Docker fixed critical Docker Hub flaw CVE-2026-105445 under four hours after a report, ending a 765-day exposure window. Docker says it found no evidence of exploitation; the open check for teams is whether anyone of theirs was named owner in a conversion.
Perspective Coverage
4 publishers
- Builder
- Builder 34%
- Operator
- Operator 51%
- Investor
- Investor 15%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+8
- Incentives50
- Confidence72
buildOne report1 publisher A Docker Hub account conversion let one user's access token act as another user
Docker says it fixed a Docker Hub token flaw about four hours after an outside researcher reported it on September 30. Teams that publish from CI should check whether Docker flagged their tokens and whether their published images still match their builds.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives25
- Confidence55
buildOne report1 publisher Valkey 9.2's INCREX closes the crash gap that strands INCR/EXPIRE counters without a TTL
Valkey 9.2.0-rc1's new INCREX command left no counters without an expiry in one developer's 500-request crash test, against 11 for INCR then EXPIRE. Most of its speed gain comes from dropping one round trip, so the case for adopting it is correctness.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher A static denylist stopped one more prompt injection than no protection in a coding-agent study
Bouras, Dai and Mechtaev found a static denylist let 46 of 75 prompt injections execute in a coding agent, against 3 under preflight-scoped capabilities. A same-day Google report of malware stealing OIDC tokens from GitHub Actions runners puts the outer limit on an agent in the CI job's permissions.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher Docker Sandbox kit confines a DeepAgents agent to one local model port
DeepAgents runs in a four-file Docker Sandbox kit whose agent can reach only a local Model Runner on port 12434, with no cloud keys. The egress policy is careful work, and exact reproduction still rests on what PyPI serves when each sandbox is created.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence40
buildOne report1 publisher Registry logs show Compose v5.5.1 ignoring pull_policy windows on explicit pulls
Docker Compose v5.5.1 hit the registry on all three explicit pulls in a developer's test, though its v5.5.0 changelog says pull now honors refresh windows. For CI pipelines built around an explicit pull step, the upgrade bought no fewer registry calls in that test.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+25
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher Unmirrored MinIO deployments lose their redeploy path when a node fails
MinIO's server and client images stopped pulling from Docker Hub after that repository was archived in September 2026, users report. Running clusters keep serving, so the first break is a redeploy with nothing to pull.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence40
buildOne report1 publisher Two PaddleOCR containers sharing one SQLite volume can OCR the same file twice
Setting RUN_MODE=job runs the same OCR image as a one-shot pipe, taking a PDF on standard input and printing markdown. It also writes a queued row into the table a running server polls, and Postgres row locking is the fix.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap−10
- Incentives55
- Confidence50
buildOne report1 publisher A missing gp3 StorageClass made Storm's init containers blame Nimbus for two days
Apache Storm ships no maintained Helm chart and no migration guide, so one team wrote its own templates for EKS. The first thing that broke was a StorageClass name, and the only symptom was an init container log line.
Reality
- Evidence58
- Adoption18
- Hype gap0
- Incentives32
- Confidence52
Google clocks TeamPCP standing up a mass credential-harvesting campaign in under six hours
GTIG's 2026 accounting traces one crew from package-registry compromises on PyPI, npm and Docker Hub to agent instructions that planned and ran the campaign, then out to public malware releases anyone can reuse.
Reality
- Evidence48
- Adoption45
- Hype gap+22
- Incentives72
- Confidence45
Dustmaker lifts GitHub Actions tokens so its packages clear AI coding trust checks
Google Threat Intelligence Group's September 8 report puts a financially motivated actor, UNC6780, inside PyPI, npm and Docker Hub, publishing under stolen maintainer automation and reselling the AI tool credentials it collects afterwards.
Reality
- Evidence54
- Adoption45
- Hype gap+22
- Incentives64
- Confidence56
Mandiant traced the Q2 2026 campaign to an AI coding chatbot, one prompt and a set of agent instructions that ran the scanning pipeline, fixed its own errors and rotated IPs with nobody at the keyboard.
Perspective Coverage
3 publishers
- Builder
- Builder 30%
- Operator
- Operator 57%
- Investor
- Investor 13%
Reality
- Evidence58
- Adoption62
- Hype gap+24
- Incentives70
- Confidence66
Google traces a six-hour credential harvest to a coding chatbot running markdown playbooks
A human broke in and assembled the framework, and after that the scanning, the retries and the address rotation ran on their own out of the victim's own IPs. That middle stretch is what response clocks have to survive.
Reality
- Evidence55
- Adoption60
- Hype gap+18
- Incentives70
- Confidence55
An attacker force-pushed 76 of Trivy's 77 action tags to credential-stealing commits
The maintainers date the second wave to March 19, eighteen days after they disclosed the first one and rotated credentials without doing it all at once, and the only action tag that came through clean was one GitHub had already frozen.
Reality
- Evidence74
- Adoption52
- Hype gap−14
- Incentives68
- Confidence61
AI coding agents route around the repository gate, and JFrog moves the checkpoint to the agent
Agent Package Resolution, now in preview, binds Claude Code and Cursor to Artifactory. Two of its three enforcement layers still run where the agent does.
Reality
- Evidence34
- Adoption14
- Hype gap+42
- Incentives86
- Confidence44
Docker puts Verified Publisher behind a signup form, and pull data behind a plan
Verified Publisher applications are now self-serve with two plans, priority search ranking and reports that name the companies pulling your images.
Reality
- Evidence38
- Adoption32
- Hype gap+28
- Incentives88
- Confidence56
buildOne report1 publisher Flux moves GitOps' source of truth into registries you own, and mirroring becomes the prerequisite
Flux Mirror ships as a v2.9 CLI plugin that copies images, charts and desired-state artifacts from a config file. The Bitnami catalogue freeze is the argument for using it.
Reality
- Evidence42
- Adoption15
- Hype gap+27
- Incentives72
- Confidence46
buildConfirmed2 publishers Wiz says attackers are using the WebDriver API's documented remote-command features to plant a modified XMRig on internet-facing Selenium Grid nodes. Authentication is off by default.
Publishers:selenium.dev · wiz.io Reality
- Evidence74
- Adoption71
- Hype gap+14
- Incentives62
- Confidence70
The 2,500-org compromise was a Trivy problem. LiteLLM was the closing act.
SOCRadar's record-level data puts 95 percent of identified victims before the poisoned LiteLLM packages ever hit PyPI. Anyone who rotated only what LiteLLM touched is still exposed.
Reality
- Evidence52
- Adoption68
- Hype gap+12
- Incentives66
- Confidence55