eyberg

8 ms·

1.
CVE-2026-53361 AF_Unix GC vs. MSG_PEEK use-after-free container escape(github.com)
13 points by eyberg 1mo ago|0 comments
2.
Capture the Flag(unik.cx)
3 points by eyberg 1mo ago|0 comments
3.
SCTPhantom: An 18-Year-Old SCTP Asconf Transport Use-After-Free(matrix.tencent.com)
4 points by eyberg 1mo ago|0 comments
4.
by eyberg 2mo ago
Containers and security are oxymorons. The flood of page cache cves (which can always be escalated/weaponized to an escape) from the other month is making deploying containers to prod untenable. As for orchestration - a lot of folks th
5.
A reliable unprivileged container jail escape proof of concept for CentOs/RHEL(github.com)
3 points by eyberg 3mo ago|0 comments
6.
CISA Admin Leaked AWS GovCloud Keys on GitHub(krebsonsecurity.com)
22 points by eyberg 4mo ago|0 comments
7.
by eyberg 5mo ago
So first off - NVD has been sliding for a long time now. This has nothing to do with mythos. The amount of money that goes into this program for the output is straight up criminal. For a very long time the security world has basically given
8.
Flatpak: Complete Sandbox Escape(github.com)
20 points by eyberg 5mo ago|0 comments
9.
by eyberg 7mo ago
No they have not been. There were at least 16 container escapes last year - at least 8 of them were at the runtime layer. I personally spent way too much time looking at this in the past month: https://nanovms.com/blog/
10.
by eyberg 7mo ago
Except this is very clearly running linux.
11.
Multiple Issues in Ingress-Nginx(openwall.com)
1 points by eyberg 8mo ago|0 comments
12.
Kubernetes RCE: Exploiting nodes/proxy GET(labs.iximiuz.com)
2 points by eyberg 8mo ago|0 comments
13.
by eyberg 8mo ago
The majority of nanos users don't do either of these methods. They simply create the image (in the case of aws that's an ami) and boot it. This is part of what makes them vastly more simple than using normal linux vms or container
14.
by eyberg 8mo ago
https://github.com/containers/bubblewrap/issues/142
15.
by eyberg 8mo ago
A lot of these "ai sandbox" conversations target code that is already running in a public cloud. Running firecracker doesn't give you magical isolation properties vs running an application in ec2 - it's the same bounda
16.
by eyberg 8mo ago
No they are not. The "industry" totally disagrees with this statement as well.
17.
by eyberg 8mo ago
> Escaping a properly set up container is a kernel 0day. Not it is not. In fact many of the container escapes we see are because of bugs in the container runtimes themselves which can be quite different in their various implementations.
18.
by eyberg 9mo ago
Duplicating a networking and storage layer on top of existing storage/networking layers that containers, and the orchestrators such as k8s provide, absolutely degrade performance - full stop. No one runs containers raw (w/out an u
19.
by eyberg 9mo ago
A shell by design is explicitly made to run other programs. You type in 'ls', 'cd', 'cat', etc. but those are all different programs. A "webshell" can work to a degree as you could potentially upload
20.
by eyberg 9mo ago
We don't enable that exec-protect feature on by default explicitly for this reason. You are right - jit needs it.
21.
by eyberg 9mo ago
Let's see last month (November 2025) we had CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881 alone. Container breakouts happen almost monthly .
22.
by eyberg 9mo ago
I can't speak for all the various projects but imo these aren't made for bare metal - if you want true bare metal (metal you can physically touch) use linux. One of the things that might not be so apparent is that when you deploy
23.
by eyberg 9mo ago
To be clear there are still numerous attacks one might lob at you. For instance you if you are running a node app and the attacker uploads a new js file that they can have the interpreter execute that's still an issue. However, you won
24.
by eyberg 9mo ago
Containers got popular at at time when there were an increasingly number of people that were finding it hard to install software on their system locally - especially if you were, for instance, having to juggle multiple versions of ruby or m
25.
by eyberg 9mo ago
a) containers don't contain b) if you want to limit your hosting environment to only the language/program you expect to run you should provision with unikernels which enforce it
26.
by eyberg 9mo ago
It's confusing but CVE-2025-55184 was released today (not the ones last week). CVE-2025-67779 is an update to that one.
27.
New React CVE CVE-2025-67779(twitter.com)
7 points by eyberg 9mo ago|2 comments
28.
New Elf-Stats Malware Campaign on NPM(npmjs.com)
1 points by eyberg 10mo ago|0 comments
29.
by eyberg 10mo ago
No it is not.
30.
by eyberg 10mo ago
The same podman that had three new CVE breakouts not even two weeks ago? Containers do not contain.

More ›