LoginSign Up
← Back to all sparks
W

Wazuh

INFRA · APIS
Velocity5.0

Open source security monitoring XDR and SIEM platform

wazuh.com ↗

Wazuh hardens its 4.14 line while 5.0 rebuilds how agents talk to the manager.

siemendpoint-securityopen-sourcesecurity-hardeningarchitecture
◆Current state
Wazuh ships 4.14 patch releases roughly every two to three weeks, and almost all of the content is security hardening: path traversal and command injection fixes, input validation in the cluster code, connection deadlines and memory leak fixes. 4.14.10 also added memory limits for oversized rulesets and queue warnings for the vulnerability scanner. In parallel, 5.0.0 reached its second release candidate on October 30.
◆Where it's heading
5.0 is the real change: agents move to HTTPS for talking to the manager, a new detection engine replaces the 4.x analysis daemon, and every server install becomes a cluster node. The 4.14 branch, meanwhile, reads like a security audit being worked through release by release, which keeps current installs safe while 5.0 settles.
◆Prediction
More 5.0 release candidates are likely before a final release, and 4.14 patch releases with security fixes should keep coming every few weeks; a 5.0 GA date is not stated in these entries.

◆Recent moves

  1. 2d ago

    Wazuh 4.14.11 RC1 tightens group paths and agent enrollment

    A release candidate made mostly of validation fixes: group paths that escape the shared directory are rejected, cluster workers refuse files the master should not push, and random enrollment failures are fixed. It continues the steady hardening of the 4.14 line.

    View source ↗
  2. 5d ago

    Wazuh 4.14.10 adds ruleset memory limits and closes a root injection

    4.14.10 adds warnings when scanner queues pass 100,000 items and limits on how much memory a ruleset may use, and fixes a root-level command injection in rootcheck plus several path traversal bugs. It is the clearest example of 4.14 doubling as a security audit.

    View source ↗
  3. 14d ago

    Wazuh 5.0 RC2 swaps in a new detection engine

    The second 5.0 release candidate adds the Wazuh Engine in place of the 4.x analysis daemon and a new inventory sync path to the indexer, on top of RC1's HTTPS agent protocol. It is still a pre-release, so the architectural shift lands for production users only at 5.0 final.

    View source ↗
  4. 29d ago

    Wazuh 4.14.9 adds compiler hardening to Linux binaries

    Linux binaries now ship with standard compiler hardening, idle enrollment and cluster connections get deadlines, and a scanner stall is fixed. More defensive work on the branch most users run.

    View source ↗
  5. 1mo ago

    Wazuh 5.0 RC1 moves agents to HTTPS and makes every server a cluster

    The first 5.0 release candidate replaces the old agent-to-manager protocol with HTTPS and removes the non-clustered deployment mode. It sets the direction for the product, but as a release candidate it is a preview rather than a shipped change.

    View source ↗
  6. 1mo ago

    Wazuh 4.14.8 fixes an alert-stopping deadlock

    4.14.8 fixes a deadlock that stopped alerts when the active response queue filled, plus a series of path validation and upgrade command restrictions. Reliability and security fixes in equal measure.

    View source ↗