The leader in real-time cloud security
San Francisco, CA
Joined January 2014
- Tweets7.8K
- Following1.3K
- Followers10.4K
- Likes4.3K
From Raleigh to Milan, the Sysdig team went all out for Halloween. 🎃
Masquerading is usually something we detect. This week, we celebrated it. Zero false positives. Several very high-severity outfits. 👻
Want to join this team? okt.to/zHFr7D
#LifeAtSysdig #TeamSysdig #Halloween okt.to/cP4dCZ
Sysdig Headless Cloud Security won the Agentic AI Security Innovation Award in the 2026 CyberSecurity Breakthrough Awards. 🏆
In an industry competing on dashboards, we broke through by removing them.
okt.to/BfXzOs
#CybersecurityBreakthrough #HeadlessCloudSecurity #AIAgents #Sysdig
🚨 Three bugs. One week. The new patch window is shorter than the news cycle.
🐘 PHP2Shell: unauthenticated RCE in PHP core, exploitation confirmed
🟢 Node2Shell: Node.js Brotli bug, also being exploited
🐧 ZDI-CAN-33367 and five other Linux flaws, one with a public root exploit
Vulnerability scanning and runtime detection are best friends before patches land. Blog links in the replies. 👇
#CloudSecurity #ThreatResearch #PHP #NodeJS #Linux
PHP2Shell
sysdig.com/blog/php2shell-cv…
Node2Shell
sysdig.com/blog/node2shell-c…
ZDI-CAN-33367
sysdig.com/blog/detecting-an…
Mythos access is expanding. Your vulnerability management program doesn’t need a rewrite. 🔒
More defenders can find vulnerabilities faster, but discovery isn’t exploitation. The fundamentals still hold.
Blog: okt.to/oSDBrm
Last chance to register for “Mythos, Decoded” this Thursday, Oct 29 at 8am PT / 11am ET: okt.to/5UTR1P
#CloudSecurity #VulnerabilityManagement #AIAgents okt.to/ZRPbfw
🚨 Node2Shell (CVE-2026-111497, CVSS 9.2): a public repo for this Node.js Brotli flaw appeared about five hours after the fix shipped.
No confirmed in-the-wild exploitation yet, but the patch-to-PoC gap was about a day. Patch in order of reachability: start with services that decode Brotli you don’t control.
okt.to/3pTBzk
#CloudSecurity #ThreatResearch #NodeJS #RuntimeSecurity
🚨 A working root exploit for a Linux kernel bug is public. No CVE. No merged fix.
ZDI-CAN-33367 is a gap in the Dirty Frag fix, with root confirmed on current Ubuntu, Debian, and AlmaLinux. Restrict unprivileged user namespaces and enforce seccomp RuntimeDefault while you wait.
okt.to/08psRf
#CloudSecurity #ThreatResearch #Linux #RuntimeSecurity
AI agents are writing code, touching production, and acting with real credentials. So who’s watching what they actually do? 🔒
Join Sysdig’s Conor Sherman and Shantanu Gattani on LinkedIn Live to talk runtime security and governance for AI agents. Live demo included.
📅 Nov 5 | 12pm ET / 9am PT
okt.to/1h0YSs
#AIDefense #AIAgents #RuntimeSecurity
🚨 PHP2Shell: two critical CVEs in PHP core (CVSS v4.0 9.2). Exploitation attempts began four days before the patch was released.
An unauthenticated attacker can run code with HTTP requests alone. The vulnerable code dates to PHP 5.4 in 2012, so even clean application code is exposed.
Patch first and assume breach.
okt.to/xlQvRe
#CloudSecurity #ThreatResearch #PHP #RuntimeSecurity
Wide eyes. Racing pulse. A backlog that keeps growing. You may be experiencing Mythos anxiety. 😅
Join our “Mythos, Decoded” webinar to learn how runtime context shows which vulns add real risk. Practical steps, minus the panic.
📅 Oct 29 | 8am PT / 11am ET
okt.to/vOdlGe
#CloudSecurity #VulnerabilityManagement #RuntimeSecurity
Sysdig Accelerate ‘26 Japan is a wrap. 🙌
Thank you to our speakers, customers, and partners. The conversations in the room were exactly why we do this: people serious about defending cloud and AI environments at machine speed.
See you next year, Japan. 💚
#Sysdig #CloudSecurity #AIDefense #Japan okt.to/LvyX7Q
Frontier AI models like Mythos can discover vulnerabilities faster than any human. Most advice floating around isn’t helping.
Join us October 29 to separate what’s actually changed from the noise.
Mythos, Decoded: What’s Actually Changed in Vulnerability Management
📅 Oct 29 | 8am PT / 11am ET
okt.to/iFTNAp
#CloudSecurity #VulnerabilityManagement #AIAgents
Excited to welcome Teri Harrell as Sysdig’s new Chief Human Resources Officer. 🎉
25+ years in talent, development, and org change. Former CHRO at VitalEdge, HR leadership at Red Hat. Exactly who you want leading people strategy at a company moving this fast.
Welcome to the team, Teri!
okt.to/Sv7Aux
#Sysdig #LifeAtSysdig #Leadership
Cybersecurity Awareness Month. A good time to remember what causes breaches every other month.
78% trace to system intrusion and social engineering. Vulnerability exploitation up 55% YoY. Human element in 62% of breaches.
MFA works. Least privilege works. Patching works. The fundamentals just need to be daily, not annual.
okt.to/yuTSw1
#CybersecurityAwarenessMonth #CloudSecurity #RuntimeSecurity
Just wrapped SecTor 2026 in Toronto. A few takeaways from the show floor.
Runtime is entering the mainstream AI security conversation. AI agents aren’t reliable narrators about their own actions. And the governance angle is resonating more than expected.
We’ve been saying this for a decade. Good to see the market catching up.
#SecTor2026 #CloudSecurity #AIDefense #RuntimeSecurity
Security teams didn't lose their edge. The window to use it collapsed.
In 2018: nearly a year to weaponize a vulnerability. By 2025: hours.
The assumption that a human has to be in the loop no longer holds for AI security. Our latest article breaks down what does.
okt.to/H6P1lU
#CloudSecurity #AIAgents #RuntimeSecurity #AIDefense
September's security theme: a gap between initial access and anyone noticing something was wrong.
Rogue OpenAI agents. ShinyHunters scaling with Claude. A human attacker at machine speed. Crystal Morin's monthly briefing covers it all.
okt.to/ju5QS8
#CloudSecurity #ThreatResearch #AIAgents #RuntimeSecurity
How fast can an AI agent chain two Zammad zero-days and reach root? DIVD says seconds.
The target: DIVD itself, the nonprofit that warns others about exposed systems.
Breakdown, detections & mitigations:
okt.to/iF0krv
#cloudsecurity #ThreatResearch
SBOMs give you visibility into your software supply chain. But what else do you need to defend against attacks?
Four challenges: inconsistent tool support, untrustworthy data, vulnerabilities that change daily, and internal threats no SBOM can detect.
Full breakdown: okt.to/5QKVCZ
#CloudSecurity #SupplyChainSecurity #SBOM #ContainerSecurity
A typical cloud attack takes 10 minutes. The median dwell time for on-premises threats is 16 days.
Those two numbers explain why cloud defense needs its own benchmark.
5 seconds to detect. 5 minutes to triage. 5 minutes to respond.
Download the 555 Benchmark whitepaper: okt.to/QgS4xe
#CloudSecurity #RuntimeSecurity #CDR #CNAPP
