https://defended.net/blog/ Release notes, signature updates and announcements from the defended open source security projects. en Fri, 04 Sep 2026 00:00:00 GMT https://defended.net/blog/malwatch-153/ https://defended.net/blog/malwatch-153/ Fri, 04 Sep 2026 00:00:00 GMT Skip handling is now zero alloc. Performance gains of approximately 5% faster scan times along with over 5% cpu and 1% memory reductions. malwatch https://defended.net/blog/malwatch-152/ https://defended.net/blog/malwatch-152/ Sat, 25 Jul 2026 00:00:00 GMT Flag and callback handling with yara scanner c binding optimised for our use case. The larger the files are, the more this improvement shines. malwatch https://defended.net/blog/malwatch-151/ https://defended.net/blog/malwatch-151/ Sat, 13 Jun 2026 00:00:00 GMT Version 1.5.1 just got published. This release focuses on adding optimisations and extending concurrency safety as well as adding even more test coverage. malwatch https://defended.net/blog/malwatch-150/ https://defended.net/blog/malwatch-150/ Sat, 16 May 2026 00:00:00 GMT Today's release 1.5.0 is large at 10 000 line changes. It introduces powerful features, paired with rigid security hardening. Malware cleaning is now sandboxed and file handling is more secure with integration of os.Root. Users with our developer time have already had their integrations uplifted before this version, please contact us if we can help. Alerting now has slack added as an integration and the sysd install process has been converted to be template driven. Recent cPanel vulnerabilities have demonstrated our solutions. Everyone can be protected. malwatch https://defended.net/blog/malwatch-142/ https://defended.net/blog/malwatch-142/ Sat, 14 Mar 2026 00:00:00 GMT Vulnerability with cloudflare/circl **[GO-2026-4550](https://pkg.go.dev/vuln/GO-2026-4550)** resolved. This project was unaffected by these third party vulnerabilities. malwatch https://defended.net/blog/malwatch-141/ https://defended.net/blog/malwatch-141/ Sun, 01 Mar 2026 00:00:00 GMT Following our engineering tradition, major new releases are followed by refactors with added test coverage for other packages. In this version path validation has been refactored with emphasis on path traversal. We have also improved scan worker file descriptor stat handling. We care greatly about code quality, features are a secondary priority. Feedback is always welcome. malwatch https://defended.net/blog/malwatch-140/ https://defended.net/blog/malwatch-140/ Sat, 07 Feb 2026 00:00:00 GMT Version 1.4.0 introduces hot reloads for malware signature changes. The design is with concurrency carefully considered using an implementation of reference accounting for worker threads as to ensure no interruptions as well as safe garbage collection given cgo. Real time monitoring no longer requires a service restart to recognise those changes. Feedback is always welcome. malwatch https://defended.net/blog/malwatch-134/ https://defended.net/blog/malwatch-134/ Wed, 07 Jan 2026 00:00:00 GMT This project was unaffected by these third party vulnerabilities. Feedback is always welcome. malwatch https://defended.net/blog/malwatch-133/ https://defended.net/blog/malwatch-133/ Fri, 17 Oct 2025 00:00:00 GMT Release 1.3.3 further tightens filesystem permissions and includes an updated yara library to 4.5.4. Feedback is always welcome. malwatch https://defended.net/blog/malwatch-132/ https://defended.net/blog/malwatch-132/ Sun, 05 Oct 2025 00:00:00 GMT Release 1.3.2 provides minor improvements with signal handling and better cli help output. Feedback is always welcome. malwatch https://defended.net/blog/malwatch-131/ https://defended.net/blog/malwatch-131/ Sat, 27 Sep 2025 00:00:00 GMT This release brings minor improvements in terms of panic error handling. It also resolves a toctou race condition regarding the lockfile. malwatch https://defended.net/blog/malwatch-signatures-1-1-1/ https://defended.net/blog/malwatch-signatures-1-1-1/ Thu, 18 Sep 2025 00:00:00 GMT Users will automatically receive these updates. Keep submitting samples for our analysis ❤️ signatures https://defended.net/blog/malwatch-signatures-1-1-0/ https://defended.net/blog/malwatch-signatures-1-1-0/ Sat, 13 Sep 2025 00:00:00 GMT Introduces a new exp family is the starting point to represents exploit frameworks that use more advanced techniques such as manipulating memory. There is now also clearer bd classification with an rce category added. signatures https://defended.net/blog/malwatch-signatures-1-0-7/ https://defended.net/blog/malwatch-signatures-1-0-7/ Sat, 06 Sep 2025 00:00:00 GMT Users will automatically receive these updates. Keep submitting samples for our analysis ❤️ signatures https://defended.net/blog/malwatch-130/ https://defended.net/blog/malwatch-130/ Tue, 02 Sep 2025 00:00:00 GMT The switch to musl for extended compatibility predictably created a small performance decline. That can however be regained as well as unlock a meaningful reduction in memory usage by pairing mimalloc. malwatch https://defended.net/blog/malwatch-signatures-1-0-5/ https://defended.net/blog/malwatch-signatures-1-0-5/ Thu, 28 Aug 2025 00:00:00 GMT Further information is available at the **[GitHub release](https://github.com/defended-net/malwatch-signatures/releases/tag/v1.0.5)** or **[project page](/malwatch)**. signatures https://defended.net/blog/malwatch-signatures-1-0-6/ https://defended.net/blog/malwatch-signatures-1-0-6/ Thu, 28 Aug 2025 00:00:00 GMT This update also includes a significant prune of unnecessary third party signatures. Our newly developed in house malware signature base delivers a higher detection rate for a footprint which is 50x smaller. signatures https://defended.net/blog/malwatch-signatures-1-0-4/ https://defended.net/blog/malwatch-signatures-1-0-4/ Fri, 22 Aug 2025 00:00:00 GMT Further information is available at the **[GitHub release](https://github.com/defended-net/malwatch-signatures/releases/tag/v1.0.4)** or **[project page](/malwatch)**. signatures https://defended.net/blog/malwatch-signatures-1-0-3/ https://defended.net/blog/malwatch-signatures-1-0-3/ Sun, 17 Aug 2025 00:00:00 GMT Further information is available at the **[GitHub release](https://github.com/defended-net/malwatch-signatures/releases/tag/v1.0.3)** or **[project page](/malwatch)**. signatures https://defended.net/blog/malwatch-signatures-1-0-2/ https://defended.net/blog/malwatch-signatures-1-0-2/ Wed, 13 Aug 2025 00:00:00 GMT Further information is available at the **[GitHub release](https://github.com/defended-net/malwatch-signatures/releases/tag/v1.0.2)** or **[project page](/malwatch)**. signatures https://defended.net/blog/malwatch-signatures-1-0-1/ https://defended.net/blog/malwatch-signatures-1-0-1/ Tue, 22 Jul 2025 00:00:00 GMT Further information is available at the **[GitHub release](https://github.com/defended-net/malwatch-signatures/releases/tag/v1.0.1)** or **[project page](/malwatch)**. signatures https://defended.net/blog/malwatch-122/ https://defended.net/blog/malwatch-122/ Wed, 16 Jul 2025 00:00:00 GMT Scan worker iterative errors and file read offsets are now reused. The file read buffer is also no longer reallocated per offset. malwatch https://defended.net/blog/malwatch-121/ https://defended.net/blog/malwatch-121/ Fri, 13 Jun 2025 00:00:00 GMT Cloudflare disclosed [GHSA-2x5j-vhc8-9cwm](https://github.com/golang/vulndb/issues/3754), this project was unaffected. malwatch https://defended.net/blog/malwatch-120/ https://defended.net/blog/malwatch-120/ Tue, 10 Jun 2025 00:00:00 GMT We receive many questions concerning compatibility with different platforms / control panels. This a major release with focus on cleaner implementation for new integrations. It comes bundled with newly added seamless support for DirectAdmin. malwatch https://defended.net/blog/malwatch-112/ https://defended.net/blog/malwatch-112/ Sat, 24 May 2025 00:00:00 GMT We receive many questions concerning compatibility with older versions of glibc, in particular CentOS 7. Certain default older AlmaLinux or Ubuntu / Debian systems can encounter errors based on the installed version of glibc. malwatch https://defended.net/blog/malwatch-110/ https://defended.net/blog/malwatch-110/ Tue, 01 Apr 2025 00:00:00 GMT Release 1.1.0 introduces a major feature, the ability to submit malware samples by means of our new API. No signup is needed to use this service and everyone has one upload permitted per week, with additional available to project **[Sponsors](https://defended.net/sponsor)**. malwatch https://defended.net/blog/malwatch-111/ https://defended.net/blog/malwatch-111/ Tue, 01 Apr 2025 00:00:00 GMT Go disclosed **[GO-2025-3595](https://pkg.go.dev/vuln/GO-2025-3595)**, this project was unaffected. malwatch https://defended.net/blog/malwatch-103/ https://defended.net/blog/malwatch-103/ Mon, 17 Mar 2025 00:00:00 GMT Go disclosed **[GO-2025-3503](https://pkg.go.dev/vuln/GO-2025-3503)**, this project was unaffected. malwatch https://defended.net/blog/malwatch-102/ https://defended.net/blog/malwatch-102/ Mon, 10 Mar 2025 00:00:00 GMT Further information is available at the **[GitHub release](https://github.com/defended-net/malwatch/releases/tag/v1.0.2)** or **[project page](/malwatch)**. malwatch https://defended.net/blog/malwatch-101/ https://defended.net/blog/malwatch-101/ Wed, 05 Mar 2025 00:00:00 GMT Small performance gain from optimisations special thank you to go team's 1.24 release. malwatch https://defended.net/blog/announcing-malwatch/ https://defended.net/blog/announcing-malwatch/ Wed, 12 Feb 2025 00:00:00 GMT Today marks the inaugural release of malwatch, an open source malware scanning solution designed for web server environments which is currently in production with some of the internet's busiest websites. It is remarkably performant and lightweight in equal measure. announcement