CVE-2026-77179Patch

We escaped Docker's hypervisor with three lines of bash. CVE-2026-77179: A container gets complete read and write access to the host filesystem. When you mount a folder into a container, Docker's VMM uses virtio-fs, and the file server runs on the host. Because of a TOCTOU bug, if a container opens a file, deletes it while holding its file handle open, and replaces the parent folder with a symlink, the kernel will follow the symlink to anywhere on the host. Full technical breakdown: https://www.accomplish.ai/blog/escaping-dockers-hypervisor/

‼️ ALERT - Critical Docker Sandboxes flaw lets malicious guest code escape the shared workspace and read or modify files across a macOS host. CVE-2026-77179 crosses the virtio-fs boundary with the host account’s rights. Read how the escape works → https://thehackernews.com/2026/09/critical-docker-sandboxes-flaw-lets.html

Shabbat Shalom. @Docker has issued a critical level (!!) CVE-2026-77179, reported by @Accomplish_ai researcher @orenyomtov. If you use Docker Sandboxes, run sbx --version. Make sure you’re running 0.42.0 or later. If you use Docker Desktop, you want 4.88.0 or later Docker Desktop and Docker Sandboxes are both affected. Docker Desktop is only affected if Docker VMM is turned on in Settings. It’s a good thing we found it now, because Docker VMM is scheduled to become the default for Docker Desktop at the end of October 2026! The escape is in Docker's hypervisor for Mac: a container gets complete read and write access to the host filesystem. Read the full details of this escape in our blog: https://www.accomplish.ai/blog/escaping-dockers-hypervisor/

Vulnerabilidades críticas en Docker permiten escapar de microVMs aisladas Docker ha solucionado dos vulnerabilidades graves (CVE-2026-77179 y CVE-2026-79994) en Docker Sandboxes https://blog.elhacker.net/2026/09/vulnerabilidades-criticas-en-docker.html

🚨 CRITICAL: CVE-2026-77179 (CVSS 9.4) allows malicious code inside Docker Sandboxes to escape the shared workspace and read or modify arbitrary macOS host files. The flaw affects the virtio-fs host server and can potentially lead to host code execution with the VMM user's privileges. ⚠️ Docker Sandboxes 0.28.0–<0.42.0 on macOS are affected. 🔴 Fixed in Docker Sandboxes 0.42.0. Update immediately. 🔗 Docker Security Advisory: https://docs.docker.com/security/security-announcements/ #Docker #macOS #CVE #CyberSecurity #Infosec

🍎🚨 CRITICAL DOCKER MACOS SANDBOX ESCAPE — GUEST CODE CAN READ/WRITE HOST FILES Accomplish researcher Oren Yomtov disclosed a critical escape in Docker’s Mac hypervisor, tracked as CVE-2026-77179 (CVSS 9.4). • A malicious container/guest can escape its shared workspace and gain read/write access to arbitrary files accessible to the macOS host user • The researcher’s PoC reduces the escape to three lines of bash • The flaw is in Docker’s virtio-fs host server: a stored path can be redirected through a symlink after the original file/directory is removed • Docker Desktop is affected when Docker VMM is enabled • Docker Sandboxes before 0.42.0 are affected on macOS • Fixed in Docker Desktop 4.88.0+ and Docker Sandboxes 0.42.0+ • Docker’s vendor advisory says the impact can potentially lead to host code execution • No confirmed exploitation in the wild has been reported ⚠️ Analyst Note: This is especially relevant to AI-agent workflows. Sandboxes are intended to contain untrusted or agent-executed code; a guest-to-host filesystem escape undermines that security boundary and could expose SSH keys, credentials, environment files and source code outside the agent’s assigned workspace. The researcher reported the issue August 12. Docker committed a fix roughly 31 hours later; the full technical disclosure was published September 19. Original researcher disclosure: https://www.accomplish.ai/blog/escaping-dockers-hypervisor/ Docker advisory: https://docs.docker.com/security/security-announcements/ #Docker #macOS #CVE202677179 #SandboxEscape #AISecurity #CyberSecurity #DDW

Containers don't contain, but VMs don't contain either :-) Latest example, Docker Sandboxes where a vulnerability in virtio-fs host server allows a host breakout / code execution (CVE-2026-77179). There's also CVE-2026-79994, another symlink related bug (with Unix domain sockets).

CVE-2026-77179: Docker container escape to the macOS filesystem Read on dbugs: https://dbu.gs/news/cve-2026-77179-docker-container-escape-to-the-macos-filesystem-20260924 Researcher Oren Yomtov of Accomplish discovered CVE-2026-77179 (https://dbu.gs/vulnerability/CVE-2026-77179) — a sandbox escape in Docker’s hypervisor for Mac that allows code running inside a container to gain complete read and write access to the host filesystem. The issue lies in virtio-fs, which Docker VMM uses to expose mounted directories to containers. When the guest first accesses a path, the file server returns a "nodeid" and stores the path. On subsequent requests, the guest refers to the file by "nodeid", so the server has to resolve it again. It first tries to locate the file by inode through macOS "volfs"; if that fails, it falls back to the path string saved during the initial lookup. The attacker creates and opens a file inside the permitted mount and keeps the handle open, preventing the server from dropping its "nodeid". The file and its parent directory are then deleted, removing the "volfs" path, and the directory is replaced with a symbolic link to an arbitrary location on the host. When virtio-fs falls back to the stored path, its check still sees a path inside the permitted mount, but macOS follows the symlink when opening it and resolves the request outside the mount. This gives the container access to host files. The author demonstrates the escape in just three lines of Bash. This is not a remote attack on its own: an attacker needs the ability to execute code inside the container. The issue is particularly relevant to AI agents, which routinely execute untrusted code and rely on the sandbox to isolate it from the host system. The vulnerability was fixed in Docker Sandboxes 0.42.0 and Docker Desktop 4.88.0. Docker Desktop is affected on macOS only when Docker VMM is selected as the Virtual Machine Manager. Docker committed the fix to Sailor, the internal name of its hypervisor, about 31 hours after receiving the report. Docker Desktop 4.88.0 shipped the fix on August 24, and Docker Sandboxes 0.42.0 followed on September 7. Article: https://www.accomplish.ai/blog/escaping-dockers-hypervisor/ CVE-2026-77179 — PT-2026-92018: https://dbu.gs/vulnerability/PT-2026-92018

🚨 CVE-2026-77179 Docker VMM on Mac container opens a file. deletes it. replaces the parent with a symlink. virtio-fs still has the old path string. kernel follows the symlink. host filesystem R/W. three lines of bash. Docker Desktop + Docker Sandboxes. Docker VMM becomes default end of October. this landed first. fixed in Desktop 4.88.0 / Sandboxes 0.42.0 https://www.accomplish.ai/blog/escaping-dockers-hypervisor/ credit: @Accomplish_ai #ExploitDev #CloudSecurity #InfoSec

CVE-2026-77179: Docker's hypervisor for Mac compromised (Docker Desktop, Docker Sandboxes) https://www.accomplish.ai/blog/escaping-dockers-hypervisor/

现在各家都在搞 sandbox，睡前顺手发两个高危漏洞， 大家也方便自查一下。 CVE-2026-77179 和 CVE-2026-79994，评分 9.4 和 8.7 ， 正好在打 Docker Sandbox。 ​ ​当然，最近还有很多其他的，都没幸免 🤣 过些天看情况再说 https://t.co/9sn4KwCE6I

Docker Sandboxes (microVM layer for Claude Code / Codex / Cursor / Copilot / etc.) closed two macOS host escapes: • CVE-2026-77179 (CVSS 9.4): virtio-fs symlink race → read/modify arbitrary host files as the VMM user • CVE-2026-79994 (8.7): Unix-socket relay TOCTOU → arbitrary AF_UNIX on the host Fixed in 0.42.0 (also D-Bus host-command + cross-sandbox OAuth hijack). Docs said symlinks outside the workspace aren't followed. They were — at reopen time, not check time. CTO take: a sandbox promise is only as real as the path the guest reuses after the check. Upgrade; until then prefer clone mode over RW mounts.

Docker assigned CVE-2026-77179 to its own Sandboxes product. On macOS, the virtio-fs host server followed a symlink when it reopened an unlinked file from a stored path. A guest that could replace a parent directory walked out of the shared workspace and read or wrote host files as the VMM user. Docker’s own record says that can become host code execution. Affected: Sandboxes 0.28.0 through anything before 0.42.0. Researcher Oren Yomtov at Accomplish said three lines of bash were enough. They reported it 12 Aug 2026. Docker confirmed two days later. Desktop 4.88.0 shipped 24 Aug with sailor 0.118.0. Sandboxes 0.42.0 shipped 7 Sep. The CVE record published 15 Sep. 0.42.0 also closed CVE-2026-79994, a socket-relay race. That one made the release notes. The virtio-fs write did not. Workaround language on the CVE card: use --clone and do not add extra read-write host mounts. No public KEV as of 22 Sep 2026. CISA-ADP SSVC on the record: exploitation none, automatable no, technical impact total. What it is not: a fleet-wide unauthenticated RCE. You need guest code that can touch the shared workspace. That is still the default path if you let an agent or untrusted repo run inside the sandbox with a bind mount. What I would take into the room: 1. On every Mac that runs Sandboxes, run sbx --version. Anything under 0.42.0 is the list. Desktop needs 4.88.0 or later, and Settings → General → Virtual Machine Manager should not be an older Docker VMM. 2. Inventory extra read-write host mounts. If the job can run --clone, that is the temporary control, not a policy essay. 3. Treat “sandbox” as the VMM user’s filesystem rights until you can screenshot the version. Keys, SSH agent sockets, and .env files in the home directory are in scope. 4. Ask one numbered vendor question: which 0.42.0 note maps to CVE-2026-77179, and did Desktop 4.88.0 and Sandboxes 0.42.0 ship the same virtio-fs change? Primary: CVE-2026-77179, Docker Inc. CNA, updated 15 Sep 2026. https://www.cve.org/CVERecord?id=CVE-2026-77179 Researcher write-up: Oren Yomtov, “Guest to host: escaping Docker’s hypervisor,” Accomplish, 19 Sep 2026. https://accomplish.ai/blog/escaping-dockers-hypervisor/ Fix tag: Docker Sandboxes v0.42.0. https://github.com/docker/sbx-releases/releases/tag/v0.42.0 Anyone already forcing 0.42.0 / Desktop 4.88.0 on Macs that let agents write into a bind-mounted workspace? #Docker #CVE202677179 #MacOS

Docker disclosed two Docker Sandboxes vulnerabilities that can allow malicious guest environments to escape workspace isolation and access host resources. CVE-2026-77179, affecting macOS versions before 0.42.0, enables symlink-race redirection of filesystem operations, potentially permitting arbitrary file read/write and host code execution. CVE-2026-79994, affecting versions before 0.42.0, can redirect guest-to-host Unix socket connections to unauthorized AF_UNIX sockets, enabling data disclosure or access to host-side functions. Docker recommends upgrading to 0.42.0 or later, using clone mode, removing writable host mounts, and minimizing sensitive data in shared paths. VULNERABILITY CVE-2026-17106 CVE-2026-2664 CVE-2026-28400 CVE-2026-33990 CVE-2026-5817 CVE-2026-5843 CVE-2026-77179 CVE-2026-79994

CVE-2026-77179: three lines of bash inside a container got full read/write on a macOS host through Docker's VMM. The bug is patched (Desktop 4.88.0, Sandboxes 0.42.0). The lesson isn't. The exploit needed one thing from you: a writable bind mount. So docker-doctor now checks for exactly that. 🧵

Docker released an update for critical Docker Sandboxes vulnerabilities (CVE-2026-77179, CVE-2026-79994). Patch these Docker Sandboxes vulnerabilities today. #Docker #DockerSandboxes #CVE202677179 #CVE202679994 #Cybersecurity https://securityonline.info/docker-sandboxes-vulnerabilities-patched/

Docker Sandboxes on macOS could follow a symlink out of the workspace and touch host files (CVE-2026-77179). Fixed in 0.42.0; if you’re still on an older build, upgrade. https://nvd.nist.gov/vuln/detail/CVE-2026-77179

#Analytics #Threat_Research An analytical review of the main cybersecurity events (Sep 19-26, 2026) 1⃣. Simple MacOS Docker Escape https://www.accomplish.ai/blog/escaping-dockers-hypervisor // CVE-2026-77179 2⃣. Brevo ClickFix Compromise https://status.brevo.com/incidents/01M2QBC4EZ24ZACW6SWQYVW8N3/write-up // malicious "ClickFix" script served via Brevo's Cloudflare account 3⃣. LastPass (and other) lookalike GitHub Repo and Kernel Module Infostealer https://blog.lastpass.com/posts/lastpass-delphos-report-rapuncel-infostealer 4⃣. How One Twitch Chat Message Became Code Execution on a Streamer’s PC https://blog.scrt.ch/2026/09/22/how-one-twitch-chat-message-became-code-execution-on-a-streamers-pc/ // Target: OBS Studio 32.2.2 on an updated Windows 11 5⃣. macOS MacSync Malware Update https://securelist.com/macsync-new-version/121383 // The new version of the MacSync infostealer differs quite significantly from its previously variants 6⃣. Send GitLab an email, push to main https://www.aikido.dev/blog/gitlab-email-push-to-main 7⃣. F5 Big-IP Vulnerability Details https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127 CVE-2026-94127 8⃣. Deterministic Cryptographic Network Covert Channel & Shannon Entropy Leak Detector https://github.com/prox0959/SpectralCovert 9⃣. Malicious Firefox Extension [Yet Another] https://socket.dev/blog/firefox-google-account-takeover 10. Bypassing EDR with Local AI https://projectblack.io/blog/bypassing-edr-with-local-ai/ // How hard is it to bypass EDR in the modern times with AI? As it turns out, not very hard.. 11. http://www.cyberpocket.org 12. http://www.kismoe.com

🔒 CYBERSECURITY, PRIVACY & OPEN SOURCE ROUNDUP — September 19, 2026 1️⃣ DOCKER HYPERVISOR ESCAPE: THREE LINES OF BASH UNLOCK THE HOST FILESYSTEM A container that is supposed to be locked away just got full read and write access to the machine running it. In CVE-2026-77179, Docker's virtual machine monitor relies on virtio-fs, and the file server runs on the host side. Because of a time-of-check-to-time-of-use flaw, a container can open a file, delete it while still holding the handle, and replace the parent folder with a symlink — the kernel then follows that link to anywhere on the host. The whole chain takes three lines of bash, and the researcher published a full technical breakdown of the escape. 🔹 @orenyomtov 2️⃣ GOOGLE PIXEL MODEM ZERO-DAY IS BEING EXPLOITED IN THE WILD Google confirmed that a zero-click vulnerability in the Pixel cellular modem is already being used in limited, targeted attacks. A logic error lets an attacker bypass permission checks and gain elevated access on the device, with one constraint: the attacker needs to be physically nearby. The September security update (patch level 2026-09-05 or later) fixes CVE-2026-58704, and CISA has added it to its Known Exploited Vulnerabilities catalog. 🔹 @IntCyberDigest 3️⃣ N8N GETS A CVSS 10.0 PUBLIC EXPLOIT The popular open-source workflow automation tool n8n just received a fully weaponized vulnerability: CVE-2026-21858, nicknamed "Ni8mare," scores a perfect 10.0. It starts with an unauthenticated file read and escalates to full remote code execution, and a working proof of concept is already circulating. Any internet-facing n8n instance that missed the patch is one request away from being fully compromised. 🔹 @PadhiyarRushi 4️⃣ BREVO SUPPLY-CHAIN ATTACK REACHES OVER 100,000 WEBSITES A supply-chain attack against the Brevo email platform may have affected more than 100,000 websites through infrastructure they already trusted. Attackers used a compromised Cloudflare API key to deploy a malicious worker that modified Brevo-hosted scripts at the edge: visitors were shown fake "prove you're human" click-fix prompts, while logged-in WordPress admins could have a malicious plugin installed through their active session. Brevo's origin files stayed clean, which makes the attack even harder to spot. 🔹 @Huntio 5️⃣ SOLARWINDS ARM: A HARD-CODED KEY OPENS THE DOOR TO REMOTE CODE EXECUTION SolarWinds disclosed a hard-coded static key in its Application Resource Management product that can be abused for unauthenticated remote code execution. CVE-2026-28326 affects ARM 2026.2 and earlier, and is fixed in 2026.2.1. The company did not report any in-the-wild exploitation, but a static key of this kind is exactly the sort of thing scanners look for. 🔹 @TheHackersNews 6️⃣ PUBLIC CVE DISCLOSURES ARE ACCELERATING AT A TERRIFYING PACE A data point worth pausing on: tallying publicly disclosed CVEs month by month, the recent trend looks alarming — and the global surge in vulnerability hunting activity suggests this is only the beginning. The researcher behind the analysis expects the numbers to jump by an order of magnitude in the coming months, which means patching cadence and exposure reduction are no longer optional hygiene. 🔹 @nekono_naha 7️⃣ UBUNTU 26.10 MOVES TO THE LINUX 7.3 KERNEL Ubuntu 26.10, the latest interim release of the always-changing flavor, is shipping with the Linux 7.3 kernel. For people who track where the desktop distribution stands, it marks another step in Ubuntu's steady climb toward the newest mainline kernel features. 🔹 @phoronix 8️⃣ IPHONE LOCKDOWN MODE JUST BEAT AN FBI EXTRACTION ATTEMPT Apple's Lockdown Mode is having a moment: the FBI said it was unable to extract data from a journalist's iPhone because the device had Lockdown Mode enabled. The setting is not a magic shield, but it drastically shrinks the attack surface by restricting features that sophisticated attacks rely on, from certain attachments and FaceTime requests to configuration profiles and untrusted wireless connections. 🔹 @cyber_razz 💭 The common thread this week is that every boundary we assumed was solid turned out to have a door: a container "wall" that a symlink walks through, a modem that gets hit with zero clicks before the phone is even unlocked, an email platform trusted by 100,000 sites that was bent through a single API key. The lesson is not to panic — it is to treat isolation, patching cadence, and least privilege as the actual product, because in 2026 the trust you assume is the thing that gets exploited. Which of these hits closest to home — containerized servers, the phone in your pocket, or a website you help run? Tell me below 👇 #CyberSecurity #OpenSource #Privacy

A security report says Docker Sandboxes can let an AI coding agent's code leave its project folder and change files on the host. It's tracked as CVE-2026-77179. Coding agents with terminal access are supposed to stay inside the project. If the sandbox does not hold, the agent can change real files on your machine. That is a rough failure mode. https://x.com/GautamS30179916/status/2100908190569496651