a visual pass with cleaner layout, contained scrolling, and a timestamp on every evidence row

Billing & Access

Tier gates reworked: workspaces free, operations and local AI paid, cloud BYOK free
Annual plan toggle added to Settings; Enterprise tier now correctly shows Custom instead of a fixed price

Release Infrastructure

New Linux release runbook and R2 upload pipeline for Linux builds
New app icon; fixed several bugs that only appeared in packaged builds, not dev mode

Get the current Linux build

Download Zypheron Desktop, verify the signed feed, and start with the 14-day no-card trial.

Download