Cloudflare’s Sandboxes Read the Last Tenant’s Disk
A cross-tenant flaw in Cloudflare Containers let one account read disk blocks left by another tenant. The fix landed in the storage layer.
CVE-2026-80521 Escapes the Container. Ubuntu Has Not Shipped the Fix.
A public container escape exploit targets a Linux kernel flaw in AF_UNIX sockets. Ubuntu still lists the fix as in progress.
Arista Patched VeloCloud in July. That Build Is Vulnerable to the September Zero Day.
Arista's July VeloCloud fix is vulnerable to the September zero day. Patching on schedule exposed operators twice.
CoreWeave Says It Cannot Read Your Data. That Is the Whole Offer.
CoreWeave's new key custody model keeps decryption keys in the customer's own store. The AI cloud holds ciphertext and nothing else.
ShinyHunters Says It Took Home Addresses for Nearly Every FBI Agent. No Patch Would Have Stopped That.
ShinyHunters says a PeopleSoft zero day handed it 2 to 3 terabytes, including home addresses for nearly every FBI agent. No patch would have stopped it.
CISA Put Three Linux Kernel Bugs on the Exploited List. Two Sit Under Your Containers.
CISA added three exploited Linux kernel vulnerabilities to its KEV catalog on 18 September. Two of them sit in the container network path.
SGLang Blocked Four Dangerous Builtins. Attackers Used Two It Left Open.
A SGLang SafeUnpickler bypass lets an unauthenticated caller reach remote code execution, and the framework has now shipped two 9.8s in six weeks.
Microsoft Patched a Perfect 10 in Azure AI Foundry and Told You to Do Nothing
Microsoft fixed an Azure AI Foundry vulnerability rated CVSS 10.0 inside a batch of 18 cloud CVEs, and every fix landed on Microsoft's own servers.
Kubernetes Mounted Every Writable Volume Executable, and v1.37 Finally Closes It
Kubernetes v1.37 adds bind mount options and emptyDir permission modes, closing a gap auditors flagged twice.
Four Linux Kernel Root Bugs Went Public at Once. Your Nodes Share That Kernel.
Four Linux kernel privilege escalation bugs went public at once. DiagSpill needs no user namespace, which makes containers the shortest path to root.