🧰 Falco

The items that name it 11

• Machine speed, hold the AI: hand-rolled marimo CVE-2026-39987 exploit
  writeup2026-09-11

  Open source runtime security tool; Falco Feeds extends it with expert-written, continuously updated rules.

• From Container Escape to Cloud Takeover
  writeup2026-07-26It is written here as Falco (runtime detection of nsenter, /proc/1/ns access and kube-apiserver manifest deletion).

  runtime detection of nsenter, /proc/1/ns access and kube-apiserver manifest deletion

• prempti
  repo2026-07-04

  Rule engine (nodriver mode) underlying Prempti; evaluates YAML rules against intercepted tool-call events; also referenced for kernel-level instrumentation (eBPF/kmod) as deeper visibility tool on Linux

• Orca: 8 Container Security Best Practices for 2026
  article2026-06-11It is written here as Falco (runtime threat detection using kernel events, plugins and rules).

  runtime threat detection using kernel events, plugins and rules

• cicd-sensor: eBPF Runtime Security for CI/CD Pipelines
  repo2026-06-04

  open-source runtime security defender, cited as comparison for other runtimes

• Socket: GemStuffer Campaign
  writeup2026-05-13

  Runtime security/eBPF-based syscall monitoring tool recommended to detect abnormal ENV['HOME'] mutation to /tmp paths.

• Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 Hours | Sysdig
  writeup2026-04-09

  Runtime security tool; Falco Feeds extends it with expert-written detection rules continuously updated as new threats are discovered.

• cks/tasks/cks/course/README.md at master · ViktorUJ/cks
  courseIt is written here as Falco (runtime behavioral analysis and threat detection).

  runtime behavioral analysis and threat detection

• AWS EKS forensics: data sources and investigation tooling (Synacktiv)
  article

  Third-party runtime security solution improving in-container visibility (mentioned as out of scope for this article)

• AWS EKS Forensics: Data Sources and Investigation Tooling
  article

  Third-party runtime security solution improving in-container visibility (noted as out of scope for this article)

• 0x4m4/hexstrike-ai
  repo

  Runtime security monitoring for containers and Kubernetes