Bitbison

Bitbison develops a Linux security platform whose core premise is the continuous capture of a complete causal record of system activity — threads, processes, files, network connections and other system objects — rather than a sampled subset of coarse-grained events. The company positions this record as the basis for detection, investigation and policy enforcement, arguing that conventional runtime security tools observe only a few hundred events per host per hour and therefore cannot detect or reconstruct activity that was never recorded. Its site states that existing approaches miss over 99% of what happens on a host, and cites external research (eAudit at IEEE S&P 2024, IBM's Cost of a Data Breach 2024, Mandiant M-Trends 2024, and a USENIX Security 2022 study on false positives) to frame the problem of dropped audit data, long breach detection times and high false-positive rates.

A second element is a policy language expressed over the causal graph. Alongside conventional rule constructs, Bitbison introduces a provenance operator that asserts an action provably flowed from a specified origin — for example, permitting only Ansible driven from a corporate bastion host to write a configuration file that a network-facing service subsequently loads, and alerting on anything else with the full causal chain attached as evidence. The company contrasts this with pattern-matching approaches based on signatures, rules or behavioral analytics, which it describes as approximating chains of cause and effect using discrete, disconnected events.

The company also publishes threat research using its own instrumentation. One post analyzes a standalone Linux build of the Shai-Hulud supply-chain worm recovered from a research fleet instrumented with Bitbison, where a genuinely vulnerable React Server Components stack was exposed to the internet; the analysis covers React2Shell-based initial access, three in-process HTTP command handlers injected into a Next.js process, an SSH worm, Global Socket reverse-shell persistence, attacker SSH keys, and VS Code and Claude Code hooks added to compromised repositories, along with build-artifact evidence (an embedded Bun 1.3.14 runtime, bun build --compile, standalone polyfill modules and an unresolvable OpenSearch commit reference) used to date the payload.

Traction

The website presents measured production comparisons against competing agents across multiple host classes (a build server fleet of 13 hosts, a web service fleet of 10,537 hosts and a control plane of 189 hosts), and the company operates an internet-exposed research fleet instrumented with its own product that captured a live Shai-Hulud and React2Shell compromise. Access to the product is offered via an early-access request.

Latest developments

In a blog post covering activity dated May 2026, Bitbison reported recovering a new "Mini Shai-Hulud" variant compiled as a standalone Linux post-exploitation executable that retains the worm's credential theft and GitHub and npm propagation without requiring a malicious package install or build workflow. The analysis describes React2Shell exploitation of a Next.js server for initial access, three simultaneously installed in-process HTTP handlers for payload delivery, SSH worm propagation, and persistence via attacker SSH keys and Global Socket startup hooks, and places the payload's likely build date at 12–15 May 2026 based on an embedded Bun 1.3.14 runtime and staging-host presence.