[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flv0ihb09FI9WAVJnwA4RIUk4POz1fANq1HhHOS9J9RE":3},{"article":4,"iocs":41,"watch_terms":49,"solutions":50,"lesson":121},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"2546dcdd-017f-4e2a-aae5-accf583ff219","Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files","critical-docker-sandboxes-flaw-lets-malicious-guest-code-read-and-modify-macos-h-c7d368","Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape the project directory shared into it and read or change files anywhere else on the host, Docker warns in a security announcement on September 15. The escape runs with the rights of the host account that runs the virtual machine. The flaw, CVE-2026-77179, is rated Critical, affects versions","A critical vulnerability in Docker Sandboxes for macOS, CVE-2026-77179, allows malicious code within a virtual machine to escape its project directory and access or alter any file on the host system with the user's privileges. A second high-severity flaw, CVE-2026-79994, enables guests to connect to unauthorized Unix domain sockets on the host. Both issues are fixed in version 0.42.0.","Docker Sandboxes flaw allows guest code to read\u002Fmodify macOS host files.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fcritical-docker-sandboxes-flaw-lets.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgJbYvRH1MRTGK43JYSWe2X3djxWAuNa3_r94FvOPBjt9sWrkRiEQi7D0DPksj3NH9vDPjm7MGSGY9UEc7JqePjd4aA-c4zuMzLZXH0Y5NWKWGnzNgbFe0tYlEFSFLrJFWVRuRKs_PQN8IKkdzYYNn8T7YWuUkZC4_2skq3deXYAw7i0aqWdx6G0FQwVzs\u002Fs1600\u002Fdocker-macos.jpg","2026-09-17T15:37:56+00:00","2026-09-18T04:00:07.533027+00:00",9,[17,20],{"name":18,"type":19},"Docker Sandboxes","product",{"name":21,"type":22},"Docker","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[42,46],{"type":43,"value":44,"context":45},"cve","CVE-2026-77179","Critical vulnerability allowing guest code to read\u002Fmodify macOS host files.",{"type":43,"value":47,"context":48},"CVE-2026-79994","High severity vulnerability allowing guest to connect to unauthorized Unix domain sockets.",[21,18],{"controls":51,"vendors":120},[52,81,106],{"slug":53,"name":54,"problem":55,"products":56},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":82,"name":83,"problem":84,"products":85},"patch-management","Automated patch management","Known holes get closed in days, not months.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":82,"product_name":103,"url":104,"description":105},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":107,"name":108,"problem":109,"products":110},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[111,112],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[],{"slug":122,"title":123,"body":124,"framework_refs":125,"framework_notes":136},"docker-sandbox-escape-exposes-macos-host-files-to-guest-code","Docker Sandbox Escape Exposes macOS Host Files to Guest Code","CVE-2026-77179 reveals a critical container\u002FVM sandbox escape flaw in Docker for macOS, where malicious guest code can break out of its isolated project directory and read or modify any host file accessible to the running user. A companion flaw, CVE-2026-79994, further allows guest processes to connect to unauthorized Unix domain sockets on the host, broadening the attack surface significantly. These vulnerabilities undermine the fundamental security promise of containerization — that guest workloads are isolated from the host. The risk is especially severe in developer environments where Docker often runs with elevated user privileges and access to sensitive files such as SSH keys, credentials, and source code. Both flaws are patched in version 0.42.0, making rapid upgrade essential.",[126,127,128,129,130,131,132,133,134,135],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST SP 800-190: Application Container Security Guide","NIST CM-6: Configuration Settings","NIST SI-2: Flaw Remediation","NIST AC-3: Access Enforcement","NIST AC-6: Least Privilege","ITIL Change Management: Emergency Change Procedure","OWASP Docker Security Cheat Sheet",{}]