Loading story…
Container images used in cloud deployments often contain unnecessary components, leading to hundreds of vulnerabilities per image, as highlighted by studies from Chainguard and NetRise. To address this, several companies, including Docker and BellSoft, are developing and promoting hardened container images that strip out non-essential software, package managers, and other potential attack vectors. These slimmed-down images are designed to include only the minimum required components, significantly reducing the number of known vulnerabilities and improving the overall security posture of containerized applications.
BellSoft has introduced its own Hardened Images, focusing on Java runtime optimization, custom maintenance for Alpaquita Linux OS, and proactive vulnerability remediation. This approach aligns with a broader industry trend, with vendors like Chainguard and Docker also offering secure, minimal images to help developers deploy safer applications in Kubernetes and other cloud-native environments. The adoption of hardened images is seen as a critical step in mitigating the growing threat of container-targeted cyberattacks and streamlining security processes for organizations relying on container technology.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
BellSoft announced Hardened Images, a container security offering aimed at reducing vulnerabilities in containerized environments by using more secure base images. The launch was reported as a response to rising cyber threats and common weaknesses in standard container images.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Docker has announced that its catalog of over 1,000 Docker Hardened Images (DHI) is now freely available and open source for all developers and organizations. These images, built on open source distributions like Debian and Alpine, are released under the Apache 2.0 license and are accessible through Docker Hub and related distribution points. The hardened images are designed to provide a secure, minimal, and production-ready foundation for containerized applications, integrating features such as software bill of materials (SBOM), public CVE data, SLSA Build Level 3 provenance, and cryptographic authenticity. Docker's move aims to reduce supply chain risks and the attack surface at the container layer by offering rootless images stripped of unnecessary components and free of known vulnerabilities. The company has also introduced tooling, including a Docker AI assistant extension, to help developers identify and replace existing images with hardened equivalents. While the images remain SBOM-verifiable and maintain a high security standard, the 7-day critical CVE patching commitment is still exclusive to certain users. This initiative is intended to set a new industry standard for secure software development and supply chain transparency.
Jun 29, 2026
dCERT issued advisories for **multiple vulnerabilities** affecting **Red Hat Hardened Images RPMs**, identifying the issue in notices `2026-1205` and `2026-1246`. The advisories indicate that security flaws were found in RPM packages used within Red Hat hardened container images, potentially exposing systems that rely on those images to a range of risks depending on the affected packages and deployed workloads. The publication of two separate dCERT notices suggests ongoing or updated vendor guidance around the same product area, and organizations using Red Hat hardened images should review the referenced advisories, determine which RPMs and image versions are affected, and prioritize remediation through updated packages or rebuilt images. Security teams should also verify downstream dependencies in container registries and production environments to ensure vulnerable image layers are replaced.
Jun 29, 2026
Security researchers at Flare have discovered that over 10,000 public Docker Hub container images are leaking sensitive secrets, including live credentials for production systems, cloud services, CI/CD pipelines, and AI platforms. The exposed data affects more than 100 organizations, ranging from small businesses to a Fortune 500 company and a major national bank. Many of these secrets are not placeholders but active credentials, with nearly 4,000 API keys for large language models such as OpenAI, HuggingFace, Anthropic, Gemini, and Groq found in the wild. In some cases, a single image contained five or more exposed secrets, significantly increasing the risk of unauthorized access to critical infrastructure. The leaks are often the result of developers inadvertently including sensitive files and hard-coded keys in Docker images, which are then published to public repositories. A notable portion of the exposed secrets comes from "shadow IT" accounts—personal or team Docker Hub registries outside formal corporate oversight—making them difficult for organizations to monitor and secure. The majority of affected organizations are in the software development sector, but the exposure also impacts finance, banking, and AI companies. This incident highlights the urgent need for improved security hygiene and automated scanning in the container development lifecycle to prevent inadvertent credential leaks.
Jun 29, 2026