v26.8

M&NTIS Platform v26.8 focuses on two axes: seeing what the attack actually did, with the raw output of every red team command now shown in the console; and a substantially faster interface.

Attack Visibility

• The console tab now shows the raw output of each executed command, on an output> line under the command itself. Until now the platform reported the commands an attack step ran and the knowledge it extracted (hosts, credentials, payloads), but never what the target actually returned.
• This applies to scenario attack steps and to manually issued redteam commands alike (such as Atomic tests), and the output is part of the attack report served by the Redteam API — so it is available to your own tooling, not only in the interface.
• The attack details overview follows the new design.
• Copy all in the lab attack console now copies every command rather than part of them.

Performance and Reliability

• Lab listing is roughly three times faster and its response time is cut by about 70%.
• A lab stopped while it was still queued is now released properly.
• Archive extraction in the catalog is now bounded, and API tokens malformed or signed by an unknown key are rejected cleanly instead of producing a server error.

Interface

• Scenario page redesigned.
• Account page redesigned.

Scenarios and Content

• Vesperlyn now runs over HTTPS by default. The attacker's control channel is deployed over TLS regardless of the scenario profile, and the certificate is installed by a dedicated attack step instead of manual commands — a closer match to how an operator actually sets this up.
• Suricata basebox updated (hostname fixed).

For API Consumers

Breaking change: dates are ISO 8601

Every date and timestamp served by the platform's REST APIs is now an ISO 8601 UTC string (2026-09-03T14:20:00Z).

• Lab timestamps were previously Unix epoch seconds as numbers.
• Attack report dates, security alert times, notification dates and assessment submission dates were previously free-form strings.
• A date with no value is now null; it used to be an empty string, which is no longer accepted as input.

Existing lab data is migrated automatically. If you consume these APIs from your own tooling, adapt your date parsing before upgrading.

• The attack report exposes a new result field on each command, carrying that command's raw output.