Insights, tutorials, and updates on Kubernetes security, AppArmor, and container protection.
Critical CVEs, a hijacked release and three cloud platform breaches hit security teams between 19 and 25 October 2026. PHP2Shell and node2shell in detail, the rest of the week in brief, and how runtime context helps teams keep up.
Two critical flaws in the PHP engine, disclosed on 21 October 2026, allow unauthenticated remote code execution and memory disclosure on almost every PHP version since 5.4. In this advisory we look at what is affected, how to patch, and what an enforced AppArmor profile stops until every workload is patched.
A refreshed deep dive into where runtime security would have mattered in the OpenAI and Hugging Face incident, using the additional detail in OpenAI's technical report on its own infrastructure.
Since 11 September 2026, the Cyber Resilience Act's reporting obligations apply. What that means for engineering teams building custom software, whether SaaS or single-tenant, and three practical tips to get started.
Most organisations scan their images and stop there. Scanning is the first rung of a six-rung ladder, and every rung you climb is a question you can answer and a shorter CVE list. From the fifth rung up, the same data that shortened the list starts protecting production.
The July 2026 Hugging Face / OpenAI incident was driven end-to-end by an AI agent. We walk the RCE chain through the lens of runtime containment.
We are introducing a fully sovereign managed bifrost. You get the same product and the same ease of use, with all data processed on a Swedish-owned cloud, outside US jurisdiction. We start onboarding the first users this summer and scale further in the fall.
CISA moves federal vulnerability management off CVSS severity and onto real-world risk with new directive. We agree with that direction, and it mirrors how we think about CVEs: severity is one dimension among several, and runtime context is what narrows the list to the vulnerabilities that matter for your specific use.
bifrost security has raised SEK 6.7 million (about €600,000), anchored by Almi Invest, to accelerate commercialisation of its runtime security platform across the Nordics, and is launching a fully sovereign offering for the Swedish market with all data processed outside American jurisdiction.
Fragnesia (CVE-2026-46300) is the third universal Linux kernel LPE in the Dirty Frag class to land in under two weeks. It abuses the XFRM ESP-in-TCP path to write into the page cache of read-only files with no race condition, and ships with a one-line public exploit. For workloads running under a behaviour-generated AppArmor profile, the surface it needs was never in the allow list. This is the same non-event, a third time. Here's why, and how to confirm your exposure in seconds.
What actually changes for a security team once a runtime-driven platform meets the Cyber Resilience Act: a smaller backlog, self-generating evidence, a 24-hour reporting clock you can hit, and metrics that mean something to a board.
A recap of KCD Helsinki on 20 May 2026, the three concerns we kept hearing at the booth, and a thank you to the organisers.
Where a runtime-driven security platform fits the CRA's essential requirements, vulnerability handling obligations, and reporting timeline. Annex I, Article 13, and Article 14 walked clause by clause.
An introduction to the EU Cyber Resilience Act, focused on companies that ship SaaS or containerised software into customer environments.
Dirty Frag is a universal Linux kernel LPE that chains two CVEs, CVE-2026-43284 and CVE-2026-43500, explicitly designed to bypass the Copy Fail mitigation. For workloads running under a behaviour-generated AppArmor profile, neither variant's required surface was ever in the allow list. Here's why, and how to confirm your exposure in seconds.
Copy Fail (CVE-2026-31431) is a Linux kernel LPE that's already in CISA KEV and reaches every container that inherits the AF_ALG kernel surface by default. For workloads running under a behaviour-generated AppArmor profile, the exploit's required syscall path was never allowed in the first place. Here's why, and how to confirm your exposure in seconds.
March 2026 saw five major supply chain attacks in twelve days. Map the kill chain behind the Trivy → LiteLLM cascade and the Axios npm compromise, then deploy five tactical defences that break the attack progression before it reaches your systems.
On April 22, 2026, @bitwarden/cli@2026.4.0 was published with a credential-stealing payload — via a GitHub Action that was itself compromised in the Checkmarx breach a month earlier. The cascade is not a metaphor; it is the mechanism. Why supply chain velocity is outpacing upstream defences, and why runtime enforcement is the only surface attackers cannot bypass.
In March 2026, the threat actor TeamPCP compromised Trivy, KICS, and LiteLLM — turning trusted security tools into credential stealers across thousands of CI/CD pipelines. We break down how the attacks cascaded, why traditional defences failed, and how tailored AppArmor profiles enforce runtime protection that stops compromised components regardless of how they were infected.
Qualys disclosed nine vulnerabilities in Linux's AppArmor module, collectively named CrackArmor, affecting every distribution shipping AppArmor by default. We break down what this means for managed Kubernetes workloads, assess the real exploitability, and outline what you should do now.
Modern container environments move fast, and so do attackers. Traditional security approaches based on signature matching or static detection rules are...
Modern container environments move fast, and so do attackers. Traditional security approaches based on signature matching or static detection rules are...
As NIS2 has become law in Sweden, we continue to explore the impact it will have on software engineering teams....
The EU’s NIS2 Directive is reshaping cybersecurity expectations for digital infrastructure and SaaS providers. While traditional tools overwhelm teams with...
The shift from virtual machines to containers and Kubernetes fundamentally changed how software is built, shipped, and operated. Infrastructure became...
The Cyber Resilience Act (CRA) is the EU’s new baseline for secure-by-design software and hardware. Any product with digital elements sold in the EU — from...
Linux sits at the heart of modern infrastructure: cloud platforms, edge devices, containers, and everything in between. With so much at stake, security can’t...
We’re proud to share that a consortium led by bifrost and Lund University has been selected to lead a new Vinnova-funded initiative to strengthen runtime...
**When your container runtime is the target** RunC sits at the heart of nearly every container platform, from Docker and containerd to Kubernetes nodes. This...
Hallucinated dependencies become a vulnerability when attackers exploit common package names generated by AI models. This is called slopsquatting, and it is a...
Alerts are pouring in. Your team’s stretched. And the critical signal is buried in noise.Bifrost flips the model: we understand each service’s legit runtime...
Here’s how your company can cut costs without compromising on security by using bifrost:⚙️Automate manual processes⚠️Prevent costly breaches️Protect the...
The EU’s NIS2 Directive is raising the bar for cybersecurity across Europe. From digital infrastructure to SaaS platforms, companies now face strict...
AppArmor is a mandatory access control (MAC) Security Module that restricts the capabilities and permissions of a containerised workload. The permissions are...
Let’s break down how bifrost supports key roles in modern software teams and how each can benefit from smarter, automated security!...
Europe relies heavily on foreign tech giants, the issue of digital sovereignty has become more crucial than ever. It’s not just about where your servers are...
As a driving force behind innovation across nearly every industry, AI tools have revolutionised the software development landscape. In cybersecurity, AI brings...
Are you confident that every dependency in your codebase is secure? That quick-fix plugin four years ago that somehow became permanent? As the usage of...
We know there’s plenty of security tools out there. But bifrost is built to do more than just alert you. It protects you automatically, from testing to...
Are you sure that your security controls are adequate in practice, not just on paper? Every day, companies spend money on tools, policies, and processes that...
Security should work with you, not against you. With bifrost, you can integrate in seconds, gain insights in minutes, and secure every release, all without...
AI-generated code is quickly becoming a central part of modern software development. These AI agents can write, test, and deploy code with minimal human input,...
As the summer winds down and routines pick up again, it’s time to dive into the second half of the year. Here at bifrost we're recharged and ready to help you...
As summer rolls in, it’s time to take a break and recharge our batteries. We’re grateful for everything we’ve accomplished together this spring! Last week we...
The Cyber Resilience Act (CRA) is a new EU regulation that works to improve cybersecurity by establishing standards for products with digital elements sold...
Stop firefighting security threats and focus on what matters, building and shipping innovative products. bifrost automates security, empowering developers,...
As financial services become increasingly tech-driven, the risks associated with digital systems also grow. Cyberattacks, system failures, and data breaches...
The evolution of HR Technology is transforming how organisations attract, retain, and engage talent. As workforce expectations shift and hybrid models become...
You’ve written the policies. You’ve stored the logs. But are you confident that your security controls are working in practice, or just on paper?...
Linux powers everything from cloud servers to smart devices. With so much depending on it, robust security is a must, and that’s where Linux Security Modules...
Last week bifrost attended SecurityFest in Gothenburg! It was two days filled with interesting talks, hallway meetups, fun CTFs, lock-picking, and even some...
bifrost integrates in seconds, learns in minutes, and protects at your next release. Just four lines of annotations, that’s all it takes to enable bifrost. No...
We’re excited to announce our latest partnership with Mint Security Mint Security is a Finnish security consultancy with deep expertise in secure software...
As Kubernetes continues to dominate container orchestration, securing your clusters is more critical than ever. While its flexibility and scalability make it a...
On June 4th and 5th, bifrost security will attend Security Fest in Gothenburg. We look forward to connecting with fellow cybersecurity enthusiasts and...
Did you know the UK online gambling market generated over £15 billion in 2023? As the industry grows, so do the security challenges it faces. In the fast-paced...
Shipping fast is a non-negotiable, but every new service, dependency, and release widens the attack surface. Security is supposed to be integrated, but most...
In a week bifrost security is co-hosting an evening with **QA.tech** and ** Netlight** to explore how DevOps and DevSecOps teams are using AI to deliver...
The bifrost team has arrived in Finland and we're excited to be at **KCD Helsinki** Attending the event? Swing by our booth or catch us during a coffee break,...
We’re committed to building a safer Kubernetes ecosystem, where runtime security is proactive, continuous, and automated, not an afterthought. It’s a vision we...
**For DevOps ⚙️** We get it, DevOps is all about speed, reliability, and efficiency. But security? It often feels like an afterthought. Traditional security...
Linux powers everything from cloud servers to smart devices. With so much depending on it, robust security is a must — and that’s where **Linux Security...
From mobile transfers and electronic payments to cryptocurrency trading, the fintech industry is improving the efficiency and convenience of the financial...
Exciting News! Kubernetes Community Days is coming to Helsinki! 🇫🇮 bifrost security is proud to be a Gold Sponsor of the @Helsinki Kubernetes Community Days,...
In software management, visibility is significant for understanding and improving performance. Bifrost offers insights into your software’s behaviour, providing...
Sweden’s top network for IT security professionals is hosting an exciting session with the @bifrost team**. ** The session will explore how behavioural...
With rising cybersecurity threats, increasing legal scrutiny and the introduction of security regulations, CISOs are under significant pressure. In the annual...
bifrost’s service leverages AppArmor, a Linux Security Module, to protect applications. But how does AppArmor work to protect your software? Let’s take a...
The rise of RegTech is reshaping how businesses manage compliance and risk. As regulatory demands grow, more companies turn to RegTech providers to streamline...
Streamlining setup and simplifying access management of software services can significantly reduce the administration of many development teams. Our service is...
Over the last decade, software, cloud computing and AI have increasingly been incorporated into healthcare. This has caused healthcare to move to online...
Kubernetes providers make life easier for developers everywhere, especially for those of us wanting to use Kubernetes without the hassle of creating and...
We are thrilled to have been a part of the Cybersecurity Startup Expo, where innovation meets security! Yesterday, our CEO and Co-founder, Hannes Ullman,...
Many organisations find it challenging to effectively protect their containerised applications in a world of complex cloud security. bifrost is designed with...
A big thank you to everyone who joined Simplify and Secure – The Future of Infrastructure and DevOps event at Norrsken House! It was great to see the...
A comprehensive guide to securing your Kubernetes clusters in 2025, covering network policies, RBAC, secrets management, and runtime protection.
As 2024 has come to an end, we take a look back at last year's Kubernetes environment. In a recent study by Redhat, insights from 600 professionals across...
Join us at Simplify and Secure: The Future of Infrastructure and DevOps, the first event by @Platform Engineers Stockholm. Together, we’ll explore how to...
A deep dive into AppArmor, the Linux Security Module that powers Bifrost's container protection, and how it provides mandatory access control for your workloads.
As the new year begins, we’re thrilled to be back in the office to see what 2025 has in store. At bifrost security, our mission is clear: help DevOps teams...
**Join us at the 1st Annual Cybersecurity Startup Expo 2025** As the Cybersecurity Startup Expo 2025 approaches, we’re thrilled to see our Co-founder & CEO,...
In the report “Protecting the Cloud Native Enterprise: Build the Foundation to Secure Your Containers in Runtime” by @Aqua, 90% of global organisations are...
The Cloud Native Community Group - Meet up is approaching ☁️ bifrost’s very own CEO and Co-founder @Hannes Ullman is a speaker at the event. Don't miss out on...
We’re excited to introduce our CTO and co-founder, Konrad Eriksson. With his background in cybersecurity, Konrad is leading the technological breakthroughs of...
We are excited to announce that bifrost has been accepted into the @Creative Destruction Lab (CDL)! On Monday, bifrost and one of its co-founders, @Hannes,...
In the wake of the ongoing global transformation, cybersecurity's challenges have taken on new dimensions. The COVID-19 pandemic has accelerated changes,...
We are thrilled to announce that @Hannes Ullman, CEO and Co-Founder of Bifrost Security, will be speaking at the Stockholm @Cloud Native Community Group -...
On November 19 and 20, bifrost security will attend the second annual @Kubernetes Community Days in Copenhagen, supported by the @Cloud Native Computing...
Next week, bifrost’s last webinar of the fall will take place. Date: 14/11 Topic: Contain Containers: An Introduction to Tailored Runtime Security Time:...
We’re sitting down with **Hannes Ullman**, CEO and co-founder of bifrost security. With his background in tech and startups, Hannes shares insights into...
Did you know 86% of organisations have known vulnerabilities deployed in their software? In many cloud attack incidents, intruders access data and disturb...
This week ItSec Insights announced bifrost’s very own CEO and Co-founder @Hannes will be one of the speakers at the Cybersecurity Startup Expo. The event will...
Calling All Master Students! bifrost security is looking for talented students interested in completing their master's thesis with us! **Possible areas of...
Cyber security breaches have been projected to cost 8 trillion USD a year in damages. Comparable to the world's third-largest economy, following the US and...
bifrost attended the ONE Conference in the Hague last week. We participated in great discussions and presentations. Here are our key takeaways from the event...
Kubernetes providers make life easier for developers everywhere, especially for those of us wanting to use Kubernetes without the hassle of creating and...
Today marks the start of the ONE Conference in The Hague! 🇳🇱 bifrost’s Hannes and Konrad have arrived in the Netherlands and are eager to discuss recent...
Today we celebrate the newest release of Talos Linux! Talos Linux is Linux reimagined for the kubernetes world. It is designed from the ground up with a...
We also want to introduce Tobia Righi, our software development intern who joined us this summer. In the following Q&A, dive into Tobia’s experience with us...
Exciting News! This week, the Nordic Software Security Summit will be held in Stockholm on September 23rd and 24th. Industry professionals will gather to...
Touchdown in London! ✈️ @Hannes and @Konrad from bifrost security are attending TalosCon today. We share their security focus and are happy to have contributed...
Ensuring your containers and software are adequately protected is essential for any organisation. However, navigating the jungle of container security is quite...
As summer is over and September has begun, we’d like to introduce our summer interns who have spent the last few weeks with us at bifrost. Meet Alva Granljung,...
In 2024, the need to secure your software supply chains has become more evident than ever. A recent Software Supply Chain Security (SSCS) report by Checkmarx...
bifrost security invites you to a virtual roundtable discussion this fall focused on the latest trends and strategies in container security. During the...
The growing landscape of cloud computing has revolutionised the way modern applications are built. Bringing a wave of agility, automation, and innovation....
Meet Hannes Ullman and Andreas Stjernström at the Nordic Software Summit by Monterro. We are happy to support the SaaS industry with tailored, continuous, and...
Join Our Fall Webinar Series! bifrost security is excited to announce three upcoming webinars this fall, designed to keep you aware in the ever-evolving world...
As we return from summer vacation and dive back into our routines, we’re excited to share some of the recent highlights from bifrost security. Here’s a glimpse...
bifrost security, a research spin-off from Lund University focusing on automating runtime security for cloud software, announced today the successful closure...
bifrost security's co-founders, Hannes and Konrad, are set to make a splash at Slush in Helsinki this week. bifrost has been gaining attention for its...
We have a new brand identity!...
We are thrilled to be among the top 50 startups at SLUSH 2023...
Quritis is delighted to be among the top 100 startups at SLUSH 2023!...
Quritis has raised a angel round of a total of 3 MSEK. The money will fund dev team expansion and further steps in commercialising the core technology...
Breakdowns of major vulnerabilities and breaches, and runtime security thinking from the bifrost team. About twice a month.