Stream.Security

Security teams are drowning in cloud alerts, digging through logs, and chasing context manually. It’s a grind - and it doesn’t scale. Stream fixes that!

[Stream.Security @StreamSecurity]

https://t.co/XO4v0aUQwI is expanding beyond cloud-native environments.

👉🔗 https://t.co/RwGsH9vv6z

#CloudSecurity #HybridCloud #VMware #CDR

[Stream.Security @StreamSecurity]

This is the second major supply chain attack in a week. Our Threat Research Team breaks down what happens after the malware runs, and why IOC-first detection fails this class of attack entirely.

https://t.co/rbdN8Dj0Uh

[Stream.Security @StreamSecurity]

⁉️ But the real question is: did your SOC catch the compromise in time, before the first IOC dropped?

[Stream.Security @StreamSecurity]

⚠️ axios was compromised. If you write JavaScript, you've used it, it's the HTTP client in virtually every Node.js application, with 60M+ weekly downloads.

~2-3 hours of exposure.

[Stream.Security @StreamSecurity]

Full IOCs, TTPs, and detection guidance here: https://t.co/4M4TZ23Nyf

[Stream.Security @StreamSecurity]

WHAT YOU NEED TO KNOW - LiteLLM Supply Chain Attack 🚨

Our Threat Research team is analyzing a cascading supply chain attack, TeamPCP, that crossed five ecosystems in under a week. The next stage is unfolding now (analysis coming soon).

[Stream.Security @StreamSecurity]

Hunt for sysmon.service, https://t.co/MB4j69bkQh, /tmp/pglog, and node-setup-* pods. Block models.litellm[.]cloud and checkmarx[.] zone at DNS now. Part 2 of our analysis coming shortly on [email protected].

[Stream.Security @StreamSecurity]

@InvestiAnalyst Thanks for the mention, @InvestiAnalyst! With the force of AI at play, our biggest defense is architecture, not time. That's why the CloudTwin is so critical to any defense in the cloud.

[Francis @InvestiAnalyst]

In 2026, Cloud Security CNAPP and posture are dead. One vendor won that market. We need to focus on what is next. We believe the next big opportunity lies in cloud runtime / CDR.

Most cloud security stacks still rely on snapshots:

• CNAPP shows what was misconfigured
• SIEM shows what happened
• EDR shows what was executed

But breakout times are now measured in minutes. Cloud environments change constantly. Stateless data from hours ago is no longer defensible.

We’re seeing early adopters move toward a Cloud Twin architecture: a continuously updated, stateful model of identities, configurations, network reachability, and exposure in near real time.

This shifts detection from log correlation to state-based reasoning and lets SOC teams prioritize alerts based on actual exploitability.

Aqsa Taylor just published a case study on how @StreamSecurity applies this model to close the CDR gap without replacing CNAPP, SIEM, or EDR.

Full report here: https://t.co/gIs9uS25hy

[Stream.Security @StreamSecurity]

Full breakdown from our Principal Security Researcher Petr Zuzanov 👇 https://t.co/Km4qGxwuua

[Stream.Security @StreamSecurity]

THIS KUBERNETES API CALL CAN HAND ATTACKERS YOUR ENTIRE CLUSTER (& you probably aren't watching it).
@GrahamHelton3's latest research shows how nodes/proxy GET can be abused to run arbitrary commands in every pod, enable trivial pod breakout, and leave no meaningful audit trail.

[Stream.Security @StreamSecurity]

Without real-time Kubernetes and cloud state, this attack path is basically invisible.

This is exactly the class of control-plane abuse Stream is built to detect by continuously modeling live permissions, access paths, and impact as they change.

[Stream.Security @StreamSecurity]

Register for the workshop to see if your team has what it takes to detect & respond in the ☁️

🔗 https://t.co/MjvwfHrDbO

[Stream.Security @StreamSecurity]

Live Workshop with @latiotech on Dec 9th 📅

Cloud incidents are getting faster and harder to untangle. (cc: Sha1-Hulud 2.0) 🪱

Does your team have what it takes to respond effectively?

[Stream.Security @StreamSecurity]

If your team wants a sharper, repeatable response workflow, this workshop is worth the hour. Stream's CPO @stavsitni and Latio's Founder @JamesBerthoty will take us step-by-step through a live cloud incident.

[Stream.Security @StreamSecurity]

Here's the deep dive into how we investigated the Shai-Hulud 2.0-style attack we created: https://t.co/jPVic0uQ1q

[Stream.Security @StreamSecurity]

We put Stream’s detection and investigation capabilities to the test using a scenario modeled after the recent Shai-Hulud 2.0 supply-chain attack. 🪱

[Stream.Security @StreamSecurity]

Stream's users don't have to wait for signature database updates to detect zero-day attacks. Do you?