Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On April 3, 2025, the National Security Agency and other partner agencies released a critical advisory about DNS and Fast Flux. They even called it a national security threat due to the potential dangers involved. In this article, we’ll go over what Fast Flux is and how Sysdig Secure detects this attack technique. We’ll also cover gathering potential Fast Flux domain names from VirusTotal.

The cloud has become the hub of modern data traffic. It offers organizations of all sizes unprecedented speed, flexibility, and countless collaboration options. However, cybercriminals also know how to exploit the power of the cloud for their own purposes, which is why proven security solutions—and service providers who can implement them quickly and in a customized manner—are in high demand.

It’s been just over a year since open source Falco graduated from the Cloud Native Computing Foundation (CNCF) during KubeCon EU 2024, and the momentum hasn’t slowed down. From advancements in real-time threat response and expanded audit event collection across cloud-native environments, to reaching 150 million downloads and even new open-source technologies like Stratoshark being built on Falco’s libraries, the project continues to evolve rapidly.

In the past year alone, the number of artificial intelligence (AI) packages running in workloads grew by almost 500%. Which is to say: AI is everywhere, and it’s settling in for the long haul. Naturally, as helpful as they are, these AI workloads come with security challenges, including data exposure, adversarial attacks, and model manipulation. So as AI adoption accelerates, security leaders must build an AI workload security program to protect their organizations while enabling innovation.

On Monday, March 24, 2025, a set of critical vulnerabilities affecting the admission controller component of the Ingress NGINX Controller for Kubernetes was announced. In total, five vulnerabilities were announced; the most severe vulnerability, CVE-2025-1974 (CVS 9.8), may result in remote code execution (RCE). Exploitation of this vulnerability can be detected with Sysdig Secure or the Falco rule provided in this article.

Effectively responding to cloud security incidents can be daunting for organizations expanding rapidly in the cloud. Whether you face a policy violation or an active threat, quick and reliable alerting and response are essential to keeping cloud services secure and available. For many organizations, Sysdig and PagerDuty each play a critical role in automating DevSecOps and helping modern IT operations and security teams respond effectively.

On March 14, 2025, StepSecurity uncovered a compromise in the popular GitHub Action tj-actions/changed-files. Tens of thousands of repositories use this action to track file changes, and it is now known to have been tampered with, posing a risk to both public and private projects. A CVE has been created for this issue: CVE-2025-30066.