Tag

Container Security

All articles tagged with #container security

security1 month ago•6 min saved

OpenAI incident exposes patched Linux IPv6 flaw and urgent patch steps

A patched Linux kernel vulnerability, CVE-2026-53362 (IPv6 Frag Gap), played a role in OpenAI’s Hugging Face incident, showing how a local foothold can escalate to root via an IPv6 UDP path; patches exist in recent kernels but many systems remain unpatched. Security guidance: apply vendor kernel updates, reboot to load the new kernel, prioritize patching for high-risk workloads, verify container-host boundaries, and consider temporary mitigations (e.g., disabling IPv6) if needed. Monitor for signs of compromise and expect more AI-enabled exploits as attackers leverage kernel bugs to gain control.

via ZDNET|

#container-security #cve-2026-53362 #ipv6-frag-gap

security2 months ago•3 min saved

Ancient Linux SCTP bug lets local attackers gain root and escape containers

A long-standing use-after-free in Linux SCTP (CVE-2026-64564, nicknamed SCTPhantom) can allow a local user to gain root on a host and escape containers when SCTP is reachable; patches landed in stable kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148 as of August 3. Tencent Zhuque Lab demonstrated root on multiple distros, though no widespread public exploit has surfaced. Mitigate by upgrading to the patched kernels or blocking the SCTP module if not needed. The issue traces back to 2008 and affects many releases, with a related use-after-free fixed in the same patch; check your distro's tracker for coverage.

via The Hacker News|

#container-security #cve-2026-64564 #linux-kernel

security9 months ago•13 min saved

VoidLink: A Cloud-Native Linux Malware Framework Targets Cloud and Containers

Check Point Research details VoidLink, a modular, cloud-first Linux malware framework designed for long-term access in cloud and container environments. Written in Zig, it features a two-stage loader, an in-memory plugin system with 37 default plugins, a web-based C2 dashboard, and adaptive stealth that tailors behavior after detecting cloud providers (AWS, GCP, Azure, Alibaba, Tencent). It supports multiple command-and-control channels (HTTP/HTTPS, DNS, ICMP) and even a potential mesh network, plus rootkit capabilities (LD_PRELOAD, eBPF, LKM) depending on kernel version, anti-analysis and self-deletion measures, and a broad plugin ecosystem for post-exploitation tasks. The framework appears to be under active development—likely commercial—raising the need for defenders to harden Linux, cloud, and container environments; as of publication, no real-world infections had been observed.

via Check Point Software|

#cloud-security #container-security #linux-malware

technology11 months ago•2 min saved

Critical runc Flaws Threaten Docker and Kubernetes Container Security

Three critical vulnerabilities in the runC container runtime used by Docker and Kubernetes could allow attackers to escape containers and gain root access to host systems. While no active exploits have been reported, mitigation strategies include enabling user namespaces and using rootless containers. Fixes are available in recent runC versions.

via BleepingComputer|

#container-security #cybersecurity #docker