Discovering the latest attacks and providing defensive measures to keep organizations safe
Shai-Hulud: The novel self-replicating worm infecting hundreds of NPM packages
On September 15, 2025, an engineer discovered a supply chain attack against the NPM repository. Unlike previous NPM attacks, this campaign used novel, self-propagating malware (also known as a worm) to continue spreading itself.
tj-actions/changed-files with Falco Actions
A compromise (CVE-2025-30066) was discovered in the popular GitHub Action tj-actions/changed-files on March 14, 2025. It impacted tens of thousands of repositories that use this action to track file changes. This blog will explain how Falco Actions can easily be integrated into your workflows to help detect this CI/CD attack and provide in-depth visibility.
Detecting and Mitigating IngressNightmare – CVE-2025-1974
On Monday, March 24, 2025, a set of critical vulnerabilities affecting the admission controller component of the Ingress NGINX Controller for Kubernetes was announced. In total, five vulnerabilities were announced; the most severe vulnerability, CVE-2025-1974 (CVS 9.8), may result in remote code execution (RCE). Exploitation of this vulnerability can be detected with Sysdig Secure or the Falco rule provided in this article.
Node2Shell (CVE-2026-111497): Detecting the Node.js Brotli RCE
Detecting and mitigating ZDI-CAN-33367 and five other Linux flaws
PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Detecting unauthenticated remote code execution in PHP core
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets an unauthenticated attacker run code on a PHP server with HTTP requests alone. The Sysdig Threat Research Team analyzed the exploitation and outlines affected versions, mitigations, and how to detect post-exploitation activity at runtime with Sysdig Secure and open source Falco.
Security briefing: September 2026
It may be October as you read this, but I bet many organizations got the creeps in September as environments were continuously breached. There were scams, old-fashioned human actors, a few agents making mistakes, and some persistent actors taking full advantage of a new vulnerability.
AI agent exploits Zammad zero-days in DIVD breach: What we know and how to detect it
AI adoption is a security survival metric
AI is moving from experiment to infrastructure. Sysdig research shows more organizations building their own infrastructure, reducing the AI attack surface.
Risky identities continue to plague cloud infrastructures
Our research finds cloud-native IAM remains one of the most persistently misconfigured and poorly governed areas of security. Here’s what you can do.
Machine speed, hold the AI: Hand-rolled marimo CVE-2026-39987 exploit
Sysdig TRT details a hand-rolled attack against marimo's CVE-2026-39987 without AI, building custom Python tools to breach a cloud bastion host.
Defaulting on tech debt: When the bill comes due, AI is the collector
Security briefing: July 2026
The Cloud Defense Report 2025
Discover key insights and trends in real-world cloud security and usage — and see how enterprises are advancing their defenses.
Rules feed
Name
Severity
Framework 1
Framework 2
Link
Long name for up to ten words “vulnerability management” test
Critical
Example text that can
Example text
Led by the industry’s most elite threat researchers
Meet with us / upcoming events
Browse all resources
2026 Cloud-Native Security and Usage Report
2025 Cloud-Native Security and Usage Report
2024 Cloud-Native Security and Usage Report
About the team
The Sysdig Threat Research Team (TRT) are highly skilled security experts dispersed across the globe, with experience in governmental, commercial, and academic arenas. Their expertise includes offensive and defensive security operations, computer network operations, malware analysis, and beyond.
The team is well-known for introducing the 10-minute timeframe for cloud attacks, setting the 555 Benchmark for Cloud Threat Detection and Response, and uncovering novel threats like SCARLETEEL.