Loading story…
Researchers introduced NACRE, a RISC-V hardware-software design intended to protect Linux containers even if the host kernel or administrator is compromised. The architecture gives protected processes hardware-recognized container identities and separates host resource-management capabilities from authority to read private container memory or commit protected state. Its design uses an isolated supervisor-mode agent and machine-mode monitor to support container lifecycle functions, including paging, fork, copy-on-write, and teardown.
A QEMU-based prototype modifies QEMU, OpenSBI, Linux, a trusted agent, and runc. The authors reported syscall and pipe performance within 3.5% of the runc baseline and nginx throughput 1.9% lower in an equally weighted aggregate. NACRE remains a research prototype rather than a production control: attestation, secure cross-container sharing and ownership, rollback protection, stale-identity handling, and multicore-concurrency security are still unimplemented or unevaluated, and its performance findings have not been independently reproduced.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Linke Song, Wenhao Wang, Weijie Liu, and Rui Hou submitted a position paper proposing NACRE, a RISC-V hardware-software design for native confidential containers that protects container private state from an untrusted host kernel or administrator. The authors described a QEMU-based prototype extending QEMU, OpenSBI, Linux, a trusted agent, and runc, with preliminary single-container performance results.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed three new `runc` vulnerabilities — `CVE-2025-31133`, `CVE-2025-52565`, and `CVE-2025-52881` — that can let attackers break container isolation and gain root access on the host systems running Docker, Kubernetes, and other platforms built on `runc`. The flaws abuse race conditions, mount manipulation, and redirected writes into `procfs`, including paths such as `/proc/sys/kernel/core_pattern` and `/proc/sysrq-trigger`, to turn container access into host-level impact. Sysdig reported that exploitation requires the ability to launch containers with custom mount configurations, making malicious or untrusted container images and Dockerfiles a likely delivery path, and said no active exploitation had been observed at disclosure. The new issues echo the earlier `CVE-2019-5736` `runC` escape, which allowed container root users to overwrite the host `runC` binary via `/proc/self/exe` and `/proc/[pid]/exe` handling and then execute code as root on the host. That earlier flaw affected Docker by default and also impacted LXC in some configurations, leading maintainers to harden `runC` by re-executing from a sealed in-memory copy created with `memfd_create()`. For the newly disclosed bugs, fixed releases are `runc` `1.2.8`, `1.3.3`, and `1.4.0-rc.3` or later, and defenders were advised to monitor for suspicious symlink creation and other attempts to target sensitive `procfs` entries from inside containers.
Jun 29, 2026
Security research highlighted a continued shift in attacker tradecraft toward **Linux cloud and container environments**, with stealth-focused malware increasingly abusing modern kernel capabilities. Elastic Security Labs documented the evolution of Linux rootkits from userland hijacking and LKM implants to newer generations that leverage **eBPF** and **io_uring** for stealth and evasion, citing examples including **TripleCross**, **Boopkit**, and **RingReaper**. Separately, reporting on **VoidLink** described a cloud-native malware framework designed to operate inside Linux workloads, detect whether it is running in major cloud providers and in **Docker/Kubernetes**, and adapt its behavior to remain persistent while harvesting sensitive material such as cloud metadata and credentials. Operationally, the same kernel features and observability gaps being leveraged by attackers are also driving defensive tooling improvements. Trail of Bits released *mquire*, an open-source Linux memory forensics tool intended to reduce dependency on external debug symbols by extracting structure and symbol information directly from memory using **BPF Type Format (BTF)** and **Kallsyms** (e.g., `/proc/kallsyms`-style data), then exposing findings through an interactive **SQL** query interface. While *mquire* is not tied to a single named campaign, it is directly relevant to investigating advanced Linux threats (including kernel-level implants and stealthy cloud malware) by enabling more reliable post-compromise analysis of Linux memory dumps across kernel versions.
Jul 12, 2026
Microsoft disclosed multiple vulnerabilities in **Azure Container Instances (ACI) Confidential Containers**, including **elevation of privilege** issues tracked as `CVE-2026-21522` and `CVE-2026-26124`, and an **information disclosure** flaw tracked as `CVE-2026-23655`. The advisories indicate security weaknesses affecting confidential container deployments, a technology intended to isolate sensitive workloads with stronger runtime protections. The disclosures come against a broader backdrop of container isolation concerns highlighted by **NVIDIAScape**, a vulnerability in the **NVIDIA Container Toolkit** tracked as `CVE-2025-23266`. Security researchers reported that the NVIDIA flaw could allow attackers to break container boundaries in AI and GPU-enabled environments, underscoring how weaknesses in container runtimes and supporting infrastructure can undermine assumptions about workload isolation even in hardened or confidential computing deployments.
Jul 12, 2026