September 2026 Summaries

AI is increasingly shifting from an experimental, externally consumed service to core infrastructure that organizations customize, integrate, or build themselves, according to Sysdig’s 2026 cloud-native security data. The analysis found substantial growth in AI and machine-learning packages, including sixfold growth in ML packages, 14-fold growth in OpenAI packages, and 40-fold growth in Anthropic packages, indicating deeper operational adoption. Although usage is expanding, consolidation into internally managed model infrastructure may reduce exposure by replacing numerous AI tools and APIs with fewer, more manageable resources; public exposure remained at 1.5% for AI and ML packages, while only 0.05% of resources were publicly exposed. B2C industries such as media, transportation, and retail are leading adoption because AI directly affects customer experience and revenue, while B2B organizations commonly apply it to productivity, analytics, automation, and support. EMEA also leads regional adoption, potentially aided by clearer EU regulation, data sovereignty needs, and compliance requirements. In cybersecurity, AI is becoming essential for both attackers and defenders, with malicious actors using it for autonomous ransomware, rapid account takeovers, and exploiting vulnerabilities, while security teams use ML, large language models, and agentic systems for detection, remediation, automated response, and investigations.

Software bills of materials (SBOMs) are intended to improve software supply chain security by documenting a program’s components, origins, and creators, particularly when combined with signed attestations that can verify integrity and provenance. Their adoption and effectiveness remain limited by inconsistent developer-tool support, the need for organizations to independently validate developer-provided SBOMs through image scanning and policy enforcement, and the fact that vulnerability data quickly becomes outdated as new flaws emerge. SBOMs also cannot reliably address insider threats or malicious code introduced by trusted contributors, such as the XZ Utils backdoor, which may require dynamic analysis and AI-assisted detection. The discussion argues that SBOMs should be treated as one part of a broader security process involving continuous scanning, CI/CD and Kubernetes controls, signed attestations, shared findings, and potentially regulation to establish stronger accountability across the software supply chain.

Cloud identity and access management remains a major security challenge as organizations increasingly depend on complex, often multicloud environments, with 24% maintaining identities across multiple cloud service providers. The report cited finds that an average of 67% of user identities are risky because of excessive permissions, long-unused access, or lack of multifactor authentication, while machine identities account for 97.2% of managed cloud identities and roughly 40% carry risks such as administrative privileges, user-managed keys, or inactivity. As cloud applications rely on interconnected microservices, external tools, and AI agents, identity permissions can grow rapidly and become difficult to govern. The article argues that IAM now functions as the cloud-native security perimeter and recommends continuous behavioral monitoring, automated enforcement, dynamic least-privilege controls, consolidated multicloud management, removal of unused permissions, and temporary or short-lived credentials. It also presents agentic AI as a potential tool for analyzing identity behavior and managing access risks at scale.

New EU Cyber Resilience Act reporting obligations, effective September 11, 2026, require manufacturers of digital products sold in the EU to report actively exploited vulnerabilities and severe incidents within timelines ranging from 24 hours to one month, adding to overlapping requirements under GDPR, NIS2, DORA, SEC rules, and the forthcoming CIRCIA framework. Although these regimes use different triggers, deadlines, recipients, and terminology such as material, major, significant, or severe, they largely require organizations to make the same rapid judgment about whether an incident warrants outside notification. The central challenge is not tracking deadlines but assembling an accurate, defensible fact pattern about what happened, when it began, what data or systems were affected, who was impacted, whether malicious activity occurred, and how the organization responded. Static compliance evidence and vulnerability inventories are insufficient for this purpose, particularly where rules require proof of active exploitation or detailed impact assessments. Organizations are encouraged to prepare before incidents by mapping applicable regulations, using the strictest requirements as a baseline, rehearsing classification and disclosure procedures, identifying decision-makers, testing available evidence against realistic scenarios, and coordinating security, legal, product, and third-party risk teams to ensure consistent communications to regulators, customers, individuals, and investors.

Runtime security in cloud-native environments is increasingly crucial due to the unique challenges containers present, where traditional security tools often fall short. Falco, an open-source project under the Cloud Native Computing Foundation (CNCF), addresses these challenges by monitoring system calls for detecting unexpected behavior in containers, hosts, and clusters. Falco's deep visibility and context-awareness allow users to identify security threats such as zero-day vulnerabilities and privilege escalation attempts during runtime. It leverages kernel system call analysis and Kubernetes API audit events, offering insights into who did what and where. While Falco excels at flagging suspicious activities, it is a monitoring-only tool and does not automatically take corrective actions. Commercial products like Sysdig Secure can extend Falco’s capabilities by offering comprehensive security workflows and easier management, providing an integrated platform for cloud security posture management.

Runtime security is emphasized as a crucial focus for Chief Information Security Officers (CISOs) to effectively manage digital risks within complex application environments. Matt Stamper, a seasoned CISO, highlights the importance of prioritizing runtime security to reduce noise and enhance the signal of actual risks, drawing parallels with economic principles where the margin is critical. He notes that while vulnerability management programs often deal with countless threats, only a small subset are actively exploited, and these demand immediate attention and remediation. By concentrating on runtime security, CISOs can better guide their organizations in prioritizing digital risks and enhancing operational resilience. Stamper points out the limitations of existing standards like the OWASP® Foundation's ASVS in addressing runtime security, advocating for a balanced approach between preventive measures and real-time protection to build a more robust security framework.

Sysdig Threat Research reported that a threat actor exploited CVE-2026-39987, a pre-authentication remote code execution flaw in marimo’s `/terminal/ws` endpoint, to gain shell access to a notebook host and pivot into AWS infrastructure. Over a nine-hour session, the operator manually built and tested Python tools that harvested AWS credentials from host and Redis-backed application sources, retrieved an SSH key from AWS Secrets Manager, and used it to access a bastion host, completing the final WebSocket-to-SSH sequence in eight seconds. Unlike previously observed AI-assisted attackers targeting the same flaw, this operator showed no apparent LLM fingerprints, avoided a planted prompt-injection trap, and used hand-rolled scripts, although a failed EC2 Instance Connect attempt exposed an automation error involving a placeholder instance ID. The report emphasizes that defenders should detect the overall attack chain—credential access, Secrets Manager calls, outbound connections, and SSH pivots—rather than rely on distinctive shell-command patterns, while recommending upgrades to marimo 0.23.0 or later, restricted terminal exposure and egress, tighter IAM permissions, credential rotation, and investigation of suspicious temporary files and cloud activity.

Containers are crucial for cloud workloads due to their flexibility, scalability, and speed, but they introduce complex security challenges that traditional approaches may not adequately address. Runtime insights provide essential visibility and intelligence by continuously monitoring containerized workloads, allowing security teams to detect real-time threats and prioritize risks effectively. This approach enhances security by analyzing live behavior, offering a more efficient vulnerability management process, and facilitating quick, informed incident responses. Runtime insights also support compliance with regulatory standards by providing continuous monitoring and audit trails. By integrating runtime insights with DevSecOps practices, teams can better collaborate to address emerging threats, thereby overcoming the limitations of static security measures and fostering cloud-native innovation.

Cloud security is increasingly critical as over 85% of organizations are expected to adopt a cloud-first strategy by 2025, making cloud environments attractive targets for cybercriminals. The complexity of cloud services, such as SaaS, IaaS, and PaaS, expands the attack surface for organizations, necessitating enhanced security measures. Traditional security tools often fall short in addressing the unique challenges of cloud environments, leading to the development of Cloud-Native Application Protection Platforms (CNAPPs). CNAPPs integrate various security functions into a single platform, providing comprehensive visibility and control over cloud workloads. By incorporating runtime insights, CNAPPs enable organizations to prioritize security threats based on business impact, thereby improving operational efficiency and minimizing risk. This approach allows DevSecOps teams to focus on significant threats without being overwhelmed by alerts, ultimately strengthening an organization's security posture. As cloud security continues to evolve, the integration of CNAPPs and runtime insights is becoming essential for proactive risk management and the protection of cloud infrastructures.

Cloud security strategies must evolve to prioritize runtime security due to the dynamic and ephemeral nature of cloud-native environments. Traditional tools like Cloud Security Posture Management (CSPM) and Endpoint Detection and Response (EDR) fall short in real-time threat detection, as they were not designed to handle the rapid changes and complexities of cloud infrastructures. Runtime security, on the other hand, offers continuous monitoring and automated responses to live threats, effectively reducing detection and response times from hours or days to mere minutes. This approach not only improves the mean time to detect (MTTD) and mean time to respond (MTTR) but also reduces costs associated with breach recovery by addressing threats as they occur. While posture management remains important, it should complement, rather than lead, a robust cloud security strategy that adapts to the fast-paced cloud environment.

August 2026 cybersecurity developments highlighted how AI systems can enable harmful activity using existing permissions rather than novel exploits or privilege escalation. The ChainDrop npm supply-chain worm compromised more than 400 packages through a compromised maintainer account with valid provenance and targeted AI coding credentials, while DEF CON research showed that manipulated logs could induce AI coding agents to perform authorized but harmful actions, underscoring the need to separate read-only and write or execution capabilities. Reports also described ransomware operators using Claude Code to identify valuable databases and assets after asserting authorization, and Sysdig’s analysis of eight AI-enabled attacks found that most relied on common command-execution techniques rather than new methods. Other developments included an updated OWASP Top 10 for LLM Applications, pending CIRCIA incident-reporting rules, NIST’s request for feedback on modernizing the National Vulnerability Database, and Cl0p’s exploitation of a PTC Windchill vulnerability affecting roughly 50 organizations.