Loading story…
Security teams are increasingly challenged by the limitations of traditional tools such as WAFs, EDRs, and SIEMs, which often fail to detect sophisticated attacks that occur within the application runtime. Recent research highlights that while organizations face thousands of attack attempts monthly, a small but significant number—approximately 81 per month—successfully target exploitable vulnerabilities inside applications, bypassing conventional defenses. These attacks, including untrusted deserialization, method tampering, and various injection techniques, exploit the logic of applications and remain largely invisible to perimeter and endpoint security solutions, underscoring the need for enhanced runtime visibility.
To address this critical blind spot, advancements in open source tools like Falco and Stratoshark are enabling security teams to bridge the gap between real-time detection and deep forensic analysis in containerized and Kubernetes environments. Falco’s new automated forensic capture capabilities, combined with Stratoshark’s deep investigation features, allow teams to quickly respond to suspicious activity and conduct thorough investigations without relying on disparate or slow traditional forensic tools. This integrated approach empowers organizations to act swiftly and confidently when runtime threats are detected, significantly improving their ability to identify and mitigate attacks that would otherwise go unnoticed.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Resilient Cyber published an article describing the evolution of application security from 'shifting left' toward greater emphasis on runtime security. The piece characterizes runtime as an emerging focal point for modern AppSec strategy.
Contrast Security published a blog post on application attack patterns and attack graphs, arguing that existing tools miss many threats because of gaps in runtime visibility. The article presents runtime-focused analysis as necessary to detect overlooked application attacks.
Sysdig published a blog post describing how Falco and Stratoshark can bridge open-source runtime detection with deeper forensic analysis. The post frames runtime visibility and post-incident investigation as a combined security workflow.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
resilientcyber.io
Open sourcecontrastsecurity.com
Open sourcesysdig.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security teams continue to face elevated risk from **network edge device vulnerabilities** and legacy/slow-to-patch infrastructure, with threat actors actively exploiting exposed perimeter systems and benefiting from limited vendor cooperation and uneven firmware update practices. Discussion also highlighted defensive approaches aimed at improving early warning and containment—particularly stronger monitoring/detection around edge assets and the use of deception mechanisms such as **canary tokens** to surface exploitation attempts sooner. Separately, security operations practitioners are emphasizing that many organizations are effectively **“flying blind”** due to incomplete or provider-controlled logging in cloud/SaaS environments, which can undermine detection engineering and incident response when platforms change telemetry or access patterns. The coverage also pointed to emerging efforts to benchmark **LLMs for defensive SecOps workflows** and shared practitioner perspectives on how large platforms (e.g., Reddit) approach threat detection, reinforcing that visibility and measurable detection capability are central constraints even when tooling and automation improve.
Jun 29, 2026
Organizations are facing a rapidly evolving threat landscape, with attackers increasingly leveraging stealthy techniques such as living-off-the-land, supply chain compromises, and edge device exploitation to bypass hardened traditional defenses. Security leaders are responding by adopting exposure-first strategies, improving telemetry, and focusing on proactive measures to reduce attack surfaces. The importance of understanding and managing what is visible to attackers, including third-party and supply chain exposures, is emphasized as a critical step in slowing adversaries and building resilience. Additionally, the shift toward edge computing, cloud adoption, and the proliferation of IoT devices are driving the need for unified, adaptive security frameworks that can protect data and operations across diverse environments. Security operations centers (SOCs) are being urged to improve the quality of their data inputs and adopt holistic, triathlon-like training approaches to enhance readiness, consistency, and endurance in defense. Endpoint detection and response (EDR) is recognized as necessary but insufficient on its own, with proactive exposure management and comprehensive edge-to-cloud strategies becoming essential. The integration of AI, the need for strong evidence retention, and the importance of collaboration across the industry are highlighted as key factors in staying ahead of threat actors. These trends underscore the necessity for organizations to rethink their security architectures and operational practices to address both current and emerging cyber risks effectively.
Jun 29, 2026
Application security posture management (ASPM) platforms are increasingly promoted as comprehensive solutions for managing application security, promising to reduce tool sprawl and provide broad code-scanning capabilities. However, experts highlight that ASPM platforms, which primarily rely on traditional code-scanning methods, have significant limitations in detecting and mitigating modern threats such as sophisticated malware embedded in software supply chains. While code scanning remains a critical component of secure application development, enabling teams to identify vulnerabilities, bugs, and misconfigurations early in the software development lifecycle, it is not sufficient to address all security risks. Static analysis tools, which form the backbone of most code scanning solutions, are effective at uncovering issues like SQL injection, cross-site scripting, buffer overflows, and hardcoded secrets, but they often miss threats that are intentionally hidden or obfuscated by attackers. The evolution of attack vectors since high-profile incidents like the SolarWinds Orion compromise has demonstrated that attackers are increasingly targeting the software supply chain, injecting malicious code that can evade traditional scanning techniques. Experts argue that malware is fundamentally different from accidental code vulnerabilities, as it involves deliberate manipulation by adversaries rather than coding mistakes. To effectively counter these advanced threats, organizations must supplement ASPM and code scanning with additional controls such as binary analysis and reproducible build techniques, which can verify the integrity of code and detect unauthorized modifications. Secure code scanning, when integrated into the software development lifecycle, helps reduce the risk of security incidents by enabling early detection and remediation of vulnerabilities. However, without enhancements that address the detection of sophisticated malware and supply chain attacks, organizations remain exposed to risks that traditional scanning cannot mitigate. The need for modern software supply chain security controls is underscored by the increasing prevalence of attacks that exploit weaknesses in dependencies and third-party components. Security teams are encouraged to adopt a layered approach, combining code scanning with advanced analysis tools and supply chain security practices to achieve a more robust application security posture. The integration of these techniques is essential for organizations seeking to protect against both accidental vulnerabilities and intentional, stealthy threats. As the threat landscape evolves, reliance on code scanning alone is insufficient, and a holistic approach to application security is required. The effectiveness of ASPM platforms is thus contingent on their ability to incorporate modern security controls that go beyond traditional scanning. Organizations must remain vigilant and continuously update their security practices to address emerging threats in the software development ecosystem. The adoption of advanced AppSec tooling is not just a best practice but a necessity in the face of increasingly sophisticated adversaries. Ultimately, the combination of secure code scanning, binary analysis, and supply chain security controls forms the foundation of a modern, effective application security strategy.
Jun 29, 2026