s4mw1se

CrowdStrike, Google, and Shadowserver disrupted GlassWorm command-and-control on 2026-05-26 after the campaign used Open VSX extensions, npm and Python packages, and poisoned GitHub repositories to maintain access to developer systems.

not a ebpf expert, just been on my radar lately because i’m going through a sysdig poc.

To me It feels more like a reverse proxy for intercepting traffic going between user land and kernel space.

As we move to k8s and classic EDR isn’t feasible i 100% understand the need. It still feels like a dumb thing humanity has done and will blow up in our face after having the kernel / user space security boundary beat into our heads for so long.

The price is no joke. Microsoft has a lot of really good security products locked behind a paywall that security vendors know they can beat. We were looking the price for sentinel the other day and holy shit it’s costly.

Three billion human lives ended on August 29, 1997. The survivors of the nuclear fire called the war Judgment Day. They lived only to face a new nightmare: the war against the Machines

I’m an AppSec engineer, and work with 300+ devs and Software Engineers. I’ve worked through start phase and two acquisitions. You spot on at this point in time. I’m on the team responsible for testing m365 copilot before it rolls out to our org. A month ago I would have agreed with you 100% but now i’m leaning more to theirs a 50% chance of large scale automation happening within 5 years.

What AI was missing is the larger business context. I doesn’t know the politics behind why things are the way they are and why fixing and issue might cost the company 50k every minute or if library is updated it would break 15 business critical products without proper coordination.

M365 Copilot is bridging that gap. Right now it’s dumb and only access what you can see on OneDrive and sharepoint. With plugins and connectors it’s going to integrate into every development platform sooner or later.

I still think it’s some years out and will require a lot of human interaction before these generalized agents can be onboarded.

It’s a security nightmare for me. We basically just automated the recon for any attacker that has compromised a 365 Account. In my opinion it’s moving to fast even when it’s dumb as bricks and has the context of a 2 year old.

I’ve been using it to compare static analysis findings and m365 copilot returns a lot of the same findings with mitigation suggestion. It’s still not 100% though, but either is any secuirty testing.

I give it two years before the grunt work is fully automated