Loading story…
Docker has announced that its catalog of over 1,000 Docker Hardened Images (DHI) is now freely available and open source for all developers and organizations. These images, built on open source distributions like Debian and Alpine, are released under the Apache 2.0 license and are accessible through Docker Hub and related distribution points. The hardened images are designed to provide a secure, minimal, and production-ready foundation for containerized applications, integrating features such as software bill of materials (SBOM), public CVE data, SLSA Build Level 3 provenance, and cryptographic authenticity.
Docker's move aims to reduce supply chain risks and the attack surface at the container layer by offering rootless images stripped of unnecessary components and free of known vulnerabilities. The company has also introduced tooling, including a Docker AI assistant extension, to help developers identify and replace existing images with hardened equivalents. While the images remain SBOM-verifiable and maintain a high security standard, the 7-day critical CVE patching commitment is still exclusive to certain users. This initiative is intended to set a new industry standard for secure software development and supply chain transparency.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Docker released more than 1,000 Docker Hardened Images as a free, open-source offering under the Apache 2.0 license, expanding what had previously been a commercial-only product. The images were presented as secure, minimal, production-ready container bases with SBOMs, SLSA Build Level 3 provenance, CVE status data, and cryptographic authenticity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Container images used in cloud deployments often contain unnecessary components, leading to hundreds of vulnerabilities per image, as highlighted by studies from Chainguard and NetRise. To address this, several companies, including Docker and BellSoft, are developing and promoting hardened container images that strip out non-essential software, package managers, and other potential attack vectors. These slimmed-down images are designed to include only the minimum required components, significantly reducing the number of known vulnerabilities and improving the overall security posture of containerized applications. BellSoft has introduced its own Hardened Images, focusing on Java runtime optimization, custom maintenance for Alpaquita Linux OS, and proactive vulnerability remediation. This approach aligns with a broader industry trend, with vendors like Chainguard and Docker also offering secure, minimal images to help developers deploy safer applications in Kubernetes and other cloud-native environments. The adoption of hardened images is seen as a critical step in mitigating the growing threat of container-targeted cyberattacks and streamlining security processes for organizations relying on container technology.
Jul 12, 2026
Security researchers at Flare have discovered that over 10,000 public Docker Hub container images are leaking sensitive secrets, including live credentials for production systems, cloud services, CI/CD pipelines, and AI platforms. The exposed data affects more than 100 organizations, ranging from small businesses to a Fortune 500 company and a major national bank. Many of these secrets are not placeholders but active credentials, with nearly 4,000 API keys for large language models such as OpenAI, HuggingFace, Anthropic, Gemini, and Groq found in the wild. In some cases, a single image contained five or more exposed secrets, significantly increasing the risk of unauthorized access to critical infrastructure. The leaks are often the result of developers inadvertently including sensitive files and hard-coded keys in Docker images, which are then published to public repositories. A notable portion of the exposed secrets comes from "shadow IT" accounts—personal or team Docker Hub registries outside formal corporate oversight—making them difficult for organizations to monitor and secure. The majority of affected organizations are in the software development sector, but the exposure also impacts finance, banking, and AI companies. This incident highlights the urgent need for improved security hygiene and automated scanning in the container development lifecycle to prevent inadvertent credential leaks.
Jun 29, 2026
Security researchers have identified a significant increase in destructive malware embedded within open source packages across major ecosystems such as npm, PyPI, NuGet, Go modules, and Docker Hub. Unlike financially motivated threats like cryptominers or credential stealers, these malicious packages are designed to inflict operational damage by deleting source code, wiping repositories, breaking builds, or sabotaging developer environments. Attackers often disguise these packages as legitimate developer tools or utilities, leveraging trusted registries to maximize reach and impact. The destructive payloads are frequently delayed or remotely controlled, allowing threat actors to time their attacks for maximum disruption while evading early detection. In CI/CD environments, a single compromised dependency can propagate rapidly, amplifying the operational fallout before the threat is identified and contained. Recent research highlights that Docker Hub, a widely used container registry, has also become a vector for supply-chain attacks, with malicious images distributed at scale to facilitate cryptomining and potentially more destructive activities. These campaigns exploit the implicit trust developers and organizations place in public registries, as well as the automated nature of modern software pipelines. Security teams are urged to extend supply-chain security controls beyond source code to include container images and other artifacts, as attackers continue to innovate in their methods for infiltrating and sabotaging software development and deployment workflows.
Jun 29, 2026