Endpoint Agent Release Notes - November 2026

Features or Fixes

• Feature: Added automatic updates for the Endpoint Protection component on Linux, enabling faster delivery of protection updates without requiring a full agent upgrade.
• Feature: Added the ability to run threat scans from the command line, with real-time progress and results shown directly in the terminal.
• Feature: Enabled common command-line operations without requiring administrator (root) privileges: status checks, scans, policy syncs, diagnostics, and quarantine list views.
• Feature: Added an error message when a detected threat can't be quarantined due to insufficient disk space.
• Feature: Added detailed crash reports to the diagnostic logs.

• Feature: Added specific actions taken on each threat, such as quarantined or blocked, to the scan and real-time protection results.

• Feature: Added more system details in the console for Linux agents.

• Feature: Improved detection of malicious non-Windows files, such as web shells.

• Fix: Fixed an issue where real-time protection would stop and report an error on endpoints under high system load, leaving the endpoint temporarily unprotected.

• Fix: Fixed an issue where uninstalling the Linux Endpoint Agent could leave background processes running if a threat scan was in progress at the time of removal.

• Fix: Fixed an issue on 64-bit (x64) systems where scans could fail after updating the agent.

• Fix: Fixed an issue where the protection component did not restart properly during the agent’s daily scheduled restarts.

• Fix: Fixed an issue where an agent could lose its Nebula group after updating from an earlier version.

Refer to the table below for the changes to the Endpoint Agent on Linux included in this release.