Hardened Containers Made Simple
Secure Your Containers Without Risky Upgrades
Aikido already scans your containers and auto-fixes vulnerabilities. Now with Root.io, we provide hardened, safe-by-default base images for advanced base image security.
- Same image, safer
- Fix unpatched CVEs
- No breaking changes
Fix Unpatchable Base Image Vulnerabilities
Upgrading to a newer base image can break builds, introduce runtime bugs, or require days of testing — and some CVEs don’t even have upstream fixes.
That’s where hardened images come in.
When Aikido detects a critical or high-severity CVE in your base image that can’t be fixed by upgrading safely, AutoFix will now suggest a hardened alternative: fully patched by Root.io, as drop-in replacements.
.png)
Why This Matters:
- Stay on your current base image
- Fix critical CVEs even if upstream maintainers haven't
- Avoid breaking changes and retesting cycles
- Automatically receive a PR through Aikido’s AutoFix
Built into Your Existing Workflow
Aikido AutoFix works directly in your set up. No new tools, no extra infrastructure.
Just smarter, safer images— automatically.
Use keyboard
to navigate through articles

By
Nicholas Thomson
What MDM can't protect on developer machines (and what to do about it)
Guides & Best Practices
May 28, 2026
Read more

By

Charlie Eriksen
Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens
Vulnerabilities & Threats
May 27, 2026
Read more

By

Aleks Frelas
Aikido vs XBOW: 58% more vulnerabilities found in independent benchmark
News
May 27, 2026
Read more

By

Sooraj Shah
Why developer machines are now the number one target for supply chain attacks
News
May 26, 2026
Read more

By

Ilyas Makari
Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer
Vulnerabilities & Threats
May 23, 2026
Read more

By

Raphael Silva
The Wild West of VS Code extensions and how a poisoned extension breached GitHub
Vulnerabilities & Threats
May 20, 2026
Read more

By
.png)
Shaun Brown
GitHub breached via a malicious VS Code extension: why developer devices are the real target
Vulnerabilities & Threats
May 20, 2026
Read more

By

Raphael Silva
Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again!
Vulnerabilities & Threats
May 19, 2026
Read more
.png)
By

Sooraj Shah
Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages
Vulnerabilities & Threats
May 19, 2026
Read more

By
.png)
Dimitris Mostrous
One year of Opengrep: What we built and what’s next
Product & Company Updates
May 12, 2026
Read more

By

Raphael Silva
Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack
Vulnerabilities & Threats
May 12, 2026
Read more
.png)
By
.png)
Mike Wilkes
Rolling out developer security in a 5,000+ engineer organization
Guides & Best Practices
May 6, 2026
Read more

By
.png)
Mike Wilkes
Security metamorphosis: a Mythos-ready architecture checklist for autonomous AI attacks
Guides & Best Practices
May 5, 2026
Read more

By

Ilyas Makari
Popular PyTorch Lightning Package Compromised by Mini Shai-Hulud
Vulnerabilities & Threats
April 30, 2026
Read more

By

Michiel Denis
Aikido integrates with AWS Kiro: Catching in review doesn't scale anymore
Product & Company Updates
April 30, 2026
Read more

By

Dania Durnas
A practical CTO security checklist to be Mythos-ready
Guides & Best Practices
April 30, 2026
Read more

By

Raphael Silva
Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer
Vulnerabilities & Threats
April 29, 2026
Read more

By

Charlie Eriksen
Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files
Vulnerabilities & Threats
April 29, 2026
Read more
.png)
By

Dania Durnas
It's time to treat browser extensions like supply chain attack vectors
Vulnerabilities & Threats
April 25, 2026
Read more

By

Ilyas Makari
Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm
Vulnerabilities & Threats
April 23, 2026
Read more

By

Ilyas Makari
GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays
Vulnerabilities & Threats
April 22, 2026
Read more

By
.jpg)
Madeline Lawrence
Introducing Device Protection: Security for Developer Devices
Product & Company Updates
April 20, 2026
Read more

By

Jorian Woltjer
Multiple Cross-Site Scripting (XSS) Vulnerabilities in Mailcow
Vulnerabilities & Threats
April 17, 2026
Read more

By

Mackenzie Jackson
Axios CVE-2026-40175: a critical bug that’s… not exploitable
Vulnerabilities & Threats
April 14, 2026
Read more

By

Ilyas Makari
GlassWorm goes native: New Zig dropper infects every IDE on your machine
Vulnerabilities & Threats
April 8, 2026
Read more

By

Robbe Verwilghen
Aikido Attack finds multiple 0-days in Hoppscotch
Vulnerabilities & Threats
April 8, 2026
Read more

By

Sooraj Shah
The cybersecurity doomerism around Mythos doesn't match what we see on the ground
News
April 6, 2026
Read more

By
.jpg)
Madeline Lawrence
axios compromised on npm: maintainer account hijacked, RAT deployed
Vulnerabilities & Threats
March 30, 2026
Read more

By

Charlie Eriksen
Popular telnyx package compromised on PyPI by TeamPCP
Vulnerabilities & Threats
March 27, 2026
Read more

By

Charlie Eriksen
CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran
Vulnerabilities & Threats
March 22, 2026
Read more

By

Charlie Eriksen
TeamPCP deploys CanisterWorm on NPM following Trivy compromise
Vulnerabilities & Threats
March 20, 2026
Read more

By

Sooraj Shah
Security testing is validating software that no longer exists
Guides & Best Practices
March 19, 2026
Read more

By

Michiel Denis
Aikido Recognized by Frost & Sullivan with the 2026 Customer Value Leadership Award in ASPM
News
March 19, 2026
Read more

By

Ilyas Makari
GlassWorm Hides a RAT Inside a Malicious Chrome Extension
Vulnerabilities & Threats
March 18, 2026
Read more

By

Raphael Silva
fast-draft Open VSX Extension Compromised by BlokTrooper
Vulnerabilities & Threats
March 18, 2026
Read more

By

Raphael Silva
Glassworm Strikes Popular React Native Phone Number Packages
Vulnerabilities & Threats
March 16, 2026
Read more

By

Ilyas Makari
Glassworm Is Back: A New Wave of Invisible Unicode Attacks Hits Hundreds of Repositories
Vulnerabilities & Threats
March 13, 2026
Read more

By

Dania Durnas
How Security Teams Fight Back Against AI-Powered Hackers
Vulnerabilities & Threats
March 12, 2026
Read more

By

Zach Rice
Introducing Betterleaks, an open source secrets scanner by the author of Gitleaks
Product & Company Updates
March 12, 2026
Read more

By

Zach Rice
Rare Not Random: Using Token Efficiency for Secrets Scanning
Guides & Best Practices
March 3, 2026
Read more

By

Robbe Verwilghen
Persistent XSS/RCE using WebSockets in Storybook’s dev server
Vulnerabilities & Threats
March 3, 2026
Read more

By
.jpg)
Madeline Lawrence
Introducing Aikido Infinite: A new model of self-securing software
Product & Company Updates
February 26, 2026
Read more

By

Sooraj Shah
How Aikido secures AI pentesting agents by design
Product & Company Updates
February 24, 2026
Read more

By

Jorian Woltjer
Astro Full-Read SSRF via Host Header Injection
Vulnerabilities & Threats
February 23, 2026
Read more

By
.png)
Mike Wilkes
How to Get Your Board to Care About Security (Before a Breach Forces the Issue)
Guides
February 23, 2026
Read more

By

Dania Durnas
What is Slopsquatting? The AI Package Hallucination Attack Already Happening
Guides & Best Practices
February 20, 2026
Read more

By

Jorian Woltjer
SvelteSpill: A Cache Deception Bug in SvelteKit + Vercel
Vulnerabilities & Threats
February 19, 2026
Read more

By

Sooraj Shah
Aikido recognized as Platform Leader in Latio Tech's 2026 Application Security Report
News
February 17, 2026
Read more

By

Hans Ott
From detection to prevention: How Zen stops IDOR vulnerabilities at runtime
Product & Company Updates
February 16, 2026
Read more

By

Ilyas Makari
npm backdoor lets hackers hijack gambling outcomes
Vulnerabilities & Threats
February 16, 2026
Read more

By

Sooraj Shah
Introducing Upgrade Impact Analysis: When breaking changes actually matter to your code
Product & Company Updates
February 13, 2026
Read more

By

Sooraj Shah
Claude Opus 4.6 found 500 vulnerabilities. What does this change for software security?
News
February 11, 2026
Read more

By

Trusha Sharma
Introducing Aikido Expansion Packs: Safer defaults inside the IDE
Product & Company Updates
February 10, 2026
Read more

By

Dania Durnas
International AI Safety Report 2026: What It Means for Autonomous AI Systems
News
February 9, 2026
Read more

By

Charlie Eriksen
npx Confusion: Packages That Forgot to Claim Their Own Name
Vulnerabilities & Threats
February 4, 2026
Read more

By

Trusha Sharma
Introducing Aikido Package Health: a Better Way to Trust Your Dependencies
Product & Company Updates
February 3, 2026
Read more

By

Sooraj Shah
AI Pentesting: Minimum Safety Requirements for Security Testing
Guides & Best Practices
February 3, 2026
Read more
-1.png)
By
Divine Odazie
Secure SDLC for Engineering Teams (+ Checklist)
Guides & Best Practices
February 2, 2026
Read more

By

Charlie Eriksen
Fake Clawdbot VS Code Extension Installs ScreenConnect RAT
Vulnerabilities & Threats
January 27, 2026
Read more

By

Charlie Eriksen
G_Wagon: npm Package Deploys Python Stealer Targeting 100+ Crypto Wallets
Vulnerabilities & Threats
January 23, 2026
Read more

By

Charlie Eriksen
Gone Phishin': npm Packages Serving Custom Credential Harvesting Pages
Vulnerabilities & Threats
January 23, 2026
Read more

By

Charlie Eriksen
Malicious PyPI Packages spellcheckpy and spellcheckerpy Deliver Python RAT
Vulnerabilities & Threats
January 23, 2026
Read more

By

Charlie Eriksen
Agent Skills Are Spreading Hallucinated npx Commands
Vulnerabilities & Threats
January 21, 2026
Read more

By

Mackenzie Jackson
Understanding Open-Source License Risk in Modern Software
Guides & Best Practices
January 19, 2026
Read more

By
Divine Odazie
Top 6 Graphite alternatives for AI code review in 2026
DevSec Tools & Comparisons
January 16, 2026
Read more

By
.jpg)
Madeline Lawrence
From “No Bullsh*t Security” to $1B: We Just Raised Our $60m Series B
Product & Company Updates
January 14, 2026
Read more

By

Sooraj Shah
Critical n8n Vulnerability Allows Unauthenticated Remote Code Execution (CVE-2026-21858)
Vulnerabilities & Threats
January 8, 2026
Read more
By
Divine Odazie
SAST vs SCA: Securing the Code You Write and the Code You Depend On
Technical
January 6, 2026
Read more
.png)
By

Charlie Eriksen
JavaScript, MSBuild, and the Blockchain: Anatomy of the NeoShadow npm Supply-Chain Attack
Vulnerabilities & Threats
January 5, 2026
Read more

By

Sooraj Shah
How Engineering and Security Teams Can Meet DORA’s Technical Requirements
Compliance
January 5, 2026
Read more
By

Sooraj Shah
IDOR Vulnerabilities Explained: Why They Persist in Modern Applications
Vulnerabilities & Threats
January 2, 2026
Read more

By

Charlie Eriksen
Shai Hulud strikes again - The golden path
Vulnerabilities & Threats
December 28, 2025
Read more

By

Sooraj Shah
MongoBleed: MongoDB Zlib Vulnerability (CVE-2025-14847) and How to Fix It
Vulnerabilities & Threats
December 26, 2025
Read more

By

Charlie Eriksen
First Sophisticated Malware Discovered on Maven Central via Typosquatting Attack on Jackson
Vulnerabilities & Threats
December 25, 2025
Read more

By

Charlie Eriksen
The Fork Awakens: Why GitHub’s Invisible Networks Break Package Security
Vulnerabilities & Threats
December 17, 2025
Read more

By

Trusha Sharma
SAST in the IDE is now free: Moving SAST to where development actually happens
Product & Company Updates
December 15, 2025
Read more

By
Divine Odazie
The Top 7 Threat Intelligence Tools in 2026
DevSec Tools & Comparisons
December 15, 2025
Read more

By

Mackenzie Jackson
React & Next.js DoS Vulnerability (CVE-2025-55184): What You Need to Fix After React2Shell
Vulnerabilities & Threats
December 12, 2025
Read more
.png)
By

Sooraj Shah
OWASP Top 10 for Agentic Applications (2026): What Developers and Security Teams Need to Know
Guides & Best Practices
December 10, 2025
Read more

By

Rein Daelman
PromptPwnd: Prompt Injection Vulnerabilities in GitHub Actions Using AI Agents
Vulnerabilities & Threats
December 4, 2025
Read more

By

Sooraj Shah
Critical React & Next.js RCE Vulnerability (CVE-2025-55182): What You Need to Fix Now
Vulnerabilities & Threats
December 3, 2025
Read more

By
Divine Odazie
How to Comply With the UK Cybersecurity & Resilience Bill: A Practical Guide for Modern Engineering Teams
Compliance
December 3, 2025
Read more
.png)

.png)

.png)










.png)


