Release notes

# New multi-framework security questionnaire

Toby Roger July 17, 2024

We’ve developed a Multi-Framework Security Questionnaire that comprehensively maps to both ISO 27001:2022 and NIST CSF 2.0, and it is now available to all customers in the questionnaire library. This dual-standard approach offers a holistic view of a third party’s security posture, ensures robust incident response and recovery plans, and demonstrates a commitment to high security standards. We’re excited to roll out even more questionnaires covering global and local regulations in coming releases.

### Detection of regreSSHion (CVE-2024-6387)

CVE-2024-6387 is a high-severity vulnerability in OpenSSH servers that, if exploited, facilitates Remote Code Execution with full root privileges (CVSS 8.1). This will raise a verified vulnerability and the high severity risk “Vulnerable to CVE-2024-6387 (OpenSSH regreSSHion Remote Code Execution)“.

### Detection for polyfill.io inclusions

Recently the polyfill.io domain has taken new ownership. This has presented a new supply chain risk because they host the CDN for the polyfill JavaScript package. This will raise a new informational risk called “Polyfill.io or Polyfill.com Discovered”

### Summary page added for Subsidiaries

For Breach Risk plans that include subsidiaries, we’ve added a Subsidiary Summary page to allow you to view the security posture of your subsidiaries in more detail, including category breakdowns and geolocation details. To learn more see [What is the subsidiary summary page](https://help.upguard.com/en/articles/9609814-what-is-the-subsidiary-summary-page).

### Other improvements

* This release includes a number of bug fixes

[View all release notes](/releases)

## UpGuard Release Notes

Learn about new features, changes, and improvements to UpGuard.

### PHP2Shell detection now live in UpGuard

Mark Barber October 21, 2026

[Read more](/releases/php2shell-detection-now-live-in-upguard)

### Close related exposed credential threats in one step

Mark Barber October 20, 2026

[Read more](/releases/close-related-exposed-credential-threats-in-one-step)

### Security Profile citations now include source control references

Mark Barber October 6, 2026

[Read more](/releases/security-profile-citations-now-include-source-control-references)

### Threat Posture: an executive view of external threat activity

Mark Barber September 22, 2026

[Read more](/releases/threat-posture-an-executive-view-of-external-threat-activity)

### Brand impersonation detection across mobile app stores

Mark Barber September 9, 2026

[Read more](/releases/brand-impersonation-detection-across-mobile-app-stores)

### Clearer citations and timeline for Security Profile checks

Mark Barber August 26, 2026

[Read more](/releases/clearer-citations-and-timeline-for-security-profile-checks)

### Subprocessors in Trust Center

Mark Barber August 12, 2026

[Read more](/releases/subprocessors-in-trust-center)

### Cloud and core infrastructure frameworks in Security Profile

Mark Barber July 29, 2026

[Read more](/releases/cloud-and-core-infrastructure-frameworks-in-security-profile)

[View all release notes](/releases)

### See UpGuard In Action

Book a free, personalized onboarding call with one of our cybersecurity experts.

[Free trial](https://www.upguard.com/demo)

[Get a demo](https://www.upguard.com/contact-sales)

Free instant security score

## How secure is your organization?

Request a free cybersecurity report to discover key risks on your website, email, network, and brand.

* Instant insights you can act on immediately
* Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities

[Free score](https://www.upguard.com/instant-security-score?)