All news with #runtime security tag

🔒 Google Cloud and Wiz announce the Wiz Runtime Sensor add-on for Google Kubernetes Engine (GKE), now in preview. The managed, first-party integration automates deployment, credential handling via Secret Manager, lifecycle updates, and fleet-wide enforcement to deliver eBPF-based runtime threat detection for Standard and Autopilot clusters. The sensor provides kernel-level observability with low CPU and fixed memory limits, supports proxyed egress, and auto-updates independently of cluster lifecycles. Platform teams can enable and enforce the add-on via gcloud, APIs, and organization policy.

🧭 Cloudflare announces on-demand CPU and memory profiling for Workers and Durable Objects, accessible from the Workers Observability page or via the CLI. Profiles capture live production behavior as interactive flamegraphs, letting you inspect functions by CPU or allocation impact and download profile files for deeper analysis. The feature helps identify hotspots, remove duplicated work, and resolve memory issues by profiling deployed script versions and Durable Objects.

🔔 AWS has integrated Amazon GuardDuty Runtime Monitoring into the AWS Security Hub Threat Analytics plan. This runtime capability inspects OS, network, and file activity to detect threats like container escapes, privilege escalation, and cryptomining across Amazon EC2, Amazon EKS, and Amazon ECS on AWS Fargate. Billing for Runtime Monitoring is now consolidated under Security Hub as a single usage type, eliminating separate GuardDuty Runtime Monitoring charges for accounts and regions with Security Hub enabled. Detection behavior, finding types, and GuardDuty agents remain unchanged, and no reconfiguration is required; free-trial terms for Threat Analytics and Security Hub Essentials remain separate.

🔥 Cloudflare announces Issues, a built-in error monitoring feature for Cloudflare Workers now in open beta. With one-line configuration, Issues captures uncaught exceptions, failed invocations, 5xx responses, console output, and stack traces without additional SDKs. It groups related failures, shows trends and context, and can send structured diagnostics to agents via Automations for investigation and remediation. Use the Workers OpenTelemetry API to attach application identifiers and the cf CLI to inspect issues and create automations.

🛠️ Amazon Elastic Container Service (Amazon ECS) now offers real-time service deployment observability in the Amazon ECS Console for native Linear, Canary, and Blue/Green deployment strategies. The console provides a live deployment timeline showing phases, service events, and task launch/termination progress, along with traffic shift distribution and lifecycle stage visibility. Deployment health signals—circuit breaker status, alarms, container and load-balancer checks, and lifecycle hooks—appear alongside the timeline, and failed tasks surface with diagnostic context and deep links for rapid troubleshooting.

🔧 The Antigravity SDK provides the runtime used in Antigravity 2.0 and the Antigravity CLI, enabling teams to build centralized agent hubs that run predictably, log comprehensively, and remain sandboxed. It combines a runtime managing model interactions and tools with observability middleware using lifecycle hooks to stream telemetry. The SDK supports session persistence, declarative safety policies, dynamic skill resolution from the filesystem, and concurrent streams for responses, thoughts, and tool calls to power a complete multi-agent control plane.

🛡️ AWS Lambda recursive loop detection is now available in all commercial AWS Regions. This default-enabled guardrail detects and stops recursive invocations between Lambda functions and supported event sources like Amazon S3, Amazon SQS, and Amazon SNS, preventing runaway workloads and unexpected costs. When a loop is detected, Lambda halts processing and sends an AWS Health Dashboard notification with troubleshooting guidance. You can disable detection per function using the PutFunctionRecursionConfig API if intentional recursion is required.

🔒 Microsoft has been named a visionary leader in Frost & Sullivan’s Frost Radar™: Cloud Workload Protection Platforms, 2026. The report highlights a market shift from isolated scanning to a unified runtime security model that connects code, cloud resources, identities, and SOC workflows. Frost & Sullivan cites Microsoft Defender for Cloud’s scale, deep runtime telemetry, and integration with Defender XDR, Sentinel, GitHub, and Copilot as key strengths. This positioning reflects Microsoft’s estimated >22% share of the global CWPP market and emphasizes runtime depth, container and Kubernetes security, and AI workload protection.

🔍 Researchers at Black Hat USA 2026 demonstrated that GitHub’s native telemetry can be used like an EDR to detect supply-chain attacks by monitoring event streams, webhooks, API data, and Git history. Their open-source GitHub Threat Detector implements behavioral detections from recurring attacker techniques—such as forged commit metadata, mass tag poisoning, workflow abuse, and OIDC token misuse—into correlated rules. The tool uses a PostgreSQL-backed activity store for historical correlation and includes production and beta detection rules, though it faces practical limits from disabled webhooks and API rate limits.

🛡️ Organizations deploying AI at scale face more than model vulnerabilities; the hardest risks arise when AI is integrated into business workflows. Identity and authorization are necessary but insufficient — runtime governance must evaluate behavior in context. Practical controls include least-privilege access, human approval gates, and recording an agent’s decisions and touched systems to ensure accountability.

🔒 AI adoption is accelerating rapidly, but so are API-linked security incidents, making mature API management essential. The article argues that without comprehensive API discovery, runtime protection and governance, investments in AI security will fall short. It highlights shadow and zombie APIs, rising AI-related CVEs, and real-world incidents where agents deleted production data. The piece recommends continuous API inventory, runtime defenses and stricter permissions to manage AI risk.

🛡️ Amazon GuardDuty Runtime Monitoring now includes three new threat detections to alert teams when sensitive files are modified on Amazon EC2 instances and container workloads on Amazon EKS and Amazon ECS. These findings monitor critical system files such as configuration files, authentication settings, and system logs to surface post-compromise activity. The detections map to MITRE ATT&CK® tactics and provide remediation guidance while using correlation analysis to reduce false positives. The capability is available to customers with GuardDuty Runtime Monitoring enabled, with a 30-day trial for new users.

🛠️ This blog demonstrates using AI agents to automate a VB6 disassembler by exposing its parsed model through the Windows Running Object Table and providing an operator briefing plus auto-generated prototypes. The agent (Claude Code in the examples) binds to the COM object, runs scripts to extract P-code, reconstruct source, generate call graphs, and export function metadata to SQLite, all locally without uploading binaries. The approach decouples tool features from fixed menus, enables repeatable exhaustive analysis, and preserves sensitive data on the analyst's workstation.

🛡️ AI is reshaping cybersecurity by breaking the long-held assumption of predictable, deterministic systems. Traditional prevention-focused controls remain important but are insufficient as AI agents, LLMs and automated development accelerate runtime change and attacker capabilities. Organizations must prioritize runtime visibility, use AI to augment defensive operations, rebuild vulnerability management and emphasize resilience and containment to manage evolving AI-driven risks.

🛡️ This article explains why AI requires a unified security architecture — the AI Defense Plane — to discover, protect, govern, and assure AI behavior across employees, applications, and agents. It describes how AI becomes an execution layer that can retrieve data, call tools, and take actions, creating risks that traverse traditional security boundaries. The piece emphasizes runtime protection, coordinated enforcement, and continuous testing to prevent prompt-based attacks, data exposure, and unsafe agent behavior.

🛡️ Attackers are embedding AI-generated lookalike domains inside legitimate third-party scripts, transforming typosquatting from a user mistake into a browser-runtime threat that traditional controls miss. Firewalls, WAFs, EDR, and CSPs cannot observe what approved scripts do once executed, enabling silent exfiltration as in the Trust Wallet compromise. Effective detection needs runtime behavioral monitoring that traces script actions, network calls, and deviations from established baselines rather than relying on static vetting.

🔒 Cloudflare assessed and mitigated the Linux local privilege escalation named Copy Fail (CVE-2026-31431) following public disclosure on 2026-04-29. Our behavioral detections flagged the exploit chain within minutes during validation, and threat hunting across a 48-hour window found no evidence of compromise. We deployed an eBPF LSM allow-list (bpf-lsm) to block AF_ALG binds for non-allow-listed binaries, built and staged patched LTS kernels, and completed fleet protection via controlled reboots with no customer impact.

🛠 Cloudflare explains reliability improvements for Rust Workers that prevent panics and aborts from poisoning Wasm instances. They upstreamed fixes into wasm-bindgen, adding panic=unwind support via WebAssembly Exception Handling so Rust destructors run and instances remain reusable after a panic. They also implemented abort classification, an abort recovery hook, and an experimental --reset-state-function to reinitialize libraries without reimporting them. Users are encouraged to upgrade to workers-rs 0.8.0 and try the --panic-unwind flag for improved stability.

🔐 Cloudflare has added outbound Workers to its Sandboxes and Containers, providing programmable egress proxies that let sandboxed workloads connect, add observability, and perform safe authentication. Handlers such as outboundByHost and global outbound functions can inject headers, block requests, or log traffic without exposing secrets to the guest. The proxy runs locally beside the sandbox with minimal latency and integrates with platform bindings like KV and R2 for identity‑aware, dynamic controls.

🔒 CrowdStrike announced it is a founding member of Project Glasswing, partnering with Anthropic to secure execution of frontier models like Mythos Preview where they run inside enterprises. CrowdStrike emphasizes its sensor-level visibility across endpoints, real-time AI Detection and Response, and Falcon Data Security to govern data and agent behavior at runtime. The company frames deployment governance as distinct from model safety and highlights regulatory and operational requirements for enterprise adoption.