Sysdig

Name: Sysdig
Address: 35 Main Street, 21st Floor, San Francisco, CA, 94105, US
Telephone: (415) 278-0444

Sysdig secures cloud innovation with the power of Runtime Insights.

11/06/2026

We talk a lot about speed. The Milan team decided to run it. 🏃

Two teams of four took on The Loop Relay, a 20K relay with skyscrapers all around, plenty of team spirit, and a great way to kick off the day.

No false positives. A few sore legs. Zero latency on the cheering. 👟
Huge shoutout to [NAMES] for lacing up and showing up.

Want to join this team? We’re hiring: https://okt.to/R28vWT

11/05/2026

Detect. Respond. Accessorize.

Cloud and AI threats? Take them head on at KubeCon SLC. Pick up your Lumin cap at booth #168.

Keep your wardrobe fresh and your cloud security fresher. Drop into these sessions:

📅 Nov 11, 10:30am | Booth 168
Falco Meets AI Threats: Runtime Defense Beyond Kubernetes (live demo)

📅 Nov 12, 2:40pm | Salt Palace, Level 2, 251 D-F
Falco Never Flies Alone: Runtime Security as an Ecosystem, with the maintainers

🎉 KubeNight Out: https://okt.to/xilwHP

See you in Salt Lake.

11/04/2026

An agent can tell you it did one thing. The real story might be something else.

Security assumed software did what it was told. Something you could write a policy for in advance and trust to hold.

AI agents don’t work that way. They write their own plan while they run. They carry a real person’s credentials. And their own account of what they did doesn’t always match what actually happened.

That leaves every organization with three critical questions: What AI are we using? Who’s accountable for it? What can we actually prove?
So we rebuilt security to answer them.

Today, Sysdig is introducing AI Defense: runtime security and governance for agents. It finds every agent run by your team, decides what they’re allowed to do, and keeps a record the agent can’t change. When an action goes too far, it’s stopped the moment it starts.

Read the full announcement: https://okt.to/ulDven

11/03/2026

Last chance to register: Thursday’s LinkedIn Live is almost here. ⏳

Can you trust an AI agent’s own account of what it did? Sysdig CISO Conor Sherman and SVP of Product Shantanu Gattani, led by VP of Marketing Ryan Davis, break down why that account can’t stand on its own, and what to rely on instead.

What you’ll see:

🔹 Why an agent’s own logs can’t be trusted on their own
🔹 Why runtime is the only place the truth about an agent lives
🔹 A live demo

📅 This Thursday, November 5 | LinkedIn Live | 12pm ET / 9am PT

Save your seat. 👇

https://okt.to/duREsV

11/02/2026

About 50% of AI tools on employee laptops never show up in the agents’ logs. 🔒

That’s what we observed over 30 days in one customer’s environment. When your board asks about AI, can you answer these questions?

🔹 What AI is in our estate, and who is accountable for it?
🔹 Can we block an agent from an MCP server? Won’t it just go around?
🔹 How do we know an agent isn’t going rogue, and can we stop it?
🔹 Who is spending the most on AI, and on the right models?

Join Frank Dickson of Dickson Research and Blair Howard, Principal Product Marketing Manager at Sysdig, for 30 minutes on what boards and regulators expect as evidence when it comes to AI.

📅 Tuesday, November 17 | 8am PT / 11am ET

Register here. 👇

https://okt.to/fkjUHp

10/30/2026

From Raleigh to Milan, the Sysdig team went all out for Halloween. 🎃

From Raleigh to Milan, the team dressed up for Halloween. Masquerading is usually something we detect, but this week we made an exception.

Swipe through for the best of both offices. 🎃

Want to join this team? We’re hiring: https://okt.to/s2HGmr

10/29/2026

Sysdig just won the Agentic AI Security Innovation Award in the 2026 CyberSecurity Breakthrough Awards. 🏆

In an industry competing on dashboards, we broke through by removing them with headless cloud security.

Headless cloud security exposes our full CNAPP through APIs, MCP services, and expert-curated agent skills, so AI coding agents like Claude and Cursor can act inside the workflows teams already use, with human approval gates.

What that looks like in practice:

🔹 Vulnerabilities prioritized by runtime exposure and delivered as ready-to-merge pull requests
🔹 Misconfigurations detected and remediated in real time
🔹 Runtime threats investigated and responded to without manual triage

Customers see it too. Jordan Bodily, Manager of Infrastructure Security at Commerce, called it “not another wrapper or dashboard.”

Thank you to the team that built it, and congratulations. 👇

https://okt.to/PclkpH

10/28/2026

🚨 Three bugs. One week. The new patch window is shorter than the news cycle.

🐘 PHP2Shell (CVE-2026-109618, CVE-2026-109619)
An unauthenticated RCE in PHP core, in code that dates to PHP 5.4 (2012). In recent days, exploitation has been confirmed and researchers estimate that 1-2 million hosts could be vulnerable.

🟢 Node2Shell/HTTP2Shell (CVE-2026-111497)
A Brotli decoder bug in Node.js. This vulnerability is also being exploited, but several fixes have been shipped in the past few days. Initially there was only one way to reproduce the RCE, now there are dozens.

🐧 ZDI-CAN-33367 and five other Linux flaws
Six reports leaked to public mailing lists with no patches attached. One has a public root exploit, but several patches have been shipped this week.

🛡️ How Sysdig helps: Vulnerability scanning and runtime detection are best friends before patches are applied. Sysdig Secure customers have Threat Intelligence entries and managed runtime rules for all three.

Get the links to each blog in the comments.

10/28/2026

Mythos access is expanding. Your vulnerability management program doesn’t need a rewrite. 🔒

Mythos 5.1 is out, and Anthropic folded Glasswing into a wider Cyber Verification Program. More defenders can now find vulnerabilities at machine speed. But discovery isn’t exploitation, and pe*******on testing and red teaming stay gated behind the most heavily vetted tiers.

What hasn’t changed:

🔹 Scan and discover everything in one place
🔹 Prioritize by what’s in use and exploitable, not what scores high
🔹 Automate remediation at the source
🔹 Treat runtime security as the safety net for whatever stays exposed

Read the blog: https://okt.to/38iwGl

Then get the practical steps live. Last chance to register for “Mythos, Decoded” this Thursday, Oct 29 at 8am PT / 11am ET 👇

https://okt.to/BxF5sp

10/26/2026

🚨 Node2Shell (CVE-2026-111497): a public repo for this Node.js Brotli flaw appeared about five hours after the fix shipped. Code ex*****on was demonstrated on the official Node.js 24.22.0 image within a day. 🚨

The bug is a malformed Brotli stream, an ignored error, and a write past the end of a buffer. The bug has a CVSS v4.0 9.2 score. As of Oct 23, no confirmed in-the-wild exploitation has been confirmed, but the gap between patch and PoC was about a day.

👀 What was found in the research:
➝ Crashes are easy to reproduce, while reliable RCE has only been shown in one setup, and it took several attempts
➝ Express 5 with default JSON parsing reaches the vulnerable decoder. So does server-side fetch() on attacker-influenced responses
➝ Node.js 25 and 20 are end of life with no fix, and Bun 1.4.3 and earlier is affected
➝ Some distro packages may use the system Brotli library, so a Node.js version number won’t tell you if you’re patched

🛡️ What to do:
➝ Update to Node.js 22.23.4, 24.22.1, or 26.12.1, and rebuild container images from a patched base
➝ Find every service that decodes Brotli from untrusted sources, and patch those first
➝ Run Node.js as an unprivileged user and keep secrets out of the process environment

🎯 Takeaway:
Patch in order of reachability. A runtime sensor won’t see the overflow, but it will catch what a successful exploit does next.

↳ Full write-up from the Sysdig Threat Research Team: https://okt.to/hQ92le

Address

35 Main Street, 21st Floor
San Francisco, CA
94105

Telephone

(415) 278-0444

Website

https://www.sysdig.com/

Alerts

Be the first to know and let us send you an email when Sysdig posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.