May 2026 Summaries

The text discusses the persistence techniques attackers use to maintain unauthorized access to Entra ID after initial token-based entry methods, such as phishing, which allows them to bypass token expiration, password resets, and MFA re-enrollment. These methods include illicit consent grants, rogue device registration, FIDO2 security key registration, guest user invitation, and federation trust backdoors. Each technique exploits weaknesses in standard security protocols and configurations, enabling attackers to sustain access without being detected. The text highlights the importance of real-time configuration monitoring over traditional log-based detection, as the latter often fails to identify persistence once established. It suggests using tools like Stream.Security's CloudTwin™ to build a real-time model of the cloud environment's state, providing a more comprehensive approach to detecting and addressing potential security breaches.

Stream platform has introduced a new API log collection capability, enhancing security teams' ability to monitor application-layer activity across cloud and hybrid environments. This feature addresses the increasing vulnerability of the API layer, which is often under-monitored, by providing comprehensive visibility from load balancers to kernel sockets, especially for AI workloads. The platform offers two methods for collecting API telemetry: kernel-level interception via the Stream eBPF sensor and direct log ingestion from cloud providers like AWS, GCP, and Azure. Both methods integrate into the CloudTwin model, enriching events with identity context and resource relationships. This allows for detailed payload visibility, enabling security teams to understand data exchanges, system instructions, and responses within AI workloads, enhancing threat detection capabilities. Stream's detection engine operates over every collected event, applying signature-based rules, anomaly detection, and IOC matching to identify potential threats. The platform ensures consistent API visibility across various infrastructures, supporting Kubernetes, VMs, and hybrid environments, while leveraging the CloudTwin model for a unified detection surface. This addition gives security teams a strategic advantage by transforming their intimate knowledge of their environment into a robust defense mechanism against cloud-based threats.

Shai-Hulud, a sophisticated malware campaign, has evolved through multiple waves, targeting npm and PyPI packages with increasing complexity and reach, affecting millions of downloads. The campaign employs various techniques, such as preinstall and postinstall hooks, Git dependency prepare scripts, and OIDC token exploitation, to steal credentials and infiltrate systems, notably using a newly introduced prepare script trick to silently execute malicious payloads. In May 2026, the threat significantly escalated when TeamPCP published the full Shai-Hulud source code on GitHub, making it accessible to a broader audience and enabling potential copycat attacks. This development has shifted the threat model from a single actor to a framework that can be customized and deployed by anyone with basic coding skills. Traditional detection methods focusing on specific malware signatures are becoming less effective due to the variability in payloads and execution methods, prompting a need for behavioral detection strategies that identify abnormal usage patterns of stolen credentials. These advanced detection techniques, which monitor deviations from established behavioral baselines, offer a future-proof solution against evolving threats by focusing on the misuse of credentials rather than the specific malware used to obtain them.

Stream.Security has introduced Workload Response Actions to enhance its response capabilities by enabling real-time threat containment in workloads directly from the investigation workflow, using the same agents responsible for detection. This addition bridges the gap between threat detection and response, which traditionally involved delays due to manual processes like triaging alerts and filing tickets. Analysts can now execute immediate actions on workloads across various platforms such as Kubernetes, Amazon ECS, or bare-metal infrastructure without additional tools or context switching. The actions include process control, network containment, container operations, and filesystem quarantine, all executed by lightweight eBPF-based agents with rigorous safety measures to prevent self-harm and ensure system integrity. These responses are automated, secure, and leave a comprehensive audit trail, reducing the mean time to containment from minutes to seconds in cloud-native environments. The system is designed to be simple, resilient, and requires no infrastructure changes, with AI-driven orchestration further enhancing decision-making for minimal disruption during containment or remediation actions. Current customers can enable these response capabilities with an update to their runtime agent, allowing them to manage threats more efficiently.

As the industry rapidly advances toward AI, there is a pervasive focus on buzzwords like context, tools, and harness. However, the real challenge lies in the lack of a universally accepted understanding of these terms, which impedes the effective integration of AI in security. True context should be a live model of the environment, not just enriched data, allowing for real-time understanding and decision-making. This concept is exemplified by CloudTwin and StreamForce, which emphasize a unified model of the environment where tools are not isolated features but expressions of the system's state, leading to seamless and meaningful actions. Instead of relying on external control layers or harnesses that compensate for fragmented data, these models propose that AI should operate on a shared reality. This approach facilitates predictive simulation rather than mere visibility or understanding, allowing agents to execute within constraints set by humans, shifting the role of AI from being an assistant to an operator. The paradigm shift proposed is to prioritize understanding the system's reality before increasing AI usage, suggesting that better security arises from a comprehensive model of the environment rather than merely adding more AI.

CVE-2026-31431 is a logic flaw in the Linux kernel's cryptographic subsystem that has existed since 2017, allowing unprivileged users to corrupt in-memory files using crypto sockets without needing special permissions. This vulnerability is particularly dangerous in Kubernetes environments, where it facilitates cross-container lateral movement by exploiting shared resources like the page cache, without escaping to the host. Container images in Kubernetes are composed of layers, and when multiple containers on the same node share these layers, they also share the same page cache entries, making them vulnerable to this exploit. The attack can be executed rapidly and invisibly through common system binaries like /usr/bin/cat, leading to potential control over cluster-admin pods and access to sensitive data. Despite its serious implications, the vulnerability is not a container-to-host escape but rather a container-to-container movement, posing a significant risk to any Kubernetes setup with shared base images. Detection and mitigation involve monitoring specific syscall patterns, applying kernel patches, and employing diverse base images to limit the blast radius. Stream.Security addresses this gap by using eBPF sensors to monitor syscalls in real time, enabling rapid deployment of detection and mitigation strategies without needing extensive configuration changes.