Topic
Securing container images and runtimes, including image composition, hardening and vulnerability management.
DepthFirst published a working Ubuntu 26.04 exploit for CVE-2026-80521 on 2026-09-22, before distribution kernels carried a fix, according to a dev.to post. The flaw sits in AF_UNIX, which default Docker and Kubernetes seccomp profiles permit.
Reality
Gotenberg's 8.30.1 patch validated metadata keys but not values, so CVE-2026-40281 lets unauthenticated callers move files as root. The dev.to write-up of the bug does not name a fixed release, so operators have no confirmed version to move to.
Reality
Kubernetes fixed CVE-2026-2270 on September 23. The StatefulSet controller bug let a user confined to one namespace get a pod created in another. Shared clusters need the upgrade and a review of cluster-wide controllers that copy fields from objects tenants can write.
Reality
EU Cyber Resilience Act rules have required 24-hour ENISA warnings on exploited flaws in commercial container images since Sept. 11, 2026. Vendors of supported Kubernetes operators and Helm charts are on the same clock, well before the rest of the law is enforced in December 2027.
Reality
ThreatDown says the Carbonato worm breaks into Docker daemons open on port 2375 and installs the open-source Hermes AI agent, then rescans nearby networks every five minutes to spread. An operator drives each infected host over Telegram.
Reality
CARBONATO, a Docker botnet running since October 2024, hijacks hosts on open port 2375 and steals keys from 14 AI providers to fund its own LLM gateway. ThreatDown found the crew's own container registry exposed, handing defenders 4.3 GB of its toolchain.
Perspective Coverage
3 publishersReality
The kernel fixed CVE-2026-80521 on August 6. Ubuntu has shipped nothing for 22.04, 24.04 or 26.04, including its AWS, Azure and GCP kernels, and DepthFirst's exploit for 26.04 went public on September 22.
Reality
Two 2026 writeups measured Docker's alpine cold start at 0.31 and 1.23 seconds, a fourfold spread on the same test. The rootless networking backend a host runs moves throughput from about 40 Gbps to 3.
Reality
Engine 29.8.0's --umask flag sets one mask for the main process, execs and healthchecks. A side-by-side test on a second daemon also shows it accepting a four-digit value and applying only the last three.
Reality
CISA has confirmed exploitation of three Linux kernel flaws without publishing how, and the three entries do not triage the same way, because Red Hat's interim advice covers kTLS and ebtables but not the AF_ALG race.
Reality
The three kernel CVEs CISA added to its exploited-bugs catalog on Friday all need local access, and the lowest-scored of them is the one STAR Labs used for privilege escalation and container escape. Red Hat has confirmed public exploit code.
Perspective Coverage
6 publishersReality
PDFik dropped --no-sandbox from its Playwright workers and kept rendering customer-submitted HTML in non-root, capability-stripped pods. Its own security auditor later wrote that the flag was mandatory.
Reality
In an account from The New Stack, a patched runtime image still misses production a week later because every service builds its own way, and buildpacks are offered as the shared path that closes the gap.
Reality
A dev.to write-up traces a build that fails only on enterprise-kernel servers to three correct components meeting badly. The seccomp profile that fixes it stays inert until the build runs on Docker's classic engine.
Reality
A dev.to writeup takes a 15-line Flask app from 442 MB to 56.6 MB and publishes its layer sizes. The measured layers cover 74.4 MB of the cut, and the base image swap has to account for the rest.
Reality
Cua's auth check keyed on a container variable while its bind default listened everywhere, and the pair scored 9.8. AutoAgent's blunter version had no fixed release when the records went out.
Reality
CISA added CVE-2026-53362 to its exploited-vulnerabilities catalog on August 27. The single published account of the bug says the escape needs only unprivileged code on the node plus permission to open a UDP socket, which almost nothing is denied.
Reality
The 39 percent comes from Wiz research with no published sample or method, and it bounds the hardened-image pitch as much as it supports it, since most critical container findings sit above the base layer.
Reality
The container security pioneers behind a $410 million exit could not sell fewer CVEs to buyers whose budgets were already committed. The registry goes dark on October 22.
Reality
Traefik Labs argues most CVEs in a container come from the OS packaging around the application, not the application. Its pitch is attack surface reduction rather than faster detection.
Reality