diff --git a/build.rs b/build.rs
index 6fd6e9e..adbec98 100644
--- a/build.rs
+++ b/build.rs
@@ -14,7 +14,7 @@ const BPFTOOL_AMD64_SHA: &str = "51ffd3dd4f46fdc46736433a971e828dc70835c6b18ad20
 const BPFTOOL_RELEASE_URL: &str = "https://github.com/libbpf/bpftool/releases/download";
 
 const LIBSCAP_REPO: &str = "https://github.com/falcosecurity/libs.git";
-const LIBSCAP_CHECKOUT_SHA: &str = "7250ae96aa8878385f85a5643a43459d3d32fca4";
+const LIBSCAP_CHECKOUT_SHA: &str = "8fc2f1fbfc90f8ce7f68e00cdfa692cc7a9983a3";
 
 fn main() {
     println!("cargo:rerun-if-env-changed=CARGO_FEATURE_FULL_BINDINGS");
diff --git a/src/consts.rs b/src/consts.rs
index ec70f0f..4113445 100644
--- a/src/consts.rs
+++ b/src/consts.rs
@@ -342,6 +342,9 @@ pub const PPM_PTRACE_IDX_MAX: u32 = 2;
 pub const PPM_BPF_IDX_FD: u32 = 0;
 pub const PPM_BPF_IDX_RES: u32 = 1;
 pub const PPM_BPF_IDX_MAX: u32 = 2;
+pub const PPM_KEYCTL_IDX_INT64: u32 = 0;
+pub const PPM_KEYCTL_IDX_CHARBUF: u32 = 1;
+pub const PPM_KEYCTL_IDX_MAX: u32 = 2;
 pub const PPM_PROT_NONE: u32 = 0;
 pub const PPM_PROT_READ: u32 = 1;
 pub const PPM_PROT_WRITE: u32 = 2;
@@ -530,6 +533,8 @@ pub const PPM_MODULE_INIT_IGNORE_VERMAGIC: u32 = 2;
 pub const PPM_MODULE_INIT_COMPRESSED_FILE: u32 = 4;
 pub const PPM_DELETE_MODULE_O_TRUNC: u32 = 1;
 pub const PPM_DELETE_MODULE_O_NONBLOCK: u32 = 2;
+pub const PPM_CLOSE_RANGE_UNSHARE: u32 = 2;
+pub const PPM_CLOSE_RANGE_CLOEXEC: u32 = 4;
 pub const PPM_BPF_MAP_CREATE: u32 = 0;
 pub const PPM_BPF_MAP_LOOKUP_ELEM: u32 = 1;
 pub const PPM_BPF_MAP_UPDATE_ELEM: u32 = 2;
@@ -603,6 +608,39 @@ pub const PPM_PR_SCHED_CORE: u32 = 62;
 pub const PPM_PR_SME_SET_VL: u32 = 63;
 pub const PPM_PR_SME_GET_VL: u32 = 64;
 pub const PPM_PR_SET_VMA: u32 = 1398164801;
+pub const PPM_KEYCTL_GET_KEYRING_ID: u32 = 0;
+pub const PPM_KEYCTL_JOIN_SESSION_KEYRING: u32 = 1;
+pub const PPM_KEYCTL_UPDATE: u32 = 2;
+pub const PPM_KEYCTL_REVOKE: u32 = 3;
+pub const PPM_KEYCTL_CHOWN: u32 = 4;
+pub const PPM_KEYCTL_SETPERM: u32 = 5;
+pub const PPM_KEYCTL_DESCRIBE: u32 = 6;
+pub const PPM_KEYCTL_CLEAR: u32 = 7;
+pub const PPM_KEYCTL_LINK: u32 = 8;
+pub const PPM_KEYCTL_UNLINK: u32 = 9;
+pub const PPM_KEYCTL_SEARCH: u32 = 10;
+pub const PPM_KEYCTL_READ: u32 = 11;
+pub const PPM_KEYCTL_INSTANTIATE: u32 = 12;
+pub const PPM_KEYCTL_NEGATE: u32 = 13;
+pub const PPM_KEYCTL_SET_REQKEY_KEYRING: u32 = 14;
+pub const PPM_KEYCTL_SET_TIMEOUT: u32 = 15;
+pub const PPM_KEYCTL_ASSUME_AUTHORITY: u32 = 16;
+pub const PPM_KEYCTL_GET_SECURITY: u32 = 17;
+pub const PPM_KEYCTL_SESSION_TO_PARENT: u32 = 18;
+pub const PPM_KEYCTL_REJECT: u32 = 19;
+pub const PPM_KEYCTL_INSTANTIATE_IOV: u32 = 20;
+pub const PPM_KEYCTL_INVALIDATE: u32 = 21;
+pub const PPM_KEYCTL_GET_PERSISTENT: u32 = 22;
+pub const PPM_KEYCTL_DH_COMPUTE: u32 = 23;
+pub const PPM_KEYCTL_PKEY_QUERY: u32 = 24;
+pub const PPM_KEYCTL_PKEY_ENCRYPT: u32 = 25;
+pub const PPM_KEYCTL_PKEY_DECRYPT: u32 = 26;
+pub const PPM_KEYCTL_PKEY_SIGN: u32 = 27;
+pub const PPM_KEYCTL_PKEY_VERIFY: u32 = 28;
+pub const PPM_KEYCTL_RESTRICT_KEYRING: u32 = 29;
+pub const PPM_KEYCTL_MOVE: u32 = 30;
+pub const PPM_KEYCTL_CAPABILITIES: u32 = 31;
+pub const PPM_KEYCTL_WATCH_KEY: u32 = 32;
 pub const PPM_CAP_CHOWN: u32 = 1;
 pub const PPM_CAP_DAC_OVERRIDE: u32 = 2;
 pub const PPM_CAP_DAC_READ_SEARCH: u32 = 4;
diff --git a/src/enums.rs b/src/enums.rs
index 72f05bb..7d29d90 100644
--- a/src/enums.rs
+++ b/src/enums.rs
@@ -435,7 +435,31 @@ pub enum ppm_event_code {
     PPME_SYSCALL_SETREUID_X = 427,
     PPME_SYSCALL_SETREGID_E = 428,
     PPME_SYSCALL_SETREGID_X = 429,
-    PPM_EVENT_MAX = 430,
+    PPME_ITER_TASK_E = 430,
+    PPME_ITER_TASK_X = 431,
+    PPME_ITER_TASK_FILE_PIPE_E = 432,
+    PPME_ITER_TASK_FILE_PIPE_X = 433,
+    PPME_ITER_TASK_FILE_MEMFD_E = 434,
+    PPME_ITER_TASK_FILE_MEMFD_X = 435,
+    PPME_ITER_TASK_FILE_REGULAR_E = 436,
+    PPME_ITER_TASK_FILE_REGULAR_X = 437,
+    PPME_ITER_TASK_FILE_DIRECTORY_E = 438,
+    PPME_ITER_TASK_FILE_DIRECTORY_X = 439,
+    PPME_ITER_TASK_FILE_SOCKET_INET_E = 440,
+    PPME_ITER_TASK_FILE_SOCKET_INET_X = 441,
+    PPME_ITER_TASK_FILE_SOCKET_INET6_E = 442,
+    PPME_ITER_TASK_FILE_SOCKET_INET6_X = 443,
+    PPME_ITER_TASK_FILE_SOCKET_UNIX_E = 444,
+    PPME_ITER_TASK_FILE_SOCKET_UNIX_X = 445,
+    PPME_ITER_TASK_FILE_SOCKET_NETLINK_E = 446,
+    PPME_ITER_TASK_FILE_SOCKET_NETLINK_X = 447,
+    PPME_ITER_TASK_FILE_ANON_INODE_E = 448,
+    PPME_ITER_TASK_FILE_ANON_INODE_X = 449,
+    PPME_SYSCALL_CLOSE_RANGE_E = 450,
+    PPME_SYSCALL_CLOSE_RANGE_X = 451,
+    PPME_SYSCALL_KEYCTL_E = 452,
+    PPME_SYSCALL_KEYCTL_X = 453,
+    PPM_EVENT_MAX = 454,
 }
 #[repr(u32)]
 #[non_exhaustive]
@@ -893,7 +917,8 @@ pub enum ppm_sc_code {
     PPM_SC_FILE_SETATTR = 450,
     PPM_SC_LISTNS = 451,
     PPM_SC_UPROBE = 452,
-    PPM_SC_MAX = 453,
+    PPM_SC_RSEQ_SLICE_YIELD = 453,
+    PPM_SC_MAX = 454,
 }
 #[repr(u32)]
 #[non_exhaustive]
@@ -964,7 +989,9 @@ pub enum ppm_param_type {
     PT_ENUMFLAGS8 = 44,
     PT_ENUMFLAGS16 = 45,
     PT_ENUMFLAGS32 = 46,
-    PT_MAX = 47,
+    PT_FD32 = 47,
+    PT_PID32 = 48,
+    PT_MAX = 49,
 }
 #[repr(i32)]
 #[non_exhaustive]