Surviving cybersecurity until the end of 2026

What it is

Aikido's checklist for the rest of 2026 (the page is undated but refers to the Binance, LiteLLM, PHP2Shell, Node2Shell and eMudhra incidents). Its premise is that a laptop, vendor, package or CI runner will be compromised at some point, so the aim is to limit how far an attacker can get from there. The page says the gap between disclosure and exploitation is shrinking, and that exploits now follow disclosure within days. It gives no technical detail on any of the named incidents.

What to do

The summary names the six practices. The page's more specific controls, by horizon:

This week

• Search developer machines for cloud credentials, SSH keys, API tokens and .env files. The page says infostealers look first at plaintext tokens in .env files and shell history.
• Set a minimum package age (cooldown) of at least 48 hours on every package manager, including npm and PyPI. The stated reason is that most malicious packages are detected within a few hours. The page gives no per-tool config syntax.
• Block malware at install time with Aikido Safe Chain (the vendor's own product).
• Check what is reachable from the internet and take offline anything that does not need to be there.

This month

• Move production secrets off laptops into a secrets manager, and rotate any credentials found on developer machines.
• Remove unused or unmaintained dependencies, and build a vendor inventory covering apps, plugins, dependencies and services, with an owner for each.
• Remove local admin rights on user machines where feasible.
• Set auto-shutdown schedules for non-production compute.
• Store identity provider, cloud audit, source control and CI logs where production credentials cannot delete them.
• Set a patch target for critical internet-facing vulnerabilities, measured in hours or days.
• Run Aikido's AI Code Analysis on internet-facing code and on code that handles authentication or payments.

By end of 2026

• Deploy attack surface management across the estate.
• Run an external network pentest and book the next one for 2027.
• Run tabletop exercises that assume a breach through a compromised vendor, developer laptop, CI runner or package.
• Review all vendor and service inventories so every item has an owner going into 2027.

Other controls the page lists:

• Tag every resource with an owner and purpose, and enforce tagging by policy.
• Put internal tools behind a VPN or zero-trust access.
• List and revoke unused OAuth grants, GitHub Apps, personal access tokens and SaaS integrations.
• Block new IDE and browser extensions until approved, and keep an allowlist of common ones. The page cites a Vercel breach this year that started with a single browser extension.
• Inventory installed software on user machines, including MCP servers and AI tools.
• Use minimal or hardened container images, and mirror or fork libraries into an internal feed.
• Add vendor-breach scenarios to the incident response plan.

Caveats

The page is a vendor post, and several items promote Aikido products. It says Aikido blocked nearly 500 malware attacks in a single week but gives no method for that figure. It does not say how to implement most items, and the text includes the phrase "three-factor authentication" where it appears to mean two-factor, which it then discusses as 2FA with IP restrictions on GitHub.