Discovering the latest attacks and providing defensive measures to keep organizations safe
Shai-Hulud: The novel self-replicating worm infecting hundreds of NPM packages
On September 15, 2025, an engineer discovered a supply chain attack against the NPM repository. Unlike previous NPM attacks, this campaign used novel, self-propagating malware (also known as a worm) to continue spreading itself.
tj-actions/changed-files with Falco Actions
A compromise (CVE-2025-30066) was discovered in the popular GitHub Action tj-actions/changed-files on March 14, 2025. It impacted tens of thousands of repositories that use this action to track file changes. This blog will explain how Falco Actions can easily be integrated into your workflows to help detect this CI/CD attack and provide in-depth visibility.
Detecting and Mitigating IngressNightmare – CVE-2025-1974
On Monday, March 24, 2025, a set of critical vulnerabilities affecting the admission controller component of the Ingress NGINX Controller for Kubernetes was announced. In total, five vulnerabilities were announced; the most severe vulnerability, CVE-2025-1974 (CVS 9.8), may result in remote code execution (RCE). Exploitation of this vulnerability can be detected with Sysdig Secure or the Falco rule provided in this article.
Security briefing: May 2026
AI agent at the wheel: How an attacker used LLMs to move from a CVE to an internal database in 4 pivots
The expendable extension name: Azure VMAccess naming chaos, password resets, and a detection gap
In early April, the Sysdig Threat Research Team (TRT) identified a detection flaw in the process for Azure VM password resets and VMAccess naming. This flaw allows attackers to assign any name to Azure VM extensions, giving them the ability to obtain read/write access, change passwords, and persist in the victim environment without being detected. Additionally, the Sysdig TRT found that the telemetry documented by the Azure Threat Matrix for this detection did not fire when the event was triggered.
NATS-as-C2: Inside a new technique attackers are using to harvest cloud credentials and AI API keys
Sysdig Threat Research Team (TRT) has identified what appears to be the first published case of a threat actor using a NATS server as command-and-control (C2) infrastructure — a technique dubbed “NATS-as-C2.” Discovered during an investigation into exploitation of CVE-2026-33017 in Langflow, the operation used cloud-native messaging infrastructure, including pub/sub orchestration and durable task queues, to coordinate a distributed credential-hunting worker pool targeting AWS and AI credentials.
CVE-2026-44338: PraisonAI authentication bypass in under 4 hours and the growing trend of rapid exploitation
.png)
Dirty Frag (CVE-2026-43284 and CVE-2026-43500): Detecting unpatched local privilege escalation via Linux Kernel ESP and RxRPC
CVE-2026-31431: “Copy Fail” Linux kernel flaw lets local users gain root in seconds
CVE-2026-42208: Targeted SQL injection against LiteLLM's authentication path discovered 36 hours following vulnerability disclosure
.png)
CVE-2026-39987 update: How attackers weaponized marimo to deploy a blockchain botnet via HuggingFace
Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 Hours
On April 8, 2026, a critical vulnerability was disclosed in marimo, an open-source reactive Python notebook platform. Currently being tracked as GHSA-2679-6mx9-h9xc, it is a pre-authentication remote code execution (RCE) vulnerability in the terminal WebSocket endpoint that allows attackers to obtain a full interactive shell on any exposed marimo instance through a single WebSocket connection – no credentials required. At the time of this writing, a CVE number has yet to be assigned.
The Cloud Defense Report 2025
Discover key insights and trends in real-world cloud security and usage — and see how enterprises are advancing their defenses.
Rules feed
Name
Severity
Framework 1
Framework 2
Link
Long name for up to ten words “vulnerability management” test
Critical
Example text that can
Example text
Led by the industry’s most elite threat researchers
Meet with us / upcoming events
Browse all resources
2026 Cloud-Native Security and Usage Report
2025 Cloud-Native Security and Usage Report
2024 Cloud-Native Security and Usage Report
About the team
The Sysdig Threat Research Team (TRT) are highly skilled security experts dispersed across the globe, with experience in governmental, commercial, and academic arenas. Their expertise includes offensive and defensive security operations, computer network operations, malware analysis, and beyond.
The team is well-known for introducing the 10-minute timeframe for cloud attacks, setting the 555 Benchmark for Cloud Threat Detection and Response, and uncovering novel threats like SCARLETEEL.