RSS

Serverless Agent Release Notes

Welcome to the release notes for Sysdig Serverless Agent.

Serverless Agent 6.3.0 June 18, 2026

Enhancements

Malware Response Support

  • Added support for Container kill and Process kill Policy Actions.

Static Policy Scoping

  • Optimized policy scoping when using the host.hostName, host.mac, and agent.tag.* labels. In this case, the scope is evaluated at load time (statically) instead of when events are generated. As a result, when static scopes do not match, the policies and their rules are not loaded and no events are generated. For mixed scopes, the static portion is evaluated at load time and the rules are loaded; the dynamic portion (such as container.name) is evaluated when an event matches any of the policy’s rules.

Defect Fixes

  • Fixed an issue in Azure Container Apps that left secure events without the container.id and container.name labels, preventing policy scoping and Falco rule-exception matching.

Vulnerability Fixes

Addressed the following vulnerabilities in Workload Agent:

Serverless Patcher 5.4.4 May 13, 2026

Vulnerability Fixes

Addressed the following vulnerabilities in Serverless Patcher:

Serverless Agent 6.2.1 May 12, 2026

Defect Fixes

  • Fixed an issue where termination signals were not properly forwarded to the agent in sidecar mode.
  • Fixed an issue on ARM64 that could occur in workloads containing specific Go binaries.

Vulnerability Fixes

Addressed the following vulnerabilities in Workload Agent:

Serverless Patcher 5.4.3 March 18, 2026

Vulnerability Fixes

Addressed the following vulnerabilities in Serverless Patcher:

Serverless Agent 6.2.0 March 16, 2026

Enhancements

Malware Detection for AWS ECS Fargate

  • Sysdig now extends Malware Detection to AWS ECS Fargate via Workload Agent sidecar deployments. This allows security teams to identify malicious binaries and known malware hashes within serverless workloads without sacrificing cloud-native scalability. For more information, see Malware Detection. The feature is disabled by default.

Defect Fixes

  • Fixed an issue where instrumented Go workloads could occasionally terminate unexpectedly while instrumenting socket system calls.

Vulnerability Fixes

Addressed the following vulnerabilities in Workload Agent:

Serverless Patcher 5.4.2 December 19, 2025

Vulnerability Fixes

Addressed the following vulnerabilities in Serverless Patcher: