Sophos Linux Sensor

These are the release notes for Sophos Linux Sensor. You can download the sensor in Sophos Central.

The features mentioned in these release notes are only available if you have the appropriate license and run a supported distribution and kernel. See Sophos Linux Sensor distribution and kernel support.

You may find that you can't yet download and use the latest version. This is because Sophos releases the software over a number of days, but publishes the release notes on the first day.

View the product documentation at Sophos Linux Sensor.

View the runtime detection content updates at Sophos Linux Runtime Detection updates.

Version 5.17.3 New

New features

Expanded attack coverage

Azure Linux with OS Guard: This functionality streamlines deployments for Azure Linux in environments such as Azure Kubernetes Service (AKS).

Data lake hydration updates

Data processing updates: Batching updates to increase alert fidelity.
account_activity_linux updates: These updates include account creation, deletion, and modifications to group membership.

Performance and resiliency updates

Extended kernel support: Added support for kernel 6.19 and 7.0.
Performance and CPU improvements: Improved event processing for endpoints with heavy container activity.
Helm charts Updates to specify nodeSelector and tolerations.

Updated components

Sophos Linux Runtime Detection Plugin has been updated to 5.17.3.

Container tag reference

Sophos Linux Sensor

Tag 5.17.3.107
Digest: sha256:64a4ff4832ea77f15896fc6f4c6fccd3df25d56cf319b2d0b8fc04dfabb78671

Content

Tag 5.17.3.1
Digest: sha256:3843d390afd3a8de94b6a30791f01e44d055eb19a1453497369b6038e3d289e5

Helm

Tag 1.0.8
Digest: sha256:b3612cf4ce9b0f5d186db1547fe325bb3ac78845ba36cb4828f61dbf301651f2

Components

Components and their version numbers by release. The second column contains the latest release.
Release date	Sophos Linux Sensor	SPL-Runtime-Detection-Plugin	Sensor container tags	Content container tags	Helm versions
June 2026	5.17	5.17.3.107	Tag: 5.17.3.107 Digest: sha256:64a4ff4832ea77f15896fc6f4c6fccd3df25d56cf319b2d0b8fc04dfabb78671	Tag: 5.17.3.1 Digest: sha256:3843d390afd3a8de94b6a30791f01e44d055eb19a1453497369b6038e3d289e5	Version: 1.0.8 Digest: sha256:b3612cf4ce9b0f5d186db1547fe325bb3ac78845ba36cb4828f61dbf301651f2
May 2026	5.17	5.17.3.107	Tag: 5.17.3.107 Digest: sha256:64a4ff4832ea77f15896fc6f4c6fccd3df25d56cf319b2d0b8fc04dfabb78671	Tag: 5.17.3.1 Digest: sha256:3843d390afd3a8de94b6a30791f01e44d055eb19a1453497369b6038e3d289e5	Version: 1.0.7 Digest: sha256:1fdb47cba8d71384e4835ef33a1185c01f5ac3969a34e7b7cca4db17e92901eb
March 2026	5.16	5.16.3.76	Tag: 5.16.3.76 Digest: sha256:d7eee8eca7f3cdc7d959cc2c3483590a0e07a7939b8ac63ca40fcd41bbc80883	Tag: 5.16.0.211 Digest: sha256:ec1a27ba817fa4eb2ecb8f0ba1254301bf5553cf1ac48fcccc6b4b7ff34c35e9	Version: 1.0.6 Digest: sha256:7c28839c10947ad37d04ed01021aff9c9ff21c4b7d9f3be28ae6d3ca266e6d4f
January 2026	5.15	5.15.1.120	Tag: 5.15.1.120 Digest: sha256:7dd06fd2f49e185edfe7b82ad0169f3f375c7b3a8d06e65889ef735b1a315791	Tag: 5.16.0.211 Digest: sha256:ec1a27ba817fa4eb2ecb8f0ba1254301bf5553cf1ac48fcccc6b4b7ff34c35e9	Version: 1.0.5 Digest: sha256:c32db2bf80c78d153b0223632a1a6700ed150d9c9f9a42054f8a6b163729f4fb
November 2025	5.15	5.15.1.120	Tag: 5.15.1.120 Digest: sha256:7dd06fd2f49e185edfe7b82ad0169f3f375c7b3a8d06e65889ef735b1a315791	Tag: 5.14.1.1 Digest: sha256:0546613e5b93e2fd7f609441e5d51e64e6b611d591d99ab9e56760dd4a40bf17	Version: 1.0.4 Digest: sha256:bfebc42adaa00ba20efe2fd04ca8386ca5e94de742fb5174042a8f71009fc4d8
October 2025	5.14	5.14.0.1519	Tag: 5.14.0.1519 Digest: sha256:d0603c5bf648bcd2455e8a1584fc5c26e5f194e59bc290a01a68fabac94b2b17	Tag: 5.14.1.1 Digest: sha256:0546613e5b93e2fd7f609441e5d51e64e6b611d591d99ab9e56760dd4a40bf17	Version: 1.0.3 Digest: sha256:fa39a0e91cee9353937504c2e3f45483fbae9455678bad9e01130215c844f39e
July 2025	5.12.0.1380	5.12.0	Tag: 5.12.0.1380 Digest: sha256:d6bd3a5f53d22e0f92b27f2d96d1f28ae349a59cb09025f8f80b057f675c0a37	Tag: 5.11.0.304 Digest: sha256:2e0cf4480a30eb99fd658dd6c1d77f2072678a2ac01210691c39d19569ad9409	Version: 1.0.2 Digest: sha256:92b18e3ede309e4d5d5781a16b66d3e317e41b77db5c2ea353fa3d357840f6f9
April 2025	5.11.1.17	5.11.1	Tag: 5.11.1.17 Digest: sha256:88a20bd3c4ad492714c4005cfd9e7f55056414f37cb1c7882aee38630e9a3763	Tag: 5.10.0.472 Digest: sha256:0e0d25c93af90705260f6843e35711f1b20e5838bccd97b0ef071b7c9ef0c98b	Version: 1.0.0 Digest: sha256:7ff2609d0e4966673056dbd9ccb09fc67ef7e59f72cb0576ca7cb757f66e4e9d
April 2025	5.11.0.679	5.11.0	Tag: 5.11.0.679 Digest: sha256:113f9c62d82babfefee58d925f3fd3466af1185c248b6af94b32e1fb401e04d1	Tag: 5.10.0.472 Digest: sha256:0e0d25c93af90705260f6843e35711f1b20e5838bccd97b0ef071b7c9ef0c98b
March 2025	5.10.0.1164	5.10.0	Tag: 5.10.0.1164 Digest: sha256:ed51758c305df299f0764542703527bff8a9de49d525e9d90bfc88ba44629fa7	Tag: 5.10.0.472 Digest: sha256:0e0d25c93af90705260f6843e35711f1b20e5838bccd97b0ef071b7c9ef0c98b
November 2024	5.9.3	5.9.3.1787	Tag: 5.9.3.1787 Digest: sha256:cc2da005a299ef770f8de9d7b6f4108cfb4cd3aa15c8684120b86ce78ff18db0	Tag: 5.9.0.2300 Digest: sha256:cf7a3252a234b9c9fb065f230ce951a58277b2147d89740ed8ee64636c874065
June 2024	5.9.1	5.9.1	Tag: 5.9.2.184 Digest: sha256:fe7803aa75d365bcebc395f45db6dfd095d71e84605fee8599c0641467142fd3	Tag: 5.8.0.4 Digest: sha256:65575a79b901fd19c6c9ba91299dc0f2c8d6406e2ec371e7aa1347eec5a49077
April 2024	5.8.1	5.8.1	Tag: 5.8.1.10 Digest: sha256:0d967be9578aacfc9f005ddb6ef12c7d84b61aa25d7161571b3787f3ff399d95	Tag: 5.8.0.4 Digest: sha256:65575a79b901fd19c6c9ba91299dc0f2c8d6406e2ec371e7aa1347eec5a49077
February 2024	5.8.0	5.8.0	Tag: 5.8.0.942 Digest: sha256:d97dd4f97f54ab7f252b5a36ff2185f7ca9686e5718d7e2615335d061e571a61	Tag: 5.6.2.24 Digest: sha256:a6b9251abf6ba96a82d62fee85ec8d6d97481c1fd482e57c3af7dcccda9b435a
November 2023	5.7.0	5.7.0	Tag: 5.7.0.581 Digest: sha256:f2d83dc336c37d9b8de3062a406d6781ca5cfecc380c2c09e5523ee735941427	Tag: 5.6.1.2 Digest: sha256:fbc755290ccf10f61e5c7b806ca5d0aff60a5a92a35f04b8dba897b7616dd664
September 2023	5.6.0	5.6.0	Tag: 5.6.1.6 Digest: sha256:9206ec390404d882e3f2d3b2784029e4dae06e8e555e4138822cad558b40980b	Tag: 5.5.3.16 Digest: sha256:0e7e503c045760cb80895abd4add849e190860f2662c332e08ce636d02b8cc52
August 2023	5.5.2	5.5.2	Tag: 5.5.2.30 Digest: sha256:af1600aa53c6a1545a345c98c3674d8824396821a9e274c73df6322bbd9dc63f	Tag: 5.4.2.51 Digest: sha256:146160d14cdab038bd5644190afffb3c47137b28d376f10d4c385bf7c87ac9d8
June 2023	5.5.1	5.3.0	Tag: 5.5.1.198 Digest: sha256:3e520f7afa185099125eb11d567e518d68512f1a7780b402f9487e411f00e192	Tag: 5.4.2.51 Digest: sha256:146160d14cdab038bd5644190afffb3c47137b28d376f10d4c385bf7c87ac9d8
February 2023	5.4.0	5.4.0
October 2022	5.1.1	5.1.1
September 2022	5.1.0	5.1.0
July 2022	5.0.2	5.0.2
June 2022	5.0.0	5.0.0

Version 5.16.3

New features

Expanded attack coverage

EKS auto mode support: This functionality streamlines and simplifies Kubernetes operations within container deployments.

Performance and resiliency

Extended kernel support: Added support for kernel 6.18.

Updated components

Sophos Linux Runtime Detection Plugin has been updated to 5.16.3.

Container tag reference

Sophos Linux Sensor

Tag 5.16.3.76
Digest: sha256:d7eee8eca7f3cdc7d959cc2c3483590a0e07a7939b8ac63ca40fcd41bbc80883

Content

Tag 5.16.0.211
Digest: sha256:ec1a27ba817fa4eb2ecb8f0ba1254301bf5553cf1ac48fcccc6b4b7ff34c35e9

Helm

Tag 1.0.6
Digest: sha256:7c28839c10947ad37d04ed01021aff9c9ff21c4b7d9f3be28ae6d3ca266e6d4f

Version 5.15.1

New features

Helm chart 1.0.5

Content version 5.16

Updated components

Sophos Linux Runtime Detection Plugin has been updated to 5.15.1.

Container tag reference

Sophos Linux Sensor

Tag 5.15.1.120
Digest: sha256:7dd06fd2f49e185edfe7b82ad0169f3f375c7b3a8d06e65889ef735b1a315791

Content

Tag 5.16.0.211
Digest: sha256:ec1a27ba817fa4eb2ecb8f0ba1254301bf5553cf1ac48fcccc6b4b7ff34c35e9

Helm

Tag 1.0.5
Digest: sha256:c32db2bf80c78d153b0223632a1a6700ed150d9c9f9a42054f8a6b163729f4fb

Version 5.15.1 New

New features

Helm chart 1.0.4

Helm chart 1.0.4 allows for the configuration of any supported setting using environment variables and the configuration of alert and event outputs. See Environment variables and Alert and event outputs.

Updated components

Sophos Linux Runtime Detection Plugin has been updated to 5.15.1.

Container tag reference

Sophos Linux Sensor

Tag 5.15.1.120
Digest: sha256:7dd06fd2f49e185edfe7b82ad0169f3f375c7b3a8d06e65889ef735b1a315791

Helm

Tag 1.0.4
Digest: sha256:bfebc42adaa00ba20efe2fd04ca8386ca5e94de742fb5174042a8f71009fc4d8

Version 5.14.0

New features

Data Lake hydration updates

Added the following updates for customers deploying Sophos Linux Sensor integrated with Sophos Central.

Data processing updates: Batching, filtering, and aggregation updates to increase performance.
Throughput updates: Improved event processing to handle higher volumes of data on active endpoints.

Performance and Resiliency

Extended kernel support.

Added support for kernel 6.16.

Updated components

Sophos Linux Runtime Detection Plugin has been updated to 5.14.0.

Container tag reference

Sophos Linux Sensor

Tag 5.14.0.1519
Digest: sha256:d0603c5bf648bcd2455e8a1584fc5c26e5f194e59bc290a01a68fabac94b2b17

Sophos Linux Content

Tag 5.14.1.1
Digest: sha256:0546613e5b93e2fd7f609441e5d51e64e6b611d591d99ab9e56760dd4a40bf17

Helm

Version 1.0.3
Digest: sha256:fa39a0e91cee9353937504c2e3f45483fbae9455678bad9e01130215c844f39e

Resolved issues

There are no resolved issues in this release.

Version 5.12.0

New features

Various software updates and improvements.

Updated components

Sophos Linux Runtime Detection Plugin has been updated to 5.12.0.

Container tag reference

Sophos Linux Sensor

Tag 5.12.0.1380
Digest: sha256:d6bd3a5f53d22e0f92b27f2d96d1f28ae349a59cb09025f8f80b057f675c0a37

Sophos Linux Content

Tag 5.11.0.304
Digest: sha256:2e0cf4480a30eb99fd658dd6c1d77f2072678a2ac01210691c39d19569ad9409

Helm

Version 1.0.2
Digest: sha256:92b18e3ede309e4d5d5781a16b66d3e317e41b77db5c2ea353fa3d357840f6f9

Resolved issues

There are no resolved issues in this release.

Version 5.11.1

New features

Expanded process termination options:

Process termination updates to support parent process termination, including parent and lineage.

Updated components

Sophos Linux Runtime Detection Plugin has been updated to 5.11.1.

Container tag reference

Sophos Linux Sensor

Tag 5.11.1.17
Digest: sha256:88a20bd3c4ad492714c4005cfd9e7f55056414f37cb1c7882aee38630e9a3763

Sophos Linux Content

Tag 5.10.0.472
Digest: sha256:0e0d25c93af90705260f6843e35711f1b20e5838bccd97b0ef071b7c9ef0c98b

Helm

Version 1.0.0
Digest: sha256:7ff2609d0e4966673056dbd9ccb09fc67ef7e59f72cb0576ca7cb757f66e4e9d

Resolved issues

Resolved an issue affecting exporting events to AWS S3.

Version 5.11.0

New features

Various software updates and improvements.

Updated components

Sophos Linux Runtime Detection Plugin has been updated to 5.11.0

Container tag reference

Sophos Linux Sensor

Tag 5.11.0.679
Digest: sha256:113f9c62d82babfefee58d925f3fd3466af1185c248b6af94b32e1fb401e04d1

Sophos Linux Content

Tag 5.10.0.472
Digest: sha256:0e0d25c93af90705260f6843e35711f1b20e5838bccd97b0ef071b7c9ef0c98b

Version 5.10.0

New features

Investigation table updates:

The new audit_selinux table includes SELinux events on the host.

Content resiliency improvements:

Resiliency improvements for the Runtime Detection plugin to limit downtime.

Updated components

Sophos Linux Runtime Detection Plugin has been updated to 5.10.0

Container tag reference

Sophos Linux Sensor

Tag 5.10.0.1164
Digest: sha256:ed51758c305df299f0764542703527bff8a9de49d525e9d90bfc88ba44629fa7

Sophos Linux Content

Tag 5.10.0.472
Digest: sha256:0e0d25c93af90705260f6843e35711f1b20e5838bccd97b0ef071b7c9ef0c98b

Version 5.9.3

New features

Investigation table updates:

The new Audit_user_msg table includes user event activity on the host and events running in a container.

Tuning updates:

Added configurable optional_metadata_gathering_timeout value to help when encountering slow start-up times for the sensor.

Updated components

Sophos Linux Runtime Detection Plugin has been updated to 5.9.3.1846.

Container tag reference

Sophos Linux Sensor

Tag 5.9.3.1846
Digest: sha256:82c75b6d1b2377755998737a6db5d5ebbb48658d8bac2d043998997e9fbe1c57

Sophos Linux Content

Tag 5.9.0.2300
Digest: sha256:cf7a3252a234b9c9fb065f230ce951a58277b2147d89740ed8ee64636c874065

Version 5.9.2.211

New features

Process termination updates: You can now configure a response action to kill the child processes of a process associated with a runtime detection.

Updated components

Sophos Linux Runtime Detection Plugin has been updated to 5.9.2.211.

Container tag reference

Sophos Linux Sensor

Tag 5.9.2.211
Digest: sha256:59bd6890ccd06f5f3e965996676ce436b6c1a4d2d1050abbfe3c22ad3012927c

Sophos Linux Content

Tag 5.8.0.4
Digest: sha256:65575a79b901fd19c6c9ba91299dc0f2c8d6406e2ec371e7aa1347eec5a49077

Version 5.8.1.10

New features

Various software updates and improvements.
Added Linux 6.1 kernel support.

Updated components

Sophos Linux Runtime Detection Plugin has been updated to 5.8.1.10.

Container tag reference

Sophos Linux Sensor

Tag 5.8.1.10
Digest: sha256:0d967be9578aacfc9f005ddb6ef12c7d84b61aa25d7161571b3787f3ff399d95

Sophos Linux Content

Tag 5.8.0.4
Digest: sha256:65575a79b901fd19c6c9ba91299dc0f2c8d6406e2ec371e7aa1347eec5a49077

Version 5.8.0.942

New features

Container Packaging Updates:

Sensor and Content container images are updated to only include required applications and runtime dependencies.
The same methods are used to configure and deploy sensor and container images.

Updated components

Sophos Linux Runtime Detection Plugin has been updated to 5.8.0.942.

Container tag reference

Sophos Linux Sensor

Tag 5.8.0.942
Digest: sha256:d97dd4f97f54ab7f252b5a36ff2185f7ca9686e5718d7e2615335d061e571a61

Sophos Linux Content

Tag 5.6.2.24
Digest: sha256:a6b9251abf6ba96a82d62fee85ec8d6d97481c1fd482e57c3af7dcccda9b435a

Version 5.7.0

New features

Various software updates and improvements.

Updated components

Sophos Linux Runtime Detection Plugin has been updated to 5.7.0.581.

Container tag reference

sophos-linux-sensor:

Tag: 5.7.0.581
Digest: sha256:f2d83dc336c37d9b8de3062a406d6781ca5cfecc380c2c09e5523ee735941427

sophos-linux-content:

Tag: 5.6.1.2
Digest: sha256:fbc755290ccf10f61e5c7b806ca5d0aff60a5a92a35f04b8dba897b7616dd664

Version 5.6.0

New features

Various software updates and improvements.

Updated components

Sophos Linux Runtime Detection Plugin has been updated to 5.6.0.

Container tag reference

sophos-linux-sensor:

Tag: 5.6.1.6
Digest: sha256:9206ec390404d882e3f2d3b2784029e4dae06e8e555e4138822cad558b40980b

sophos-linux-content:

Tag: 5.5.3.16
Digest: sha256:0e7e503c045760cb80895abd4add849e190860f2662c332e08ce636d02b8cc52

Version 5.5.2

New features

Detection integration with Sophos Central: Sophos Linux Sensor provides integration with Sophos Central for the consumption of detections. The capability leverages the existing alert output configuration to allow a sensor to send detections to multiple destinations. With this addition, you can add Sophos Central as a destination, while still sending detections to other destinations. The detections are accessible in the Threat Analysis Center as Detections and via Data Lake queries in Live Discover.

Updated components

Sophos Linux Runtime Detection Plugin has been updated to 5.5.2

Container tag reference

sophos-linux-sensor:

Tag: 5.5.2.30
Digest: sha256:af1600aa53c6a1545a345c98c3674d8824396821a9e274c73df6322bbd9dc63f

sophos-linux-content:

Tag: 5.4.2.51
Digest: sha256:146160d14cdab038bd5644190afffb3c47137b28d376f10d4c385bf7c87ac9d8

Version 5.5.1

New features

Updates for Cloud-Native Deployment Options: Provide updates for the Sensor to allow users to deploy as a Container image.

Updated components

Sophos Linux Runtime Detection Plugin has been updated to 5.5.1

Container tag reference

sophos-linux-sensor:

Tag: 5.5.1.198
Digest: sha256:3e520f7afa185099125eb11d567e518d68512f1a7780b402f9487e411f00e192

sophos-linux-content:

Tag: 5.4.2.51
Digest: sha256:146160d14cdab038bd5644190afffb3c47137b28d376f10d4c385bf7c87ac9d8

Version 5.4.0

Improvements

Various software updates and improvements.

Updated components

SPL-Runtime-Detection-Plugin: 5.4.0

Version 5.1.1

Improvements

Optimizations for resource usage.

Optimizations for memory usage.

Improvements to the management of memory and list reference counting.

Optimizations to event state and task list handling when completing tasks.

Reliability updates for gRPC.

Updated components

SPL-Runtime-Detection-Plugin updated to version 5.1.1.

Resolved issues

Resolved intermittent segmentation fault issues.

Resolved an issue where process event filters prevented Sophos Linux Sensor from starting.

Version 5.1.0

New features

Various software updates and improvements.

Updated components

Sophos Linux Runtime Detection plugin is now called SPL-Runtime-Detection-Plugin.

SPL-Runtime-Detection-Plugin version 5.1.0.

Version 5.0.2

New features

Sophos Linux Sensor supports ARM64.

Components

Sophos Linux Runtime Detection Plugin version 5.0.2.

Version 5.0.0

New features

Sophos Linux Sensor includes Sophos Linux Runtime Detection. You can download the sensor, in Sophos Central, as RPM Package Manager (RPM) and Debian (DEB) packages.

Components

Sophos Linux Runtime Detection Plugin version 5.0.0.

Known issues

Host kernel panic with Linux kernel versions 5.10.133 - 5.10.142

Linux kernel versions 5.10.133 - 5.10.142 have an issue with ftrace that may cause the host system kernel to become unresponsive. This is a known issue with these kernel versions that affects our endpoint software because it utilizes ftrace functionality for various capabilities. When you install SLS on the affected kernel versions, RTD enters dormant mode. Additionally, other applications on the host that depend on ftrace functionality may be affected.

For known issues, see Sophos Linux Known Issues list.

System requirements

Free disk space: 2 GB
Memory: 2 GB
System type: x86_64 and ARM64

Note

We test the latest point release for platforms listed here.

Supported platforms

Tested platforms

Minimum kernel versions for x86_64 systems are noted where applicable.

Amazon Linux 2
Amazon Linux 2023
CentOS Stream
Debian 11
Debian 12
Debian 13
Oracle 8
Oracle 9
Oracle 10
RHEL 8
RHEL 9
RHEL 10
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server 16
Ubuntu 22.04 (LTS)
Ubuntu 24.04 (LTS)
Ubuntu 26.04

Legacy platforms

The following legacy platforms include versions of platforms that have recently reached their end of mainstream support as published by the distribution vendor. For additional details on extended support for legacy versions, see Sophos Central: Extended support. For additional details on support for legacy versions, see Legacy versions.

Minimum kernel versions for x86_64 systems are noted where applicable.

CentOS 7 (3.10.0-1062 or later)
Debian 10
Oracle 7 (UEK 4.14 or later, RHCK 3.10.0-1062 or later)
RHEL 7 (3.10.0-1062 or later)
SUSE Linux Enterprise Server 12
Ubuntu 18.04 (LTS) (4.15 or later)
Ubuntu 20.04 (LTS)

Unlisted platforms

Sophos will investigate any issues by attempting to replicate them on a corresponding testing distribution. For more information related to platforms and versions not listed here, including platforms that have reached their end of mainstream support as published by the distribution vendor, such as downstream and upstream distributions and legacy platforms, see Sophos Protection for Linux distribution and kernel support.

To gather more information on installation errors, see the following pages:

Support

You can find technical support for Sophos products in any of these ways:

Visit Sophos Community at Sophos community and search for other users who are experiencing the same problem.
Visit Sophos support at Sophos support.
Find how-to, configuration and troubleshooting videos at Sophos Techvids video hub.

Legal notices

Copyright © 2023 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.

Sophos and Sophos Anti-Virus are registered trademarks of Sophos Limited and Sophos Group. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.