Docker
Docker Built Its Own Hypervisor. Your Laptop Will Notice.
Docker Built Its Own Hypervisor. Your Laptop Will Notice. For 13 years, the virtual machine below Docker Desktop belonged to somebody else. In August 2026, …
← All Posts
##security
Security
Docker Model Runner SSRF - OCI Registry Realm Hijack Exposes Internal Network & Cloud Credentials
Docker Model Runner's OCI token exchange follows the WWW-Authenticate: realm URL without validating scheme, hostname, or IP range. A malicious registry sets the realm to …
Security
terminal-prettier npm Malware - RC4 Obfuscation and Anti-Analysis Hiding in dist/logger.js
Package masquerading as a terminal formatting utility. Under a legitimate-looking name sat an intentionally obfuscated dist/logger.js with an RC4-like cipher, base64 decoding, anti-analysis loops, and …
Security
axios npm Supply Chain Attack - Malicious 1.14.1 & 0.30.4 Drop RAT via plain-crypto-js
StepSecurity and Socket identified two malicious releases of axios - the HTTP client with over 100 million weekly npm downloads - published using the compromised …
Security
SQL Expressions to SSH on Your Host - CVE-2026-27876
Liad Eliyahu, Head of Research at Miggo Security, discovered that Grafana's sqlExpressions feature - designed to transform query data with SQL syntax - also permitted …
Security
CVE-2026 OpenAI Codex GitHub Token Theft - Command Injection via Branch Name Explained
OpenAI Codex - the AI coding agent embedded in ChatGPT - was vulnerable to command injection via the branch parameter during task creation. Codex runs …
Security
Checkmarx KICS GitHub Action Compromised - TeamPCP Supply Chain Attack
checkmarx/kics-github-action - used to scan Terraform, Kubernetes, Dockerfiles, and CloudFormation for misconfigurations - had all release tags force-pushed to malicious commits containing a modified setup.sh. …
Security
TRIVY DOCKER IMAGES COMPROMISED
TeamPCP silently pushed three poisoned Docker images - 0.69.4, 0.69.5, 0.69.6 - to Docker Hub without any corresponding GitHub releases, armed them with a 3-stage …
Security
CanisterWorm The Self-Propagating npm Supply Chain Worm
CanisterWorm is a self-propagating malware that infected 64+ npm packages in March 2026. Named by Aikido Security and Socket.dev, it's notable for two historic firsts: …