January 2026 Summaries

Falco, a CNCF-graduated open-source project, offers runtime security for cloud-native environments by monitoring containers at the kernel level using eBPF probes to detect suspicious behavior in real-time. Integrating Falco with AWS Security Hub CSPM through the AWS Marketplace provides a streamlined solution for cloud security, eliminating the need for complex manual setup. This integration allows for seamless deployment on Amazon EKS clusters, automatically provisioning necessary AWS resources and enabling immediate visibility of security findings in the AWS Security Hub CSPM dashboard. The integration supports compliance alignment, workflow management, and automation, making it ideal for DevOps and security teams looking to consolidate threat detection using open-source tools without extensive setup. With this solution, organizations can quickly enhance their runtime security posture by leveraging Falco's detection capabilities and AWS's unified security dashboard, facilitating rapid detection and action on potential security threats.

Sysdig has been recognized as a Strong Performer in the Gartner Voice of the Customer for Cloud-Native Application Protection Platforms (CNAPP), reflecting positive feedback from its users. CNAPPs are integrated security solutions that provide visibility and protection across the application lifecycle, combining various security functions into a unified platform. Sysdig's CNAPP has been praised for its robust security features, real-time threat detection, and comprehensive integration of multiple tools, earning a 4.8 out of 5 rating from customers on Gartner Peer Insights. Customers have highlighted the platform's ability to eliminate siloed views and provide real-time security, citing its transparency, clarity, and speed as standout features. Sysdig’s commitment to delivering end-to-end cloud security through agentic AI and open-source solutions has contributed to its high customer satisfaction, with 94% of respondents recommending the platform.

As organizations prepare to integrate generative AI tools like Microsoft Copilot and Google Gemini, they face significant challenges in protecting sensitive business data, particularly unstructured data, which is not easily safeguarded by traditional security measures focused on structured data. The deployment of these AI tools, often bypassing conventional gatekeepers and with unlimited data consumption potential, raises concerns as they prioritize providing accurate answers over data protection. This shift requires organizations to reassess their strategies for inventorying, protecting, and managing access to sensitive data, emphasizing the need for new approaches that recognize the emergent sensitivity of unstructured data and ensure the integrity and responsible handling of information. Controlled Unclassified Information (CUI) serves as an example of unstructured data requiring specific safeguarding measures, highlighting the complexity of defining and managing data sensitivity without relying on conventional methods like regex or predefined attributes.

Sysdig's Threat Research Team conducted an in-depth analysis of VoidLink, a sophisticated Chinese-developed Linux malware framework targeting cloud environments, following its initial discovery by Check Point Research. VoidLink is notable for its advanced server-side rootkit compilation, which allows kernel modules to be built on-demand for specific targets, addressing portability challenges traditionally faced by Loadable Kernel Modules (LKMs). The malware is written in the Zig programming language and features real-time adaptive detection and response evasion, making it highly stealthy and difficult to detect. It employs a multi-stage loader architecture with fileless execution techniques and utilizes various stealth mechanisms, including eBPF and LKM, depending on the kernel version. VoidLink's rootkit capabilities include syscall table hooks and kretprobe hooks to hide its presence, as well as multiple control channels, such as ICMP covert channels, for managing the malware. Despite its sophistication, VoidLink's activities can still be detected through runtime monitoring tools like Falco and Sysdig Secure, which can identify its distinctive syscall patterns and fileless execution techniques. The analysis highlights the malware's integration of AI-assisted development with deep kernel expertise and operational tradecraft, suggesting a high level of sophistication and maturation in its design, which poses significant threats to Linux environments, especially those in cloud-native settings.

AI workloads, while often perceived as complex and magical, require the same security measures as traditional IT infrastructures, especially given their vulnerability to threats such as data leaks, model poisoning, and unauthorized access. The article outlines the security risks associated with different AI applications, such as large language models (LLMs) and company-specific models, and offers mitigation strategies including access control, model and data security, and threat management. It emphasizes the importance of educating users on best practices, securing credentials, filtering user inputs, and protecting against attacks like LLMJacking and denial of service. Furthermore, the text highlights the necessity of compliance with data protection laws such as GDPR and CCPA and recommends utilizing security benchmarks to identify and address vulnerabilities. Ultimately, the guide draws parallels between AI workload security and conventional security practices, encouraging a comprehensive approach to safeguard AI infrastructures.

Threat actors are exploiting self-hosted GitHub Actions runners as backdoors, allowing them to maintain persistent access to compromised systems by using trusted communication channels that evade traditional network defenses. The Shai-Hulud worm exemplifies this threat by using GitHub's infrastructure to establish rogue runners after compromising developer machines. The attackers leverage intentionally vulnerable workflows to execute arbitrary code, posing a significant security risk due to the runners' access to internal networks and cached credentials. The article recommends several mitigation strategies, including using ephemeral runners, restricting runner access to trusted repositories, and implementing runtime detection for persistence techniques to counteract these threats effectively. The case study of the Shai-Hulud campaign highlights the need for organizations to treat the security of self-hosted runners as a priority to prevent attackers from gaining privileged access to critical infrastructure.

Sysdig introduces an innovative approach to cloud security with the industry's first agentic AI-powered platform, Sysdig Sage, designed to enhance real-time defense without compromising efficiency. The platform offers comprehensive protection across the cloud lifecycle, including posture management, vulnerability management, cloud workload protection, and detection and response, aiming to bridge the gap between fast-paced security and development teams. Sysdig emphasizes openness and transparency through its integration with the open-source community, leveraging tools like Falco for customizable security solutions. The platform significantly reduces the mean time to resolution (MTTR) by 76% and cuts down on vulnerability noise by 98%, allowing teams to save time, respond swiftly, and maintain focus on innovation. With recognition as a representative vendor in Gartner's CNAPP Market Guide and as a customer's choice for CNAPP, Sysdig builds trust by offering clear insights and actionable guidance, prioritizing security without hindering agility.

Sysdig Sage is an AI-powered cloud security tool designed to enhance vulnerability management by transforming the traditional approach into an intelligent, end-to-end workflow. Unlike conventional scanners that inundate users with generic risk scores and results, Sysdig Sage integrates AI reasoning with real-time context to prioritize vulnerabilities based on their actual impact on the environment, focusing on what is widespread, dangerous, and immediately fixable. By analyzing runtime data, such as loaded packages and deployed images, it offers tailored, step-by-step remediation guidance that integrates seamlessly into existing development workflows, reducing false positives and manual triage. Sysdig Sage also tracks remediation progress and provides audit-ready reports, allowing security teams to demonstrate real improvements. Part of the Sysdig Agentic Cloud Security Platform, it leverages continuous monitoring and autonomous action to streamline vulnerability management, saving teams significant time and enabling faster remediation of critical issues.

December 2025 saw significant cybersecurity challenges, marked by the emergence of sophisticated threats and vulnerabilities. Notable incidents included the React2Shell vulnerability affecting applications with React Server Components, which required urgent patching and monitoring due to its potential for remote code execution. The BRICKSTORM malware, linked to Chinese state-sponsored actors, targeted Linux-based cloud environments, leveraging advanced techniques to maintain persistent control and evade detection. MongoDB faced the MongoBleed vulnerability, a longstanding data exposure issue at risk of exploitation by unauthenticated attackers, necessitating audits and patching. Additionally, the Sysdig Threat Research Team identified a new threat dubbed EtherRAT, utilizing Ethereum blockchain for command and control, and highlighted payloads from its exploitation of React2Shell. Other security events included a breach at the European Space Agency and a DDoS attack disrupting French postal and banking services. These incidents underscored the ongoing pressure on cybersecurity defenders and highlighted the need for vigilance, resilience, and collaboration in the face of evolving threats.

Sysdig's recent blog entries highlight significant cybersecurity threats and innovations, focusing on EtherRAT and its implications. EtherRAT, a novel implant linked to the DPRK, utilizes Ethereum blockchain for command and control and targets React Server Components and Next.js through the React2Shell vulnerability. The Sysdig Threat Research Team provides an in-depth analysis of how EtherRAT delivers multiple payloads using blockchain technology, illustrating the evolving nature of cyber threats. Other topics include the introduction of Sysdig's runtime file integrity monitoring (FIM) for enhanced security and strategies for detecting multi-stage attacks with behavioral analytics, emphasizing the importance of proactive security measures in cloud environments.