Ephemeral CI runners hide vulnerable kernels behind short-lived hosts, so this post maps the actively exploited Linux kernel flaws and the Copy Fail root-escalation bug to CI and cloud workloads and lays out a practical kernel patch-triage checklist.
A critical Docker Sandboxes vulnerability let malicious guest code running inside a container read and modify files on the macOS host, a reminder that local and CI containers should not be treated as trusted security boundaries.
A developer-focused look at how attackers are probing Gitea Docker CVE-2026-20896 shortly after disclosure, with practical guidance for hardening containerized deployments.
A Linux kernel authencesn logic flaw in AF_ALG and splice() enables a deterministic 4-byte page cache write that can lead to root on major distributions and cross-container compromise.