Discussions, questions and news about Kubernetes from cybersecurity professionals on Cyberr.
0 members · 28 posts
Quinton Plaatjies — SOC Engineer
“Kali Linux 2026.3 Released With New Security Tools, Easier Custom Builds and Expanded NetHunter Capabilities” indicates a major update to Kali Linux, the penetration testing and security assessment distribution maintained by Offensive Security. What is Kali Linux? Kali Linux is…
· 1 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
Your AI model may be secure. Your AI supply chain might not be. Think about everything surrounding a modern AI application. Open-source packages. Models. Plugins. MCP servers. APIs. Vector databases. Cloud services. Third-party tools. Container images. CI/CD pipelines. Every con…
· 3 reactions · 0 comments
Naman Mahna — Software Engineer
☁️ AI DevOps Copilot — Building an AI-Powered, Cloud-Native DevOps Platform What if a DevOps platform could do more than display dashboards—what if it could help engineers investigate failures, understand operational dependencies, and make troubleshooting more intelligent? That…
· 7 reactions · 2 comments
samuel watua Soita — Full Stack Software Engineer
The cloud didn't eliminate the perimeter. It moved the perimeter into identity. This is one of the biggest shifts in modern cybersecurity. Your infrastructure may be protected by: Firewalls. WAFs. EDR. Network segmentation. DDoS protection. But if an attacker obtains a highly pr…
· 1 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
container_escape_audit.sh v4.8.4 — built for the kernels Kubernetes actually runs on An update to the read-only container-escape and LPE auditor, focused on the Linux distributions you actually find under Kubernetes nodes, plus two fresh CVEs. Node-OS coverage. The CVE engine no…
· 9 reactions · 6 comments
Mario Matkovski — Independent Threat Researcher | Ransomware Intelligence & OSINT
Beyond the Leak Site: What the Azazel Case Reveals About Ransomware Attribution Independent Threat Research | 12 October 2026 Introduction Ransomware data leak sites are a valuable source of threat intelligence. They provide visibility into victim claims, extortion activity, and…
· 5 reactions · 8 comments
Steven Daignault — Consultant
I'd like to experiment with 'paired' persona context engineering in my next position managing an objective or mission such as an InfoSec IAM modernization program. What this means is standing up a side-by-side team of AI personas to perform the same InfoSec program functions the…
· 7 reactions · 4 comments
Schomer — Principal Security Solutions Architect & Founder
The boundaries are collapsing everywhere you look. Check out the breaking intel on the feed right now. We aren't just dealing with basic application bugs anymore—we are looking at structural engineering failures across the board: 🔘 Zero-Click Ad Spyware: Adversaries are deployi…
· 4 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
container_escape_audit.sh v4.8.2: check 30 expanded from 8 → 26 RBAC probes, closing every gap we identified: * Escalation self-grant: escalate on roles/clusterroles, plus create clusterrolebindings and create rolebindings alongside the existing bind. * Full impersonation set: i…
· 3 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
container_escape_audit.sh v4.8.1 — now detecting the DepthFirst container escapes. Following DepthFirst's "Containers Are No Longer a Security Boundary" disclosure (Sept 22), the read-only container-escape/LPE auditor now covers both kernel bugs from it: CVE-2026-80521 — an AF_U…
· 4 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
☸️ Cloud Security Architecture Check: How a single Kubernetes YAML file can hand over control of an entire GCP organization. Varonis just documented a massive "confused deputy" flaw where a Kubernetes user with limited privileges can escalate execution authority across the entir…
· 2 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
container_escape_audit.sh — recent updates (v4.7.9) A quick update on the read-only container-escape and privilege-escalation auditor for Linux and Kubernetes nodes — a single Bash script, no dependencies, makes zero changes to the host it runs on. The last few releases have pus…
· 3 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
K8s-container_escape_audit v4.8.0 Released CVE database: 43 → 51 entries (done as conf-only work under v4.7.9, then bundled into the v4.8.0 release) xfrm nat_keepalive double-free (CVE-2026-72137) — local LPE via CAP_NET_ADMIN/userns; scored HIGH/7.8 with the published 9.8 secon…
· 2 reactions · 0 comments
Zane Anderson — Security Consultant
IoT Search Engines: The Attack Surface You Can't See. The Bottom Line: If you're not hunting your own infrastructure on Shodan, someone else is. And they're probably doing it faster. IoT search engines have evolved from curiosity to core adversary infrastructure. IABs, ransomwar…
· 2 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
New in the K8s_container-escape-audit CVE database: two Linux kernel local privilege escalations, both of the page-cache-poisoning class that's dominated kernel LPE disclosures this quarter. CVE-2026-43503 — "DirtyClone" (CVSS 8.8) The fourth member of the DirtyFrag family. The…
· 5 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
v4.7.4 — containerd CRI-plugin cluster + CrackArmor v4.7.4 closes two container-escape coverage gaps found while reviewing advisories published since the last sweep. The CVE database grows from 32 to 38 entries; the check count stays at 53. containerd CRI-plugin cluster (AWS bul…
· 3 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
New release: K8s-container_escape_audit v4.7.6 — two new container-escape / LPE checks. Both of these are local-root bugs that matter inside containers, not just on desktops: ▸ CVE-2026-64600 (RefluXFS) — XFS reflink CoW race (Qualys). Concurrent O_DIRECT writes to a reflinked f…
· 2 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
Kubernetes Container Escape Audit v4.7.3: catching a Docker daemon bypass your policy engine can't see Most of what container_escape_audit.sh checks lives inside the container looking out — capabilities, mounts, kernel exposure, runtime binaries reachable through a host path. v4…
· 3 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
container_escape_audit.sh v4.7.7 — deeper AppArmor & SELinux coverage Most tooling answers one question about mandatory access control: is AppArmor/SELinux switched on? The problem is that "on" hides a lot. A profile in complain mode logs policy violations but allows them, to an…
· 1 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
Updated the CVE database in K8s-container_escape_audit with three new Linux kernel issues worth checking your hosts against: 🔹 CVE-2026-46333 — ptrace credential-hijack LPE (Qualys TRU). Public exploits circulating. Vulnerable code goes back years, but the practical path is gat…
· 3 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
K8s Container Escape Audit has just released version 4.4. This read-only bash script is designed to be run inside a pod to identify escape vectors to the node, specifically aimed at penetration testers and security teams conducting authorized assessments. What's new in this rele…
· 2 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
K8s container-escape-audit v4.7.5: → New CVE-2026-46215 — use-after-free in the DRM GEM change_handle ioctl. Any process that can open a /dev/dri render node reaches passwordless root; a public PoC also bypasses the DirtyPipe fix. → New check 54 probes render-node reachability —…
· 1 reactions · 0 comments
Jovan Gazivoda — Senior Infrastructure & Security Engineer
Has successfully verified Certified Kubernetes Administrator (CNCF), Cisco Certified Network Associate (Cisco) and 2 more certifications
· 0 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
container_escape_audit v4.7.2 — rolling up the 4.7.x line A bigger update than the version bump suggests. Since 4.6: Container OS support actually fixed, not just claimed — Amazon Linux, SUSE, OpenShift/RHCOS, and Azure Linux nodes were silently falling through to "unknown" beca…
· 1 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
Just released an open-source bash checker for CIFSwitch (CVE-2026-46243) — the 19-year-old Linux kernel LPE disclosed last week that lets any unprivileged local user get root by abusing the CIFS/SPNEGO upcall path. The script runs on bare-metal, VMs, and inside containers, and i…
· 2 reactions · 0 comments