New content
New bonus minigame: proxychain.sh. Stand up relay hops to route your traffic to a target host before the trace catches up. You place whatever the queue hands you, with no skipping. A dead end drops the connection, but every hop still scores, and a longer route than you strictly needed pays better. Three difficulties, each with its own leaderboard. Find it in the Games menu (Ctrl+J), alongside greylist.exe, worm.sh and waf-buster.exe.
New scanner tool: Nuclei Templates. $3,000, sitting between the Python Fuzz Script and Burp Suite Pro, and the first tool in the game whose output isn't flat. Its base rate matches the fuzz script, but it gains 15% for every distinct vulnerability class you have ever discovered, up to 2.35x with all nine. Going wide across scan modes now makes a tool you already own measurably better, and grinding a single mode does nothing for it. Comes with paired research, the Community Template Feed.
New event: the Anonymous Tip. Rarely, a chip with a glow that fades through a shifting rainbow scrolls past in your findings ticker. Click it before it scrolls off and one lead cascades into a burst of findings over several seconds, each paying its own bounty, with one guaranteed to be a vulnerability class you have never seen before - which permanently raises Nuclei Templates' multiplier. The ticker is something you watch now, not just something that reports.
Three new music tracks. System Failure, System Sleep, and Water in the Wire, each with its own cover art in the player.
Three new desktop backgrounds. Nightshift, System Sleep, and System Failure.
Redesigns
apt, the package manager. 34 rows in one long flat scroll became a left sidebar, matching the Store and Challenges windows. Scanners are now grouped Web App, Cloud & Infra, and AI-Assisted, with Research and Black Market as their own sections. Installed tools stay put in their category and restyle in place instead of jumping to a separate list at the bottom.
Settings. The Display section had grown to 13 subsections in a single scroll. It is now split into Theme (background effect, background color, color theme, wallpaper), Desktop (ticker, widgets, icons, windows, text size, animations) and Display (window mode, vsync, framerate cap) - which also makes it visible which settings are per-mode and which are global.
Fixes
Adding to a cloud fleet you already own. Cloud instances are permanent across engagements, but buying another one was still gated on the tool's reputation requirement, and reputation resets every engagement. You could be looking at a running cloud fleet you owned and be unable to extend it. That gate is gone for tools you already have cloud instances of.
The cloud rules are now stated up front. The Remote Monitor and the System Manual both say outright that you do not need to own a tool locally before deploying it to the cloud. That was always true and intended - the 5x price premium is what buys you a tool that needs no local hardware at all - but nothing said so, and the Tools window hides a tool's tab until you own it locally, so the same deploy was reachable in one window and not the other.
Deploy buttons explain themselves. Cloud Deploy and Rush Deploy now say why they are unavailable instead of explaining how to use a button that cannot be clicked, and a couple that were dim-but-clickable, silently doing nothing, are properly disabled.
The critical bug's "Lucky Find" RCE reward was never recorded as a find of that vulnerability class, so it never counted toward the Vuln Wiki, never unlocked the RCE entry, and never fed Nuclei Templates' multiplier. It does now.
Vulnerability classes discovered only through offline cloud progress silently re-locked their wiki entry at the next engagement.
The tool tooltip's "Each generates $X/sec" figure ignored every research, black-market and broker multiplier you had bought. It now matches what htop and the Tools window report. Displayed rates will read higher than before, but nothing about your actual income changed.
The SQL injection wiki entry's login-bypass example was wrong, caught by a player report. On its own, the classic ' OR '1'='1 payload does not bypass a login: AND binds tighter than OR, so the query ends up matching only an empty password. The example now includes the trailing -- comment that removes the password check, and explains why that comment is the part doing the work. The wiki is meant to teach the real thing, so thank you for flagging it.
The Bank window made the whole desktop stutter while it was open, and got worse the longer it stayed open. It was re-reading the ledger from disk ten times a second and rebuilding its entire transaction list on the same tick.
The Report window's Stats and Summary tabs caused stutter while open.
The findings ticker scrolled jitterily, and its top row flickered. Lane speeds are now chosen so a lane advances a whole number of pixels per frame, adjusted at runtime to suit your display's refresh rate, which is what both problems came down to. The per-lane background bands also fade out now instead of blinking off the moment a lane empties.
Desktop widgets got wider, and drifted down and to the left, after switching between Career and Persistence Mode. Previously only "Reset Widget Positions" would put them back.
Full changelog, including previous releases: https://www.vulnbyte.com/changelog