{"id":7246,"date":"2025-11-17T14:41:34","date_gmt":"2025-11-17T12:41:34","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=announcement&#038;p=7246"},"modified":"2026-10-19T13:10:42","modified_gmt":"2026-10-19T10:10:42","slug":"whats-new-in-elements-october-2025","status":"publish","type":"announcement","link":"https:\/\/support.withsecure.com\/en\/announcements\/whats-new-in-elements-october-2025\/","title":{"rendered":"What&#8217;s New in Elements &#8211; October 2025"},"content":{"rendered":"<h2 data-id=\"extended-detection-and-response\"><strong>Extended Detection and Response<\/strong><\/h2>\n<h3 data-id=\"endpoint-protection\"><strong>Endpoint Protection<\/strong><\/h3>\n<h4 data-id=\"elements-agent-for-linux-now-available-for-arm64-architecture\"><strong>Elements Agent for Linux Now Available for ARM64 Architecture<\/strong><\/h4>\n<p>We are pleased to announce that <strong>Elements Agent for Linux<\/strong> now include support for ARM64-based systems.<\/p>\n<p>Installation packages are available for download in the\u00a0<a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fwww.withsecure.com%2Fen%2Fsupport%2Fdownload\" target=\"_blank\" rel=\"nofollow noopener ugc\">Download Center<\/a>\u00a0and in the\u00a0<a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Felements.withsecure.com%2Fapps%2Fcommon%2Fdownloads\" target=\"_blank\" rel=\"nofollow noopener ugc\">Elements Portal<\/a>.<\/p>\n<h4 data-id=\"withsecure-mobile-protection-for-ios\"><strong>WithSecure Mobile Protection for IOS<\/strong><\/h4>\n<p>An update to the WithSecure Elements Mobile Protection app for iOS (25.10.11981) has been released<\/p>\n<p>It includes the following fixed issues:<\/p>\n<ul>\n<li>The app and the WithSecure Elements Endpoint Protection portal now support the SMS Protection setting<\/li>\n<li>The &#8220;Recent Activities&#8221; view now shows occurrences for processed and blocked URLs<\/li>\n<li>Added a filtering option at the top of the list of checked URLs<\/li>\n<li>Added main screen for iPad devices<\/li>\n<li>Improvements to app stability<\/li>\n<li>Fixed an issue where Network Protection could interfere with certain applications&#8217; internet connectivity<\/li>\n<\/ul>\n<h4 data-id=\"withsecure-mobile-protection-for-android\"><strong>WithSecure Mobile Protection for Android<\/strong><\/h4>\n<p>An update to the WithSecure Elements Mobile Protection app for Android (25.4.0023361) has been released<\/p>\n<p>It includes improvements to app stability<\/p>\n<h2 data-id=\"exposure-management\"><strong>Exposure Management<\/strong><\/h2>\n<p>We are happy to share many improvements to WithSecure Exposure Management<\/p>\n<h4 data-id=\"recommendation-list-page-exposure-recommendations\"><strong>Recommendation list page (Exposure -&gt; Recommendations)\u00a0<\/strong><\/h4>\n<p>Recommendation list &#8220;Generate on&#8221; column is now showing the time of when the recommendation was given in the context of organization. <strong>Please note<\/strong> that historical recommendations may show very recent timestamp due to the fact that this info is only available since very recently.<\/p>\n<h4 data-id=\"saved-views-on-findings-recommendations-and-identities-pages\"><strong>Saved views on Findings, Recommendations and Identities pages<\/strong><\/h4>\n<p>Preserving the state of ordering is now supported by saved views.<\/p>\n<h4 data-id=\"unified-cloud-microsoft-tenant-configuration\"><strong>Unified Cloud Microsoft tenant configuration\u00a0<\/strong><\/h4>\n<p>New connection management for\u00a0<a href=\"https:\/\/community.withsecure.com\/en\/kb\/articles\/32544-new-feature-identity-inventory\" target=\"_blank\" rel=\"nofollow noopener ugc\">Identity Inventory<\/a>\u00a0released<\/p>\n<h4 data-id=\"identity-details-risk-assessment-tab\"><strong>Identity details &#8211; Risk assessment tab\u00a0<\/strong><\/h4>\n<p>There is now new possibility to filter Identity breaches by severity<\/p>\n<h4 data-id=\"finding-definitions-tab-added-under-environment-exposure\"><strong>Finding definitions tab added under Environment -&gt; Exposure<\/strong><\/h4>\n<p>The Finding Definitions page now lists all potential finding types that Exposure Management can detect\u2014across vulnerabilities, identities, cloud assets, and external attack surfaces. Unlike the Findings tab, this view includes definitions even if no asset is currently affected. It supports pagination, saved filters, and navigation to related data, consistent with other XM views.<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-acdc6649897948-c4c2.jpg.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-acdc6649897948-c4c2.jpg.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-acdc6649897948-c4c2.jpg.webp 902w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-acdc6649897948-c4c2-300x57.jpg.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-acdc6649897948-c4c2-768x145.jpg.webp 768w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-acdc6649897948-c4c2-447x84.jpg.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-acdc6649897948-c4c2-775x146.jpg.webp 775w\" sizes=\"auto, 100vw\" alt=\"image-acdc6649897948-c4c2.png\" height=\"170\" width=\"902\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<h4 data-id=\"service-principal-tab-add-under-environment-identities\"><strong>Service principal tab add under Environment -&gt; Identities<\/strong><\/h4>\n<p>The identities list now includes\u00a0<strong>Entra service principals<\/strong>\u00a0alongside users, providing basic information for each service principal. It supports pagination, saved filters, and navigation to related data, consistent with other XM views.<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-e7726d3b62fb-6f6a.jpg.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-e7726d3b62fb-6f6a.jpg.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-e7726d3b62fb-6f6a.jpg.webp 537w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-e7726d3b62fb-6f6a-300x163.jpg.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-e7726d3b62fb-6f6a-447x242.jpg.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-e7726d3b62fb-6f6a-269x146.jpg.webp 269w\" sizes=\"auto, 100vw\" alt=\"image-e7726d3b62fb-6f6a.png\" height=\"291\" width=\"537\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<h3 data-id=\"exposure-management-for-business\"><strong>Exposure Management for Business<\/strong><\/h3>\n<h4 data-id=\"new-feature-identity-inventory\"><strong>New Feature: Identity Inventory<\/strong><\/h4>\n<p><strong>Identity Inventory<\/strong>\u00a0is a new capability in WithSecure\u2122 Elements that provides a unified place for administrators to configure and manage Entra ID tenants. It simplifies Tenant management by centralizing visibility and control within the Elements Security Center.<\/p>\n<p>You can find out more about Identity Inventory in this <a href=\"https:\/\/community.withsecure.com\/en\/kb\/articles\/32544-new-feature-identity-inventory\" target=\"_blank\" rel=\"nofollow noopener ugc\">dedicated article<\/a><\/p>\n<h4 data-id=\"exposure-management-portal\"><strong>Exposure Management Portal<\/strong><\/h4>\n<ul>\n<li>Improved overall performance.<\/li>\n<li>Added an info banner to the Vulnerability Users page announcing its upcoming deprecation for all customers.<\/li>\n<li>Disabled Vulnerability Users page for new Exposure Management customers.<\/li>\n<li>Added support for logarithmic scales in the VM Histogram widget.<\/li>\n<li>Resolved an issue that caused errors when opening historical Web Scan reports.<\/li>\n<li>Resolved an issue where email notifications about low disk space on scan nodes were not being sent.<\/li>\n<li>Disabled Dashboard page by hiding the tab for new Exposure Management customers.<\/li>\n<\/ul>\n<h4 data-id=\"system-scan\"><strong>System Scan<\/strong><\/h4>\n<p>Support for detecting vulnerabilities in the following products was added to Authenticated Scanning: <\/p>\n<ul>\n<li>Apache Zeppelin<\/li>\n<li>Snappy Java<\/li>\n<\/ul>\n<p>Support for detecting vulnerabilities in the following products was added to Authenticated Scanning for Windows:<\/p>\n<ul>\n<li>FPGA Support Package for the Intel oneAPI DPC++\/C++ Compiler<\/li>\n<li>Intel Advisor<\/li>\n<li>Intel Connectivity Performance Suite<\/li>\n<li>Intel Distribution for GDB<\/li>\n<li>Intel DPC++ Compatibility Tool (DPCT)<\/li>\n<li>Intel Integrated Performance Primitives (IPP)<\/li>\n<li>Intel oneAPI Data Analytics Library (oneDAL)<\/li>\n<li>Intel oneAPI Deep Neural Network Library (oneDNN)<\/li>\n<li>Intel oneAPI DPC++ Library (oneDPL)<\/li>\n<li>Intel oneAPI Math Kernel Library (oneMKL)<\/li>\n<li>Intel oneAPI Threading Building Blocks (oneTBB)<\/li>\n<li>NetSupport Manager<\/li>\n<li>QEMU<\/li>\n<li>Schneider Electric Software Update<\/li>\n<\/ul>\n<h2 data-id=\"elements-foundations\"><strong>Elements Foundations<\/strong><\/h2>\n<h3 data-id=\"integrations\"><strong>Integrations<\/strong><\/h3>\n<h4 data-id=\"withsecure-elements-api\"><strong>WithSecure Elements API<\/strong><\/h4>\n<h5 data-id=\"new-remote-operation-send-full-status\"><strong>New remote operation (Send Full Status)<\/strong><\/h5>\n<p>We have added API support for the <strong>sendFullStatus <\/strong>remote operation, allowing administrators to request a full status report from devices. This operation is available for both computer and mobile devices and requires no additional parameters. After the operation is sent, the target device(s) will asynchronously send their status to the Elements Cloud.<\/p>\n<p>Read more from the <a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%2F\" target=\"_blank\" rel=\"nofollow noopener ugc\">api specification page<\/a>\u00a0under <strong>POST <\/strong>\/devices\/v1\/operations endpoint.<\/p>\n<h5 data-id=\"new-api-endpoint-get-incident-updates\"><strong>New API Endpoint: Get Incident Updates<\/strong><\/h5>\n<p>We have added a new endpoint to\u00a0the Elements API that provides programmatic access to incident update\u00a0history.<\/p>\n<p><strong>Endpoint Details<\/strong><\/p>\n<p><strong>GET<\/strong>\u00a0\/incidents\/v1\/updates<\/p>\n<p><strong>Description<\/strong><\/p>\n<p>This endpoint retrieves the\u00a0complete history of changes made to a specific incident\u00a0(Broad Context Detection). Each\u00a0update represents a modification\u00a0to the incident over its\u00a0lifecycle, including status changes, detection\u00a0additions, comments, and other\u00a0modifications.<\/p>\n<p><strong>Key Capabilities<\/strong><\/p>\n<p><strong>Update Types Tracked<\/strong><\/p>\n<ul>\n<li>Status\u00a0changes (patch)<\/li>\n<li>Detection additions, removals, and modifications<\/li>\n<li>User\u00a0comments<\/li>\n<li>Response actions<\/li>\n<li>Incident merges<\/li>\n<li>Risk\u00a0level adjustments<\/li>\n<li>Category\u00a0changes<\/li>\n<li>Threat investigation and validation results<\/li>\n<\/ul>\n<p><strong>State Tracking<\/strong><\/p>\n<p>Each\u00a0update includes\u00a0stateBefore\u00a0and\u00a0stateAfter\u00a0objects, allowing you to see\u00a0exactly what changed. This includes status, resolution, risk\u00a0level, and categories.<\/p>\n<p><strong>Origin Information<\/strong><\/p>\n<p>Updates\u00a0include source information indicating whether the change was made by:<\/p>\n<ul>\n<li>A user (with display name)<\/li>\n<li>An automated engine<\/li>\n<li>A response action<\/li>\n<\/ul>\n<p><strong>Pagination Support<\/strong><\/p>\n<p>Results can\u00a0be paginated using anchor-based navigation, with a configurable limit of 1-100\u00a0updates per request (default 50).<\/p>\n<p><strong>Filtering<\/strong><\/p>\n<p>Filter\u00a0updates by type to retrieve only relevant changes (e.g., only\u00a0comments or only status changes).<\/p>\n<p><strong>Customer Benefits<\/strong><\/p>\n<ol>\n<li><strong>Complete Audit Trail<\/strong>: Access\u00a0the full history of incident modifications for compliance\u00a0and reporting purposes.<\/li>\n<li><strong>Accountability<\/strong>: Identify who made specific changes to\u00a0incidents through origin tracking.<\/li>\n<li><strong>Integration\u00a0Support<\/strong>: Build automated workflows that respond to specific\u00a0types of incident updates.<\/li>\n<li><strong>Change\u00a0Analysis<\/strong>: Compare before and after states to understand the\u00a0evolution of an incident.<\/li>\n<li><strong>Efficient\u00a0Data Retrieval<\/strong>: Use type\u00a0filtering to retrieve only relevant updates, reducing unnecessary data transfer.<\/li>\n<li><strong>Scalability<\/strong>: Pagination support allows handling incidents with extensive update histories.<\/li>\n<\/ol>\n<p>Read more from the\u00a0<a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%2F\" target=\"_blank\" rel=\"nofollow noopener ugc\">Elements API specification<\/a>\u00a0page under &#8220;Get Incident Updates&#8221;.<\/p>\n<h5 data-id=\"new-restart-remote-operations\"><strong>New &#8220;restart&#8221; remote operations<\/strong><\/h5>\n<p>We have added two new remote operations to the Elements API device\u00a0operations endpoint that enable programmatic system\u00a0and agent restarts.<\/p>\n<p><strong>Operations Overview<\/strong><\/p>\n<p>The new operations &#8220;restartSystem&#8221; and &#8220;restartProduct&#8221; are available via the\u00a0<strong>POST<\/strong>\u00a0\/devices\/v1\/operations endpoint.<\/p>\n<p><strong>New Operations<\/strong><\/p>\n<p><strong>restartProduct<\/strong><\/p>\n<p>Restarts the WithSecure agent software\u00a0on a device without restarting the entire system.<\/p>\n<p><strong>restartSystem<\/strong><\/p>\n<p>Restarts the entire\u00a0device (full system reboot).<\/p>\n<p><strong>Batch\u00a0Capability<\/strong><\/p>\n<p>Both operations support batch execution on up to\u00a05 devices per request.<\/p>\n<p><strong>Benefits<\/strong><\/p>\n<ol>\n<li><strong>Agent Troubleshooting:<\/strong> Restart\u00a0the WithSecure agent without disrupting the user&#8217;s work by avoiding a full system reboot.<\/li>\n<li><strong>Maintenance\u00a0Automation:<\/strong> Integrate system restarts into automated maintenance workflows\u00a0following software updates or configuration changes.<\/li>\n<li><strong>User\u00a0Communication:<\/strong> Provide advance notice to users with custom messages before system restarts, improving user experience.<\/li>\n<li><strong>Efficient Remediation:<\/strong> Quickly restart multiple devices as part of incident\u00a0response or troubleshooting procedures.<\/li>\n<li><strong>Granular Control:<\/strong> Choose between agent-only or full system restarts based on the specific troubleshooting or maintenance requirement.<\/li>\n<li><strong>Operation Tracking:<\/strong> Track restart operations using returned operation IDs to\u00a0verify execution on remote hosts.<\/li>\n<\/ol>\n<p>Read more from the\u00a0<a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%2F\" target=\"_blank\" rel=\"nofollow noopener ugc\">Elements API specification<\/a>\u00a0under &#8220;Trigger remote operations on devices&#8221;.<\/p>\n<h5 data-id=\"new-response-actions-to-enable-new-workflows\"><strong>New response actions to enable new workflows<\/strong><\/h5>\n<p>We&#8217;ve added new response action endpoints under<\/p>\n<p>POST \/response-actions\/v1\/execute\/&lt;name&gt;<\/p>\n<p>to expand remote execution capabilities for both device and identity management.<\/p>\n<p>This allows you to automate new workflows that involve acting on the target devices and identities.<\/p>\n<p>This release increases the number of API supported response actions from 8 to 32.<\/p>\n<p><strong>Device response actions<\/strong><\/p>\n<p>The following device response actions are available:<\/p>\n<ul>\n<li><strong>Create full memory dump<\/strong>\u00a0&#8211; Uploads a full memory dump from the device<\/li>\n<li><strong>Delete registry key or value<\/strong>\u00a0&#8211; Deletes a specified Windows registry key or value<\/li>\n<li><strong>Delete scheduled task<\/strong>\u00a0&#8211; Deletes a specified Windows scheduled task<\/li>\n<li><strong>Delete Windows service<\/strong>\u00a0&#8211; Deletes a specified Windows service<\/li>\n<li><strong>Delete WMI persistence objects<\/strong>\u00a0&#8211; Deletes Windows Management Instrumentation (WMI) persistence objects<\/li>\n<li><strong>Enumerate running processes<\/strong>\u00a0&#8211; Enumerates running processes on the device<\/li>\n<li><strong>Enumerate WMI persistence mechanisms<\/strong>\u00a0&#8211; Enumerates WMI persistence mechanisms, including event consumers, filters, and bindings<\/li>\n<li><strong>List file system structure<\/strong>\u00a0&#8211; Lists the file system structure based on path matching patterns<\/li>\n<li><strong>List registry keys and values<\/strong>\u00a0&#8211; Lists Windows registry keys and values based on path matching patterns<\/li>\n<li><strong>List scheduled tasks<\/strong>\u00a0&#8211; Lists all Windows scheduled tasks on the device<\/li>\n<li><strong>Retrieve amcache files<\/strong>\u00a0&#8211; Retrieves the application compatibility cache file from the device<\/li>\n<li><strong>Retrieve antivirus logs<\/strong>\u00a0&#8211; Retrieves antivirus software log files for security analysis<\/li>\n<li><strong>Retrieve browser artifacts<\/strong>\u00a0&#8211; Retrieves the browser history from the device<\/li>\n<li><strong>Retrieve event log tracing files<\/strong>\u00a0&#8211; Retrieves .etl event log tracing files with records of system activities<\/li>\n<li><strong>Retrieve files from device<\/strong>\u00a0&#8211; Retrieves files from the device based on path matching patterns<\/li>\n<li><strong>Retrieve jump list files<\/strong>\u00a0&#8211; Retrieves jump lists stored in the AutomaticDestinations and CustomDestinations subfolders<\/li>\n<li><strong>Retrieve master boot record<\/strong>\u00a0&#8211; Retrieves the master boot record (MBR) from a specified drive<\/li>\n<li><strong>Retrieve master file table<\/strong>\u00a0&#8211; Retrieves the master file table (MFT) from a specified drive<\/li>\n<li><strong>Retrieve network connections<\/strong>\u00a0&#8211; Retrieves network connections, routing tables, interface statistics, and related process information<\/li>\n<li><strong>Retrieve prefetch files<\/strong>\u00a0&#8211; Retrieves Windows prefetch files with evidence of program execution<\/li>\n<li><strong>Retrieve process memory dump<\/strong>\u00a0&#8211; Retrieves a memory dump of a specific process<\/li>\n<li><strong>Retrieve RDP cache files<\/strong>\u00a0&#8211; Retrieves remote desktop protocol (RDP) bitmap cache files<\/li>\n<li><strong>Retrieve recently accessed files<\/strong>\u00a0&#8211; Retrieves information about recently accessed files and folders from user activity artefacts<\/li>\n<li><strong>Retrieve registry hive files<\/strong>\u00a0&#8211; Retrieves Windows registry hive files<\/li>\n<li><strong>Retrieve SRUM database<\/strong>\u00a0&#8211; Retrieves the system resource usage monitor (SRUM) database<\/li>\n<li><strong>Retrieve Windows event log entries<\/strong>\u00a0&#8211; Retrieves Windows event log entries based on specified filters<\/li>\n<li><strong>Retrieve Windows event log files<\/strong>\u00a0&#8211; Retrieves Windows event log files<\/li>\n<li><strong>Terminate process<\/strong>\u00a0&#8211; Terminates processes matching the specified patterns<\/li>\n<li><strong>Terminate thread<\/strong>\u00a0&#8211; Terminates a thread<\/li>\n<\/ul>\n<p><strong>Identity response actions<\/strong><\/p>\n<p>The following identity response actions are available for Microsoft Entra:<\/p>\n<ul>\n<li><strong>Block user access in Microsoft Entra<\/strong>\u00a0&#8211; Blocks access for a user to all resources inside the Microsoft Entra ecosystem<\/li>\n<li><strong>End Microsoft Entra session<\/strong>\u00a0&#8211; Ends the Microsoft Entra session of a user<\/li>\n<li><strong>Reset Microsoft Entra password<\/strong>\u00a0&#8211; Resets the Microsoft Entra password of a user<\/li>\n<\/ul>\n<p><strong>Response action results and attachments<\/strong><\/p>\n<p>Response actions are processed asynchronously: once triggered, you can monitor their progress.A new endpoint is available for retrieving the actual results of response actions that return data (for example, memory dumps or other files):<\/p>\n<p>GET\u00a0\/response-actions\/v1\/responses\/tasks<\/p>\n<p>By using this endpoint, you can download any files or attachments produced by completed response actions. To determine when your action has finished, first poll the state via\u00a0GET\u00a0\/response-actions\/v1\/responses. When the action is marked as finished, your attachments are ready for download from the tasks endpoint.<\/p>\n<p><strong>Start building<\/strong><\/p>\n<p>Full API documentation is available at <a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%2F\" target=\"_blank\" rel=\"nofollow noopener ugc\">Elements API Reference | WithSecure\u2122 Connect<\/a><\/p>\n<h2 data-id=\"other-items-of-interest\"><strong>Other items of interest<\/strong><\/h2>\n<h3 data-id=\"threat-advisory-october-docker-compose-path-traversal-vulnerability-cve-2025-62725\"><strong>Threat Advisory October: Docker Compose Path Traversal Vulnerability (CVE-2025-62725)<\/strong><\/h3>\n<p><strong>Technical Summary<\/strong><\/p>\n<ul>\n<li>A critical vulnerability in <strong>Docker Compose<\/strong>&#8216;s handling of OCI-based artifacts allows attackers to perform path traversal and write arbitrary files to the host system. This flaw stems from improper validation of layer annotations in <strong>YAML files<\/strong>, which are widely used in CI\/CD pipelines and development environments.<\/li>\n<li>Attackers can exploit this flaw by tricking users into referencing a malicious remote artifact. This enables them to escape the <strong>Compose<\/strong> cache directory and write files anywhere the Compose process has permissions\u2014potentially leading to full host compromise, data tampering, or privilege escalation.<\/li>\n<\/ul>\n<h2 data-id=\"share-your-ideas-with-us\"><strong>Share your ideas with us<\/strong><\/h2>\n<p>Our purpose is to co-secure the world with you \u2013\u00a0now as WithSecure\u2122. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via <a href=\"https:\/\/community.withsecure.com\/categories\/ideas\" target=\"_blank\" rel=\"nofollow noopener ugc\">the Ideas section of the WithSecure Community<\/a>, now accessible directly from WithSecure\u2122 Elements Security Center.<\/p>\n<figure class=\"entry-image display-medium float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-e5139ffa2aa21-31af.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-e5139ffa2aa21-31af.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-e5139ffa2aa21-31af.png.webp 337w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-e5139ffa2aa21-31af-300x298.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-e5139ffa2aa21-31af-150x150.png.webp 150w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-e5139ffa2aa21-31af-147x146.png.webp 147w\" sizes=\"auto, 100vw\" alt=\"image-e5139ffa2aa21-31af.png\" height=\"335\" width=\"337\" loading=\"lazy\" data-display-size=\"medium\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<h2 data-id=\"further-information\"><strong>Further information<\/strong><\/h2>\n<p>Changelogs and Release Notes for all parts of WithSecure\u2122 Elements can be found at the\u00a0<a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fwww.withsecure.com%2Fuserguides%2F\" target=\"_blank\" rel=\"nofollow noopener ugc\">Help Center<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Extended Detection and Response Endpoint Protection Elements Agent for Linux Now Available for ARM64 Architecture We are pleased to announce that Elements Agent for Linux now include support for ARM64-based&hellip;<\/p>\n","protected":false},"template":"","announcement_category":[142],"class_list":["post-7246","announcement","type-announcement","status-publish","hentry"],"acf":{"source_system":"vanilla-import","import_hash":"4f223b85514755144870c8b2180c4a11c5a41938","vanilla_article_id":32712,"legacy_author":"AndyF_WS","vanilla_url":"https:\/\/community.withsecure.com\/announcements-en\/kb\/articles\/32712-whats-new-in-elements-october-2025","vanilla_category_id":142,"machine_translated":false},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement\/7246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/announcement"}],"version-history":[{"count":1,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement\/7246\/revisions"}],"predecessor-version":[{"id":8756,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement\/7246\/revisions\/8756"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=7246"}],"wp:term":[{"taxonomy":"announcement_category","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement_category?post=7246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}