v2026.7

Notes

Security

The Santa codebase has been undergoing dedicated security review by folks with access to frontier AI security models. The issues fixed below were identified through that work, and we recommend updating. This is an ongoing investment to ensure Santa remains your most trusted endpoint security solution.

🔒 Fixed two issues related to Mach-O parsing that could prevent policy from being effectively enforced on specially crafted x86 binaries
🔒 Fixed a heap buffer overflow that could be triggered with certain EventLogType configurations when an execution contained an extremely large number of arguments
🔒 Improved tamper resistance handling to protect against local rule modification
🔒 Fixed a narrow issue with File Access rules where an exception applying to platform binaries only could be erroneously granted to unsigned x86 binaries
🔒 Fixed a narrow issue affecting CEL policies that conditionally returned ALLOWLIST_COMPILER after accessing a non-cacheable field

Full details for each issue are available in the published advisories.

Announcements

🎉 Get the most out of Santa with Workshop! Workshop is North Pole Security's official sync service, built to integrate deeply with Santa. It is fully featured, scalable, and enterprise ready. Learn more at northpole.security.

Fixed

❗ Dock icons no longer stick around when quickly closing stacked UI windows
❗ Fixed issue with file types being unexpectedly handled by Santa
❗ Workshop customers: CEL process ancestor data reliability greatly improved under load

Changed

↔️ Improved tamper resistance features protecting critical Santa components
↔️ Several small performance and memory improvements
↔️ Workshop customers: Users now receive a notification banner when temporary admin mode session ends (EPM)

Added

➕ The block dialog "open" button label can now be configured per-rule
➕ Workshop customers: Santa now supports queued commands that are delivered on the next sync, so commands issued while a host is offline still run
➕ Workshop customers: Signal matches on telemetry now include process tree and responsible process info in uploaded events
➕ Workshop customers: Signals can now be correlated across a time period, requiring a threshold before firing
➕ Workshop customers: Added new package inventory command to support scanning hosts for data about Homebrew, PyPI, Go, NPM, browser extensions, IDE extensions, and much more

---

The Santa Lite package is rarely the right choice. Install the standard package unless you have a specific reason not to. Workshop customers should not install lite since it omits many features. See the lite package documentation for details. Download at: santa-2026.7-lite.pkg.

Santa documentation can be found at northpole.dev.

What's Changed

• santactl/status: Show filter count under telemetry section by @russellhancox in #1060
• gui: Fix missing caret in TAM justification prompt by @sharvilshah in #1061
• common: improve process tree reliability under load by @mlw in #1062
• metrics: Allow metrics export to https by @russellhancox in #1063
• processtree: use PROC_PIDT_SHORTBSDINFO to look up ppid during backfill by @mlw in #1064
• gui: Delay restoring activation after last window close by @russellhancox in #1065
• common: reduce per-evaluation copies in CEL activations by @mlw in #1066
• build: split legacy grouped targets into one library per file by @mlw in #1067
• gui: notify user when temporary admin session ends by @sharvilshah in #1068
• common: take SantaCache keys by const reference by @mlw in #1071
• Fix uninitialized stat use in SNTFileInfo by @tnek in #1073
• Add ScopedMachPort and use it where task_name_for_pid is used by @russellhancox in #1074
• Fix file writer buffer growth by @tnek in #1070
• docs: Add category indexes by @russellhancox in #1076
• santactl: report SIP status in doctor output by @sharvilshah in #1069
• Protect tamper-resistant paths from clonefile by @tnek in #1075
• Protect tamper-resistant paths from copyfile by @mlw in #1077
• syncv2: report santanetd version by @sharvilshah in #1078
• cel: cache compiled DB CEL plans instead of recompiling per exec by @mlw in #1079
• santad: hold CEL fallback rules in an atomically-swapped batch by @mlw in #1081
• common: use thread-safe getpwuid_r for passwd/group lookups by @sharvilshah in #1080
• signals: Update proto import & SignalReport refs, pass persistence path to Sleigh by @russellhancox in #1083
• common: reap process tree removals from a min-heap by @mlw in #1086
• common: take a reader lock in ProcessTree::ReleaseProcess by @mlw in #1088
• common: store process-tree cdhash as raw bytes by @mlw in #1089
• status/sync: Count signal rules by @russellhancox in #1090
• gui: Lower scope of CFBundleDocumentTypes to remove IPSW association by @russellhancox in #1091
• common: reduce per-exec copies and duplicate work in the process tree by @mlw in #1087
• Replace builtin casts with proto-specific casts for protobuf types. by @ClaytonKnittel in #1084
• Reduce locks and copies on the process-tree ingest path by @mlw in #1092
• Tighten and speed up NSString string conversions by @mlw in #1093
• Bump Docusaurus to 3.10.2 and update docs dependencies by @mlw in #1094
• Reduce work on the exec-decision and file-change regex paths by @mlw in #1095
• SantaCache: strength-reduce hashing, avoid false sharing, template callables by @mlw in #1096
• TimedSyncSession: fix lock_ <-> timer-queue deadlock by @sharvilshah in #1082
• Add CLA workflow by @russellhancox in #1098
• Add HTTP Santa commands, drained serially at the end of sync by @tburgin in #1097
• docs: Update several dependencies by @russellhancox in #1100
• santad: leave Temporary Monitor Mode when client mode changes by @sharvilshah in #1099
• gui: Add event_detail_button_text support by @russellhancox in #1101
• santad: make TAM's crash/restart reconciliation safe against directory outages, account deletion, and uid reuse by @sharvilshah in #1085
• santactl: report build metadata from the embed label by @mlw in #1102
• commands: Add package inventory command by @russellhancox in #1103
• Revert "santactl: report build metadata from the embed label" by @mlw in #1105
• workflows: Skip scheduled and deploy jobs outside this repo by @mlw in #1106
• docs: Update deps, move to pnpm 11 by @russellhancox in #1107
• santasyncservice: run binary uploads from the HTTP command queue by @tburgin in #1104
• docs: Document binary_upload and package_inventory commands by @tburgin in #1108

New Contributors

• @tnek made their first (northpolesec) contribution in #1073
• @ClaytonKnittel made their first contribution in #1084

Full Changelog: 2026.6...2026.7