LoginSign Up
← Back to all sparks
M

MISP

INFRA · APIS
Velocity6.3

Open-source threat intelligence and information sharing platform

www.misp-project.org ↗

MISP 2.5.50 deletes legacy discussions, templates and allowedlists as security fixes keep coming.

security-hardeningthreat-intelligenceopen-sourcelegacy-deprecationui-migration
◆Current state
MISP is deep in a security-remediation cycle: 2.5.46, 2.5.47, 2.5.48 and now 2.5.50 each ship externally reported fixes, and 2.4.221 backported 57 of them to the EOL branch. 2.5.47 added PostgreSQL support and a first AI-assisted analysis integration. 2.5.50 moves Redis host settings to CLI-only and closes event-index and object-search information leaks. It also starts deleting legacy features outright.
◆Where it's heading
The project is shifting from adding hardening patches to shrinking its attack surface. In 2.5.50, event discussions become analyst notes, legacy templates become event templates, and signature allowedlists become warninglists, with migrations and logged failures. Combined with the Overmind UI migration and the database abstraction, this looks like a deliberate cleanup of the 2.5 codebase.
◆Prediction
Expect further legacy features to be migrated and removed in the next releases, alongside more advisories from the ongoing review. Admins with workflows on the removed discussion trigger will need to adapt.

◆Recent moves

  1. 19d ago

    MISP 2.5.50 Released - Security hardening, Overmind improvements, and streamlined workflows

    The hardening cycle continues with access-control and info-leak fixes, and Redis host settings move to CLI-only so a hijacked admin session can't redirect them. The bigger shift is removal: event discussions, legacy templates and signature allowedlists are migrated into analyst notes, event templates and warninglists, and the old code is deleted.

    View source ↗
  2. 1mo ago

    MISP 2.5.48: 20 vulnerabilities fixed, native XLSX export

    The third security release in three weeks closes 20 vulnerabilities plus 6 hardening changes. It also adds native XLSX export and tag removal from enrichment modules, and fixes sync bugs that silently dropped objects on receiving instances.

    View source ↗
  3. 1mo ago

    MISP 2.4.221: security backport for EOL branch

    The EOL 2.4 branch gets 57 security fixes from 2.5, and the project again urges users to move off it. It is a courtesy release, not new direction.

    View source ↗
  4. 1mo ago

    MISP 2.5.47: PostgreSQL support, AI analysis, 27 CVEs including authenticated RCE

    ⚡ SPARK

    The pivotal release of the cycle: a large security round lands alongside PostgreSQL support and the first AI-assisted analysis integration. Later releases build on the hardening it started.

    View source ↗
  5. 1mo ago

    MISP 2.5.46 released - security hardening, major performance gains, knowledge-base updates and Overmind moving forward

    A security review plus major performance gains and a round of Overmind UI migration work. It set the pace for the September releases.

    View source ↗
  6. 2mo ago

    MISP v2.5.45 released - Overmind Everywhere, LDAP Reworked, Security Hardened and Many Fixes

    A six-week cycle dominated by the Overmind UI migration (83 commits) and an LDAP authentication rework. It laid the groundwork for the hardening releases that followed.

    View source ↗