Mitigating Leaky Vessels Vulnerabilities in runc, BuildKit and Moby with Aqua

Aqua Cloud Native Blog

Expert insight, best practices and advice on cloud native security, trends, threat intelligence and compliance.

SECURITY RESEARCH
Mitigating Leaky Vessels Vulnerabilities in runc, BuildKit and Moby with Aqua
Threat Alert
On January 31, 2024, researchers revealed the discovery of four severe security vulnerabilities in the container ecosystem. These vulnerabilities, affecting key components including runc, BuildKit, Moby (Docker Engine), and Docker Desktop, pose significant risks to the security and integrity of applications that use containerization applications.  
Read more
SECURITY RESEARCH
HeadCrab 2.0: Evolving Threat in Redis Malware Landscape
At the beginning of 2023, Aqua Nautilus researchers uncovered HeadCrab – an advanced threat actor utilizing a state-of-the-art, custom-made malware that compromised 1,200 Redis servers. As you know in the ever-evolving world of cybersecurity, threat actors continually adapt and refine their techniques. Recently, our researchers detected a new version of the HeadCrab malware targeting our …
Read more
SECURITY RESEARCH
The Gaps in Open Source Governance That Threaten the Software Supply Chain
Security Threat
The widespread issue of unmaintained and deprecated npm packages recently discovered by Aqua researchers affects more than a fifth of open source packages. Presenting yet another silent example of hidden threats to the software supply chain, it demonstrates how poor operational and structural integrity of dependencies can be just as risky as code vulnerabilities, while …
Read more
SECURITY RESEARCH
Deceptive Deprecation: The Truth About npm Deprecated Packages
Threat Alert
Researchers at Aqua Nautilus found that 8.2% percent of the most downloaded npm packages are officially deprecated, but due to inconsistent practices in handling package dependencies, the real number is much larger, closer to 21.2%. Moreover, some package maintainers, when confronted with security flaws, deprecate their packages instead of reporting them, getting a CVE assigned …
Read more
SECURITY RESEARCH
Apache Applications Targeted by Stealthy Attacker
Threat Alert
Researchers at Aqua Nautilus have uncovered a new attack targeting Apache Hadoop and Flink applications. This attack is particularly intriguing due to the attacker’s use of packers and rootkits to conceal the malware. The simplicity with which these techniques are employed presents a significant challenge to traditional security defenses.
Read more
Expert Insights
2024 Cybersecurity Trends: AI, Cloud, and Threat Intelligence
As we begin this new year, we see the landscape of cybersecurity poised to witness a surge in AI-driven attacks, propelling the industry into a rapid cycle of innovation. Defenders are on a quest to develop advanced AI-based security measures, not just to detect and respond to threats in real-time, but to predict and thwart …
Read more
Expert Insights
The Evolving Landscape of Cloud Security: Our Predictions for 2024
In the ever-shifting realm of cybersecurity, where innovation and uncertainty intertwine, the year 2023 has been nothing short of chaos. As the dark underbelly of AI-powered threats surfaces, and court rulings redefine the consequences of security failures, the security industry stands at a pivotal juncture. CISOs face jail!
Read more
SOFTWARE SUPPLY CHAIN SECURITY
Lasting Legacy of Log4j: Lessons for Runtime Security
Another December is upon us, stores are full of shoppers, lights are illuminating cities, towns and cul-de-sacs as radio stations bombard listeners with the continuous rotation of holiday music. Yet amongst all this merriment sits the IT security professional behind their screen completing their end of year tasks. Their eyes slowly twitch, and they fill …
Read more
FEDERAL
Navigating Container Security within the FedRAMP Guidelines
The digital transformation journey of many organizations heavily leans on cloud technologies. As they migrate to the cloud, adhering to stringent security protocols becomes paramount. Enter FedRAMP(R) (Federal Risk and Authorization Management Program). It’s a government-wide initiative designed to provide a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.
Read more
SECURITY RESEARCH
The Ticking Supply Chain Attack Bomb of Exposed Kubernetes Secrets
Exposed Kubernetes secrets pose a critical threat of supply chain attack. Aqua Nautilus researchers found that the exposed Kubernetes secrets of hundreds of organizations and open-source projects allow access to sensitive environments in the Software Development Life Cycle (SDLC) and open a severe supply chain attack threat. Among the companies were SAP’s Artifacts management system …
Read more
Expert Insights
SEC vs. SolarWinds: A Cybersecurity Game Changer for CISOs
As winter winds swept across the US this month an even colder wind swept through offices of organizations everywhere, as the SEC brought charges against SolarWinds Corporation and its Chief Information Security Officer (CISO). With one simple indictment the lives of CISOs everywhere changed (even if they may not know it yet) as the consequences …
Read more
CLOUD SECURITY, SOFTWARE SUPPLY CHAIN SECURITY
Combating Unknown Unknowns In Hybrid IT Environments
Recent years have seen a dramatic 1400% increase in unknown unknowns, zero-day and fileless attacks, representing one of the most serious threats in cybersecurity today. The financial services sector is especially vulnerable given its complex, hybrid cloud IT environments comprising both legacy systems and modern cloud native platforms.  Security teams operate with a false sense …
Read more
Page 4 of 34‹ Prev12345678Next ›
Need to secure enterprise workloads?
Aqua Cloud Native Application Protection Platform (CNAPP)
Go cloud native with the experts!
Get Demo
Aqua Security is the pioneer in securing containerized cloud native applications from development to production. Aqua's full lifecycle solution prevents attacks by enforcing pre-deployment hygiene and mitigates attacks in real time in production, reducing mean time to repair and overall business risk. The Aqua Platform, a Cloud Native Application Protection Platform (CNAPP), integrates security from Code to Cloud, combining the power of agent and agentless technology into a single solution. With enterprise scale that doesn’t slow development pipelines, Aqua secures your future in the cloud. Founded in 2015, Aqua is headquartered in Boston, MA and Ramat Gan, IL protecting over 500 of the world’s largest enterprises.
Read Aqua Security reviews on G2

Use Cases

Environments

Partners

Resources

About Us

Get in Touch

Products

Get Started
Copyright © 2024 Aqua Security Software Ltd.   Privacy Policy | Terms of Use | Cookie Settings |  
Accessibility Tools
Normal text size Medium text size Large text size
Normal display Black & White display High contrast display
Stop transitions and animations Underline Links