Code Name (Themis) 

We are pleased to announce the release of r2026-01 CYBER RANGES, code-named Themis! 
This release introduces key improvements across the Main App, Scenario Composer, Admin App, and multiple Backend Services. Alongside significant new features and security enhancements, we’ve made upgrades to performance, streamlined technical operations, and resolved a range of bugs for better stability. 

Highlights 

What’s New [APP] 

Scenario & Event Management 

• Team-Specific Events: When fetching events, a new 'team' query parameter has been added, allowing for more specific event filtering and management. 

• User Server Snapshots: Users can now take snapshots of their running servers directly from the servers page within the instance view, providing personal restore points. 

• Scenario Content Placeholder: A new 'no content' placeholder message is now displayed on the Playlist view when no scenarios or playlists are currently available. 

Observer & Administration 

• Wiki Visibility: Observer users can now toggle the visibility of wikis, giving them control over what content is accessible to participants. 

  

• Instance Information: An 'admin view info box' is now shown in the instance view, providing additional context and information for administrative users. 

• Password Expiration: Added support for password expiration functionality during login. 

Stability & Usability Fixes 

• Authentication: Fixed issues with AD and Radius authentication, ensuring login now works properly and consistently. 

• Event Actions: Enabled all top-bar indicators after an event starts (except 'auto start'), and ensured enabled actions work correctly when toggled. 

• Top Bar Fix: Resolved issues with top-bar indicators and added a fix to properly display the 'password protected' indicator only when active. 

Dev Notes - Fixes and Improvements [APP] 

• Chat Upgrades: File upload functionality has been significantly improved, now allowing all file types to be uploaded, and fixing an issue where zip files were not sending correctly on Windows. 

• Observer Stability: Proper handling has been implemented for scenarios that have a misconfigured CAG dashboard, preventing UI errors. A missing success notification pop-up was also added for observer injections. 

• System Quality: Major internal upgrade to core UI components, significantly improving the stability and future maintainability of the application. 

• Internal Security: Prepared for an internal upgrade to a more secure mechanism for handling build credentials, which improves security compliance. 

• Minor Fixes: Corrected an issue where scenario fetching was being triggered twice, and resolved a routing problem on the 'reset expired password' page. 

What’s New [Composer] 

Cloud Composer & Diagram 

• Advanced Snapshotting: Added support for multiple server node snapshots per node, allowing for more flexible recovery points during scenario execution. 

• Internet Access Control: Users can now easily set up and manage full internet access for server nodes and cloud templates directly within the composer. 

Whitelisted IPs and Domains settings are only editable for templates with strategies Injector Engine 3 or Parent Template. 

• Diagram Clarity: 

  • Diagram nodes now display a satellite icon to indicate that internet access is enabled. 

  • The diagram now clearly displays network routing paths, providing better visibility into network traffic flow. 

  • Removed the grid background from the nodes diagram in full-screen view for better focus. 

• Server Status: You can now manually mark a container node as 'dirty' or 'undirty' to track changes during scenario creation. This action is correctly restricted to templates where the instance is running. 

• Cloud Image Properties: Added support for additional properties within cloud images, expanding customisation and metadata options. 

Security and Quality 

• Password Expiration: Added support for password expiration functionality during login. 

• Test Suite Rework: The test suites for Assessment View, Login, Store, and Subscription pages were significantly reworked to ensure they pass reliably across all browsers. 

Dev Notes - Fixes and Improvements [Composer] 

• Usability: Added a "Fit to Screen" button for the nodes diagram and adjusted the scroll sensitivity for a smoother experience. 

• Scenario Cloning: When cloning a scenario, the injection activity is now correctly removed. 

• Snapshot Restore: Fixed an issue where restoring a server snapshot did not properly roll back the server's state. 

• Internal Updates: Included various package updates, addressed a Dockerfile issue, and prepared for npm authentication. 

What’s New [Admin] 

User & Security Management 

• Critical User Deletion Protection: 

• Any Admin cannot delete Super Admin users. 

• Admins are notified but not prevented from deleting Admin-role users, but are prevented from deleting Super Admin role users. 

• Password Expiration: Added support for password expiration functionality during login. 

Subscription & Bundle Management 

• Bundle Visibility: Subscriptions now show a 'Pending Publishing' state for bundles, providing better visibility while the service finalises the publishing process. 

• Subscription Extension: The option to extend a user's subscription is now disabled if the subscription is already expired. 

Application Administration 

• Badge Composer Clarity: The Badge Compose page now displays badge image specification information (specs), aiding in proper image selection and upload. 

• LMS Profiles: Added support for displaying user profiles and included a specialised large JSON viewer (Monaco) in the Learning Management System (LMS) section. 

• Questionnaires: Search functionality has been improved to allow searching by keyword instead of just by name. 

Dev Notes - Fixes and Improvements [Admin] 

• User Data Export: Fixed several issues related to the download of the Users CSV file, including the file path for the CSV example download. 

• Lobbies: Fixed an issue preventing the download of the Lobbies report. 

• Internal Security: Updated the build process to use a more secure, token-based mechanism for handling internal repository access, improving security compliance. 

• Stability: Addressed various package vulnerabilities, corrected a typo in the Dockerfile.dev, and applied minor UI cleanup on the Badge Composer page. 

Backend Service Updates 

Authentication (4.7.0) 

• Security & Stability: Significantly improved the AD/Radius authentication process, resolving a bug that allowed incorrect authentication provider use. 

• Security Fix: Patched a critical bug allowing email validation bypass. 

• Performance: Upgraded to GraalVM for building, resulting in faster startup times and lower memory usage. 

• Usability: Added a default value for detail exposure in forgot password messages. 

Cloud Composer (2.3.0) 

• Network Access Control: Added support for Gateway Configuration in cloud templates, allowing users to specify whitelisted IP addresses or grant certain roles full internet access. 

• Stability: Fixed several issues related to gateway configuration updates, snapshot restoring, and the incorrect disabling of default SNAT values. 

• Error Handling: Improved logic for handling exceptions during cloud template deletion and validation errors. 

Exam Engine (3.3.0) 

• Search Improvements: Added support for full-text search on the competence endpoint. 

• Usability: Implemented case-insensitive searching for entity names. 

• Observer Page: Added additional endpoints for enhancing the Observer page functionality. 

• Cleanup: Data storage optimization by removing redundant database access and streamlining configuration.

Reports v2 (1.2.0) 

• Reporting Accuracy: Reports generated for a specific platform are now properly scoped and return data only for the requested platform. 

• Report Detail: Improved the XLSX styling and added the ability to generate a user's answers sheet. 

• Internal Quality: Added a version validator to ensure library compatibility, which improves service stability. 

Organization (2.3.0) 

• Error Clarity: Improved logging and added a specific exception to prevent users from being members of multiple organisations. 

Score v2 (1.3.0) 

• Team Management: Trainers can now create new teams and take on the role of a team officer. 

Core (2.3.0) 

• Enhanced Reliability: Added robust connection handling (Circuit Breaker) to prevent services from hanging in an unavailable state, eliminating the need for manual service restarts. 

Other Improvements 

• System Stability Fix (PID 1): Implemented a critical fix across 11 core services to ensure they properly shut down and register. This technical change resolves underlying stability issues, resulting in significantly improved overall reliability and uptime. 

• LRS (2.2.0): New endpoints added for managing (finding and deleting) individual agent profiles using their unique ID. 

• Uploader (1.2.0): Moved to GraalVM for improved performance. 

Injector Engine 

Activity Center 

• Improved Templates and Sorting: Major enhancements to how templates are defined (now supporting children/descriptions) and how entities are sorted, improving list accuracy. 

• Enhanced Stability: Multiple fixes addressing data formats, permissions, and ID access have significantly boosted service robustness. 

• Quality Assurance: Unit Tests are now integrated into the Continuous Integration (CI) process. 

Editor 

New Features 

• Full-Screen Editing: Provides an expansive, distraction-free editing environment. 

• Integrated Documentation: Direct access and editing of documentation via node definition modals and a new dedicated documentation view. 

• Layout and UI: All views are now responsive, and the layout automatically fits the content after selection. 

• Debugging Clarity: Deployment errors now clearly indicate the specific attachment and node involved. 

• Administrative: Added permissions editing and the ability to copy milestones to the clipboard. 

Fixes & Stability 

• Performance: Optimised the Monaco editor by loading the worker locally. 

• Consistency: Fixed various UI issues, including ensuring consistent plugin heights and proper application of control settings. 

• Node Integrity: Ensured attachment checks display the correct node names to prevent accidental data overwrites.