🧰 Docker

The items that name it 190

• Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster
  articleas classification.technologies2026-10-29
• GitLab Security Incident: Attempted Exploitation of CVE-2026-97229
  writeupas classification.technologies2026-10-28
• Kizuno18 (@Kizuno18) on X
  threadas classification.technologies2026-10-27
• How to patch PHP2Shell with free Aikido Images
  articleas classification.technologies2026-10-26
• Artificial Intelligence (AI) in Cybersecurity, Part 30: Shannon – AI Pentester for Web Apps and APIs
  articleas classification.technologies2026-10-26
• Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
  writeupas classification.technologies2026-10-25
• Tailworm – Tailscale Vulnerabilities
  writeupas classification.technologies2026-10-25
• Everything, everywhere, all at once… the week software broke | Endor Labs
  articleas classification.technologies2026-10-24
• New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack
  writeupas classification.technologies2026-10-23
• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
  writeupas classification.technologies2026-10-23
• LiteLLM Compromised in Fresh Supply Chain Attack
  articleas classification.technologies2026-10-23
• eMudhra / emSign CA Compromise: What Python, pip, and CI/CD Users Need to Update
  articleas classification.technologies2026-10-22
• Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
  advisoryas classification.technologies2026-10-22
• EMudhra Intermediate CA Certificates Compromised
  advisoryas classification.technologies2026-10-22
• Muscle AI (@themuscleai) on X
  threadas classification.technologies2026-10-22
• eMudhra CA compromise: eight private keys, and one of them is 4
  articleas classification.technologies2026-10-22
• There isn't an easy exploit for this PHP vulnerability
  articleas classification.technologies2026-10-21
• Compromised eMudhra intermediate certificates
  advisoryas classification.technologies2026-10-21
• PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
  articleas classification.technologies2026-10-21
• LiteLLM 1.107.0 Compromised: Python Startup Hooks Steal Cloud, AI, and Proxy Credentials | Endor Labs
  writeupas classification.technologies2026-10-21
• Billy Lee (@billyozno) on X
  threadas classification.technologies2026-10-21
• LiteLLM Compromised, Steals Credentials
  writeupas classification.technologies2026-10-21
• LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials
  writeupas classification.technologies2026-10-21
• LiteLLM compromised again: infostealer and RAT found in version 1.107.0
  writeupas classification.technologies2026-10-21
• eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
  repoas classification.technologies2026-10-21
• ikow/php2shell-poc
  repoas classification.technologies2026-10-21
• Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI
  articleas classification.technologies2026-10-21
• LiteLLM supply chain compromise: What you need to know
  writeupas classification.technologies2026-10-21
• Show HN: VoidAccess – open-source dark web OSINT, from query to a graph
  repoas classification.technologies2026-10-20
• lee1981 (@lee1981b) on X
  advisoryas classification.technologies2026-10-20
• Plex vulnerabilities being exploited in the wild to drop a cryptominer
  writeupas classification.technologies2026-10-19
• Dark Web Intelligence (@DailyDarkWeb) on X
  threadas classification.technologies2026-10-18
• SBOM vs. SBOM: Comparing SBOMs from Different Tools and Lifecycle Stages | Endor Labs
  writeupas classification.technologies2026-10-16
• AWS Security Agent (now part of AWS Continuum) exploited 33 of 37 new real-world CVEs
  articleas classification.technologies2026-10-15
• dbugs (@ptdbugs) on X
  toolas classification.technologies2026-10-15
• Artificial Intelligence (AI) in Cybersecurity, Part 29: Creating Isolated Autonomous Agents for Hacking with NemoClaw
  articleas classification.technologies2026-10-14
• Package managers have an integrity problem
  writeupas tools2026-10-14It is written here as Docker: Ubuntu-based containers used in the testing harness for each package manager.
• Accelerating Pollard Rho with GPU Field Arithmetic on NVIDIA Blackwell
  paperas classification.technologies2026-10-14
• Dark Web Intelligence (@DailyDarkWeb) on X
  threadas classification.technologies2026-10-13
• trhhubsd/ARTEX
  repoas classification.technologies2026-10-08
• IP Camera Hacking: Hacking IP Cameras with Cameradar
  articleas tools2026-10-08

  Container platform used to run cameradar

• | Blog | Endor Labs
  articleas classification.technologies2026-10-06
• lee1981 (@lee1981b) on X
  writeupas classification.technologies2026-10-06
• Ayyaz (@ayyazdev) on X
  threadas classification.technologies2026-10-05
• Introducing Solana Microscope: Program Monitoring and Alerts
  toolas classification.technologies2026-10-05
• Sandboxes Explained: What Each Type Actually Isolates | Blog | Endor Labs
  articleas affected products2026-10-02

  Default container configurations (privileged mode, mounted Docker socket, bind-mounted host paths) cited as weak if misconfigured.

• NuvexNetwork/nuvex
  repoas tools2026-10-02

  builds the node image via node/Dockerfile

• Pentesting: Managing Compromised Machines with Platypus
  writeupas tools2026-10-02

  used to install and run Platypus via docker-compose

• GPT-6 Sol on Codex: average scores, quarter the cost | Blog | Endor Labs
  articleas tools2026-10-01It is written here as Docker (isolated environment to apply patches and run functional and hidden security tests).

  isolated environment to apply patches and run functional and hidden security tests

• LinuxSecurity (@lnxsec) on X
  threadas classification.technologies2026-09-30
• Offensive Security: Pentesting Office Phones with SIPVicious
  writeupas classification.technologies2026-09-28
• nealbridges/VulnHunter
  repoas classification.technologies2026-09-22
• Containers Are No Longer a Security Boundary (CVE-2026-80521)
  writeupas affected products2026-09-22

  Container runtime affected by kernel-level container escape via CVE-2026-80521

• Outrider Recon
  repoas classification.technologies2026-09-19
• VIPER-MCP: Detecting Vulnerabilities in MCP Servers
  paperas classification.technologies2026-09-17
• Markakd/Container_escape
  repoas tools2026-09-16

  Installed in the guest VM; each PoC run starts a fresh Docker container inside the guest to test container escape

• OpenHunterAI
  repoas classification.technologies2026-09-15
• Maskit
  repoas classification.technologies2026-09-15
• AI SAST in Action: Finding Real Vulnerabilities in OpenClaw | Blog | Endor Labs
  writeupas tools2026-09-11

  Used to deploy OpenClaw in a container with integrations configured for exploit validation testing

• Codex with GPT-6 Astra posts 82.1% FuncPass and 34.1% SecPass | Blog | Endor Labs
  writeupas tools2026-09-08

  Isolated environment used to apply and test each combo's patch

• GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI
  articleas classification.technologies2026-09-08
• vet (SafeDep)
  repoas affected products2026-09-07

  Container image format scanned by vet

• How Endor Labs AI SAST Learns What Matters to Your Organization | Blog | Endor Labs
  articleas classification.technologies2026-09-07
• eldarshiraliyev/BugScanner
  repoas classification.technologies2026-09-05
• Claude Code with Fable 5.1 posts 87.2% FuncPass and 37.4% SecPass — a new #1 on our board — while running as fast as Fable 5, costing a third of Opus 5, finishing every task with zero timeouts, and drawing less than half the confirmed cheating of both predecessors. | Blog | Endor Labs
  writeupas tools2026-09-04

  Isolated environment used to apply and test each combo's patch

• Dirty Frag (CVE-2026-43284): the Linux kernel bug that turns read access into root
  writeupas affected products2026-09-04

  Container environments sharing the host/node kernel are at risk of escalation via Dirty Frag

• Malicious Model Detection with MLTracer Syscalls
  writeupas classification.technologies2026-09-01
• galyarder-security
  repoas classification.technologies2026-08-31
• LiteLLM
  toolas classification.technologies2026-08-31
• Dev Machine Guard Now Inventories Where Developer Credentials Live
  articleas classification.technologies2026-08-28
• Securing Docker images
  articleas tools2026-08-28

  Container platform whose images (built from Dockerfiles/layers) are the subject of the hardening/patching practices discussed.

• vibecheck
  repoas classification.technologies2026-08-27
• numasec
  repoas tools2026-08-27

  container runtime used to run numasec via 'docker run -it --rm -v "$PWD:/work" -w /work francescostabile/numasec:latest'

• subScraper
  repoas tools2026-08-27

  multi-platform container with all tools pre-installed (Linux amd64, arm64, armv7)

• ThreatRadar
  repoas classification.technologies2026-08-27
• When AI infrastructure becomes the target: Securing gateways and control points | Microsoft Security Blog
  articleas tools2026-08-26

  Container runtime; its socket was accessed by attackers inside the compromised Kestra environment for container-environment enumeration

• Could OpenClaw have actually hacked that Australian gym? We decided to test it.
  writeupas classification.technologies2026-08-25
• Cyberful
  repoas tools2026-08-25

  container engine required to run Cyberful's runtime image (Linux-container engine, at least 10 GB RAM dedicated)

• henrymao2004/Auto-research-red-teaming
  repoas tools2026-08-25

  sandboxes the victim agent during attack runs

• Cloudflare Computer
  repoas classification.technologies2026-08-25
• Cybermes
  repoas classification.technologies2026-08-23
• MinIO Security Lab
  repoas tools2026-08-21

  containerized lab bring-up for all setup steps

• SKANF
  repoas tools2026-08-21

  Containerization used to build/run SKANF (dockerofsyang/skanf:latest image, or local build via Dockerfile)

• N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it
  writeupas affected products2026-08-20
• armourinfosec/Offensive-Linux-Privilege-Escalation
  repoas affected products2026-08-19
• When you can't upgrade: open source examples of Endor Patches | Blog | Endor Labs
  articleas tools2026-08-19

  used to run hermetic builds of patched artifacts

• Nothing Private
  repoas classification.technologies2026-08-14
• Aikido: CVE-2026-18171
  advisoryas classification.technologies2026-08-13
• Control Which Package Registries Your CI Jobs and Developer Machines Use
  articleas affected products2026-08-12

  builds pulling base images from registry-1.docker.io

• The Agent Baseline: 35 Controls, But Where Should You Start?
  articleas classification.technologies2026-08-12
• npm-scan
  repoas tools2026-08-05

  Multi-arch images for running npm-scan

• Precogly
  repoas tools2026-08-05

  Containerization/infrastructure used to run Precogly (docker compose up --build)

• Kritt-ai/open-kritt
  repoas classification.technologies2026-08-02
• openhackai/OpenHack
  repoas tools2026-08-02

  Required for sandbox verification (/verify sandbox), which spins up the scanned app in a container and attempts to exploit findings with live HTTP requests; also required for browser verification when combined with sandbox.

• Codex Security CLI
  repoas classification.technologies2026-08-01
• AgentHound
  repoas classification.technologies2026-08-01
• Slither
  repoas classification.technologies2026-07-31
• Critical Security Controls for Governing AI Coding Agents | Blog | Endor Labs
  articleas classification.technologies2026-07-31
• thewhiteh4t/FinalRecon
  repoas tools2026-07-31

  Used to run FinalRecon in a containerized environment (docker pull thewhiteh4t/finalrecon)

• Beetle
  repoas tools2026-07-31

  Deployment/containerization for running Beetle (docker compose build/up)

• Flowsint - OSINT Framework
  repoas tools2026-07-31

  Containerization platform used to build and run Flowsint's services (dev and prod)

• Clairvoyance
  repoas classification.technologies2026-07-31
• Speeding Up AD Pentests with ADScan & ADPulse
  writeupas classification.technologies2026-07-31
• hackingtool
  repoas tools2026-07-31

  run hackingtool via published image or local build

• Hetty
  repoas tools2026-07-31

  Used to distribute and run Hetty images via GitHub Container registry and Docker Hub

• OpenOSINT
  repoas classification.technologies2026-07-31
• How I Found Open-Source 0-days with an LLM Multi-Agent Workflow
  writeupas tools2026-07-29

  Used to spin up open-source projects (Nextcloud, Matomo, Grafana) locally for reproduction of findings

• 1N3/Sn1per
  repoas tools2026-07-26

  Docker-first deployment for Sn1per; images for sn1per-kali-linux and sn1per-blackarch

• SeClaw
  repoas classification.technologies2026-07-22
• HackingLZ/gibson
  repoas tools2026-07-22

  Example Dockerfile builds gibson from source (rust:1.75) and runs the collect command in a debian:bookworm-slim container

• Beyond MCP: The New Security Playbook for Coding Agents | Blog | Endor Labs
  articleas classification.technologies2026-07-21
• Gabson0x/pentdem
  repoas tools2026-07-20

  sandboxed, resource-limited, network-isolated execution of dangerous tools (sqlmap, nuclei, nmap, ffuf, subfinder, httpx, dalfox, nikto, wfuzz)

• dinosn/fastjson-jsontype-rce-lab
  repoas classification.technologies2026-07-20
• jit
  repoas classification.technologies2026-07-18
• OpenNVR
  repoas classification.technologies2026-07-18
• CyberSunil/LLMVault
  repoas classification.technologies2026-07-18
• Strix
  repoas tools2026-07-15

  Required runtime; Strix pulls a sandbox Docker image to run pentesting agents locally

• deep-scan
  repoas classification.technologies2026-07-14
• LocxZ/SecureSDLC-Lab
  repoas tools2026-07-14

  Containerization of the application, scanned for vulnerabilities

• awesome-ai-security-tools
  repoas affected products2026-07-11

  used by AIO Sandbox and Gram local development stack

• Endor Labs’ AI SAST Finds Zero Day Memory-Amplification DoS in Anthropic’s buffa library | Blog | Endor Labs
  writeupas classification.technologies2026-07-06
• One Request to Own Every Repo: How We Hijacked GitLab Through Its MCP Server - Pluto Security
  writeupas classification.technologies2026-07-06
• ThinkWatch
  repoas classification.technologies2026-07-04
• Armur-Ai/Pentest-Swarm-AI
  repoas tools2026-06-21

  Container runtime used to run pentestswarm image

• Endor Labs: Claude Fable 5
  writeupas tools2026-06-18It is written here as Docker (isolated environment).

  Used to apply and test each combo's predicted patch in isolation

• Orca Security: nginx Flaw in 1.45M Tengine Servers (CVE-2026-42945 + CVE-2026-9256)
  writeupas tools2026-06-16

  Used to build a controlled test environment/container for compiling and testing Tengine with ASAN.

• Pipelock
  repoas classification.technologies2026-06-14
• SkillSpector
  repoas classification.technologies2026-06-14
• Orca: 8 Container Security Best Practices for 2026
  articleas affected products2026-06-11It is written here as Docker (container engine; mounting the Docker socket into a container lets it launch privileged containers and compromise the host).

  container engine; mounting the Docker socket into a container lets it launch privileged containers and compromise the host

• Miasma & Hades Worms
  writeupas classification.technologies2026-06-10
• Defending Code Reference Harness
  repoas tools2026-06-05

  builds the target into an image with ASAN; required for scripts/setup_sandbox.sh

• ShulkwiSEC/bb-huge
  repoas classification.technologies2026-06-05
• HackTricks-wiki/hacktricks
  repoas classification.technologies2026-05-31
• Metis
  repoas tools2026-05-31

  Used to build and run the Metis container, and to run PostgreSQL/pgvector and Qdrant instances via docker compose/docker run

• OSV
  toolas classification.technologies2026-05-25
• PentAGI
  repoas classification.technologies2026-05-23
• CyberStrikeus/CyberStrike
  repoas classification.technologies2026-05-23
• KeygraphHQ/shannon
  repoas classification.technologies2026-05-23
• Socket: TeamPCP + BreachForums Launch $1,000 Contest for Supply Chain Attacks
  articleas classification.technologies2026-05-20
• JFrog: Keep your Agents Under Control with agent-belt
  toolas classification.technologies2026-05-19
• Open ASM Platform
  repoas tools2026-05-17

  Container runtime used by workers to pull and run connector images for scans

• OWASP/DockSec
  repoas classification.technologies2026-05-14
• GigaChad GRC
  repoas classification.technologies2026-05-13
• PromptZero
  repoas tools2026-05-12It is written here as Docker (ghcr.io/xunholy/promptzero).

  multi-arch, distroless, signed container images with SBOM + provenance for hosting PromptZero

• Intelligence Cyber Digest
  threadas affected products2026-05-12
• Betterleaks
  repoas classification.technologies2026-05-10
• Titus by Praetorian
  repoas classification.technologies2026-05-10
• oritera/Cairn
  repoas tools2026-05-10

  Used for container execution of worker containers (not needed for local mode)

• SanMuzZzZz/LuaN1aoAgent
  repoas tools2026-05-08

  Per-Task Executor and Gateway container isolation backend

• GH05TCREW/pentestagent
  repoas tools2026-05-08

  Containerization used to run PentestAgent and pentesting tools in isolation

• Strix
  articleas tools2026-05-07

  required runtime dependency for installing and running Strix

• IronCurtain: Secure AI Agent Runtime
  repoas affected products2026-05-07

  used for Docker Agent Mode; not required but strongly recommended

• GigaChad GRC
  repoas classification.technologies2026-05-06
• Securing Jenkins: Top Attack Flows & Misconfigurations | Wiz Blog
  articleas classification.technologies2026-05-06
• Presidio (Microsoft)
  repoas classification.technologies2026-05-06
• OpenClaw MAESTRO
  writeupas classification.technologies2026-05-06
• 0xSteph/pentest-ai-agents
  repoas tools2026-05-06

  Used for container escape testing (container-breakout agent) and for running security tools in an isolated container

• zeroc00I/DontFeedTheAI
  repoas classification.technologies2026-05-05
• Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 Hours | Sysdig
  writeupas classification.technologies2026-04-09
• CVE-2025-62878 — Critical Path Traversal in Rancher Local Path Provisioner (CVSS 10.0)
  advisoryas classification.technologies2026-02-10
• 1-Click RCE To Steal Your OpenClaw Data and Keys (CVE-2026-25253) | depthfirst
  writeupas classification.technologies2026-02-01
• Azure Batch Misused for Crypto Mining
  writeupas tools2024-03-15

  Used by the attacker to pull and run the malicious ubtssl/webappx container that hosted the coin miner.

• SCF Controls Platform — open source
  toolas classification.technologies
• Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504)
  writeupas classification.technologies
• derailed/popeye
  toolas classification.technologies
• Revenge of the SD-WAN: Cisco Catalyst SD-WAN Manager Auth Bypass (CVE-2026-76504)
  writeupas tools

  Used by researchers to inspect the running vManage container stack (service-proxy/Envoy and application-server) during reproduction

• chainguard-dev/malcontent
  repoas classification.technologies
• target/strelka
  repoas classification.technologies
• deepfence/YaraHunter
  repoas classification.technologies
• NVIDIA/OpenShell — sandboxed runtime for autonomous AI agents
  repoas tools

  container runtime option required to run OpenShell sandboxes

• AI-Infra-Guard (A.I.G) — Tencent Zhuque Lab
  repoas classification.technologies
• NVIDIA OpenShell — secure runtime for autonomous AI agent fleets
  repoas classification.technologies
• openrig — multi-agent Claude Code/Codex orchestration
  repoas affected products

  Required for service-backed rigs and managed apps (e.g. secrets-manager)

• SpecterOps/Blacklight — local AI agent attack surface mapping toolkit
  repoas tools

  Used to build the Windows and Linux Scout matrix via build.ps1/build.sh

• FirmAgent: Fuzzing + LLM Agents for IoT Firmware Vulnerability Discovery (NDSS 2026)
  repoas classification.technologies
• SAPMAP — SAP Landscape Attack Path Mapper
  repoas classification.technologies
• Agent Threat Rules (ATR) — open detection-rule standard for AI agent threats
  repoas classification.technologies
• FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
  articleas affected productsIt is written here as Docker (fake).

  Counterfeit MCP server/skill lure posing as Docker tooling.

• Unauthenticated Administrator takeover exfiltrated via the MCP
  advisoryas tools

  used to run the vulnerable b3log/siyuan:v3.7.1 image in the lab reproduction environment

• rewanthtammana/Who-Let-The-Agents-Act
  repoas classification.technologies
• Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool calls
  advisoryas tools

  used to build and run a local container of the affected commit for PoC verification

• Flowise MCP Security Bypass Enables RCE
  advisoryas tools

  Containerization; abused via 'docker build' subcommand not on Flowise's command blocklist to fetch and execute a remote Dockerfile, enabling container escape

• Chocapikk/CVE-2026-21858
  repoas classification.technologies
• DVLAA
  repoas tools

  容器化部署 DVLAA 控制台及按需拉起官方上游漏洞环境容器

• CVE-2026-26980 — Ghost CMS Content API unauthenticated blind SQLi lab
  repoas classification.technologies
• Tencent/AI-Infra-Guard
  repoas classification.technologies
• cyanheads/osv-advisory-mcp-server
  repoas tools

  Container runtime used to run osv-advisory-mcp-server via ghcr.io/cyanheads/osv-advisory-mcp-server:latest image

• agent-egress-bench
  repoas classification.technologies
• CVE-2026-42533 nginx heap buffer overflow PoC (pre-auth RCE via two-pass capture clobbering)
  repoas classification.technologies
• AWSHound — AWS BloodHound OpenGraph Collector
  repoas classification.technologies

In every workspace you can read 275