CuraSec

tag: Container-Escape · 2 items

Act archived Public PoC Released for Unpatched Ubuntu Container Escape (CVE-2026-80521)
2026-09-23 · The Hacker News · source ↗ #container-escape#linux-kernel#ubuntu
  • Engineer — Act: Public PoC exists for a container-to-host-root escape on Ubuntu 22.04/24.04/26.04 LTS — all still unpatched. Apply the upstream kernel fix manually or enforce strict seccomp/AppArmor profiles on all container workloads immediately, and track Ubuntu’s security backport channel for the official LTS patch.
  • SOC/IR — Plan: No evidence of active exploitation yet (EPSS 0.00, not on KEV), but a public PoC makes this a near-term detection priority; build or tune rules for anomalous privilege escalation originating from container processes and AF_UNIX socket abuse before exploitation begins.
  • Leader — Skip
  • Signals: CVE-2026-80521 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
Act archived Critical Docker Sandboxes VM Escape Exposes macOS Host Files (CVE-2026-77179)
2026-09-18 · The Hacker News · source ↗ #container-escape#docker#macos
  • Engineer — Act: A public PoC exists for this container escape on macOS; any engineer running Docker Sandboxes should update to the patched version immediately and audit shared directories for unexpected access. Until patched, avoid running untrusted code inside Docker Sandboxes VMs.
  • SOC/IR — Learn: No active exploitation signals and no KEV listing; primarily an engineer patching concern. Worth noting the attack pattern (VM guest escaping to host filesystem via shared directory traversal) for future detection development.
  • Leader — Skip
  • Signals: CVE-2026-77179 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub