The latest release of this open source threat intelligence platform focuses heavily on performance, robustness and safer handling of data at scale. Internally, JSON processing pipelines have been reworked to rely on more efficient encoding paths whenever the simdjson extension is available, including new streaming options for events and large arrays. Compressed requests get smarter handling, with improvements to how different compression formats such as zstd are processed, reducing overhead when moving large volumes of threat data. These changes are meant to make instances feel more responsive under load and more resilient when dealing with complex workflows and big feeds.

‍
On the functional side, the release updates the JSON schema to match the latest 2.5 feature set and introduces a new workflow module for creating cases in FlowIntel, along with a reorganized attribute fetcher pipeline. Together, these enhancements give operators more structured ways to automate case management and refine how attributes are collected and filtered as they move through the system. Several security fixes are also bundled into this version, continuing the pattern of tightening validation logic and hardening the platform against edge cases that could lead to instability or misuse. For users running production instances, the upgrade offers a mix of new capabilities and behind-the-scenes tuning aimed at smoother, safer day-to-day operations.

‍

Source: https://www.misp-project.org/2025/11/27/misp.2.5.27.released.html/