Security Digest — 2026-08-14

General Security News (unfiltered)

Scoped Vulnerability Tracking

Database

The most urgent issue is the CISA KEV-confirmed critical vulnerability in Dokploy (CVE-2026-72862), which allows attackers to execute arbitrary commands via unquoted Docker image inputs in database service deployments. This poses an immediate risk to any environment using Dokploy for database services, as it is actively exploited.

Formal Vulnerabilities

Dokploy — CVE-2026-72862 (CVSS 9.9 CRITICAL 🔴 ACTIVELY EXPLOITED (CISA KEV))

Summary: Dokploy passes user-controlled `dockerImage` fields unquoted into `docker pull` commands, enabling attackers to execute arbitrary shell commands on the remote server. This affects all database service deployments (MySQL, MongoDB, PostgreSQL, etc.) in Dokploy versions prior to 0.29.13. Exploitation requires network access to the Dokploy instance.

Affected Features / Interoperability: All database services deployed via Dokploy (MySQL, MongoDB, PostgreSQL, Redis, etc.) are vulnerable. This could disrupt replication, client integrations, or third-party tools relying on Dokploy's database services.

Source:

• GitHub commit
• Dokploy security advisory

Actions:

• Fix: Upgrade to Dokploy 0.29.13.
• Workaround: Avoid using Dokploy for database services until patched.
• Tradeoff: No significant tradeoff; workaround requires abandoning Dokploy for database services temporarily.

PostgreSQL — CVE-2026-48528 (CVSS 9.8 CRITICAL)

Summary: Metacat's unauthenticated SQL injection vulnerability allows attackers to extract or modify data via the `/cn` REST API endpoints. This exposes sensitive metadata, access logs, and user identifiers. Fixed in Metacat 3.4.1.

Affected Features / Interoperability: The `/cn` REST API endpoints in Metacat. This could break data catalog integrations or compromise DataONE network operations if Metacat is used there.

Source: Metacat security advisory

Actions:

• Fix: Upgrade to Metacat 3.4.1.
• Workaround: Disable `/cn` endpoints in web.xml if immediate patching isn't possible.
• Tradeoff: Disabling endpoints may reduce functionality for DataONE Coordinating Node deployments.

PostgreSQL — CVE-2026-14662 (CVSS 8.8 HIGH)

Summary: Integer wraparound in tsvector/tsquery functions allows unprivileged users to cause out-of-bounds writes, potentially executing arbitrary code. Affects PostgreSQL versions before 18.5.

Affected Features / Interoperability: PostgreSQL core functionality. Could compromise database integrity or allow remote code execution if exploited.

Source: PostgreSQL security page

Actions:

• Fix: Upgrade to PostgreSQL 18.5 or later.
• Workaround: Restrict access to tsvector/tsquery functions if immediate patching isn't possible.
• Tradeoff: Workaround may limit functionality for applications relying on these functions.

PostgreSQL — CVE-2026-14664 (CVSS 8.8 HIGH)

Summary: Heap buffer overflow in regexp functions allows arbitrary code execution via malformed inputs. Affects versions before 18.5.

Affected Features / Interoperability: PostgreSQL's regexp engine. Could lead to remote code execution or data corruption.

Source: PostgreSQL security page

Actions:

• Fix: Upgrade to PostgreSQL 18.5 or later.
• Workaround: Input validation for regexp queries.
• Tradeoff: May require application-level filtering, increasing development effort.

PostgreSQL — CVE-2026-14669 (CVSS 8.8 HIGH)

Summary: Heap buffer overflow in `to_char(timestamptz)` allows arbitrary code execution via long timezone abbreviations. Affects versions before 18.5.

Affected Features / Interoperability: PostgreSQL's time formatting functions. Could compromise server integrity.

Source: PostgreSQL security page

Actions:

• Fix: Upgrade to PostgreSQL 18.5 or later.
• Workaround: Sanitize timezone inputs.
• Tradeoff: May break applications using custom timezone handling.

PostgreSQL — CVE-2026-14671 (CVSS 8.8 HIGH)

Summary: Type confusion in the `refint` module allows object creators to execute arbitrary code. Affects versions before 18.5.

Affected Features / Interoperability: PostgreSQL's internal data type handling. Could lead to remote code execution.

Source: PostgreSQL security page

Actions:

• Fix: Upgrade to PostgreSQL 18.5 or later.
• Workaround: Restrict access to `refint` module functions.
• Tradeoff: May limit functionality for advanced database operations.

PostgreSQL — CVE-2026-15741 (CVSS 8.8 HIGH)

Summary: SQL injection in `EXTRACT()` deparse allows object owners to execute arbitrary SQL as a superuser. Affects versions before 18.5.

Affected Features / Interoperability: PostgreSQL's `EXTRACT()` function and tools like `pg_dump`. Could compromise data or administrative controls.

Source: PostgreSQL security page

Actions:

• Fix: Upgrade to PostgreSQL 18.5 or later.
• Workaround: Restrict `EXTRACT()` usage to trusted users.
• Tradeoff: May reduce functionality for automated backups or reporting tools.

MySQL — CVE-2026-18617 (CVSS 8.8 HIGH)

Summary: Data Science Pipelines Operator (DSPO) allows namespace editors to inject `LOCAL INFILE` via `customExtraParams`, enabling file exfiltration and privilege escalation. Affects MySQL Data Source configurations.

Affected Features / Interoperability: MySQL Data Sources in DSPO. Could break data pipeline integrations or allow unauthorized data access.

Source: Red Hat errata

Actions:

• Fix: Upgrade DSPO to patched version.
• Workaround: Restrict namespace editor permissions.
• Tradeoff: May limit administrative capabilities for DSPO users.

Redis — CVE-2026-72862 (CVSS 9.9 CRITICAL)

Summary: Same as Dokploy's CVE-2026-72862, affecting Redis service deployments in Dokploy. See Dokploy entry for details.

Affected Features / Interoperability: Redis services in Dokploy. Same risks as Dokploy's database services.

Source: Dokploy security advisory

Actions:

• Fix: Upgrade Dokploy to 0.29.13.
• Workaround: Avoid using Dokploy for Redis services until patched.
• Tradeoff: Same as Dokploy entry.

MongoDB — CVE-2026-72857 (CVSS 7.7 HIGH)

Summary: Budibase fails to redact credentials in STRING fields, exposing MongoDB connection strings and Firebase keys. Affects Budibase versions before 3.40.0.

Affected Features / Interoperability: MongoDB datasource integrations in Budibase. Could leak sensitive credentials.

Source: Budibase security advisory

Actions:

• Fix: Upgrade Budibase to 3.40.0.
• Workaround: Manually redact credentials in STRING fields.
• Tradeoff: Workaround requires manual effort and may not catch all exposures.

MongoDB — CVE-2026-73617 (CVSS 7.1 HIGH)

Summary: NoSQL injection in MongoDB datasource integration allows bypassing access controls via query parameters. Affects Budibase before 3.40.0.

Affected Features / Interoperability: MongoDB data access in Budibase. Could enable unauthorized data modification or deletion.

Source: Budibase security advisory

Actions:

• Fix: Upgrade Budibase to 3.40.0.
• Workaround: Sanitize query parameters.
• Tradeoff: May reduce functionality for dynamic query features.

MongoDB — CVE-2026-73562 (CVSS 6.5 MEDIUM)

Summary: Mongoose prototype pollution allows attackers to modify object prototypes via `$set` in update operations. Affects Mongoose versions before 6.13.10, 7.8.10, etc.

Affected Features / Interoperability: Mongoose-based MongoDB applications. Could compromise data integrity or allow privilege escalation.

Source: Mongoose security advisory

Actions:

• Fix: Upgrade Mongoose to patched versions.
• Workaround: Avoid using `$set` with user-controlled data.
• Tradeoff: Workaround may require code changes in applications using Mongoose.

News & Community Mentions

PostgreSQL

• Reddit Post: A vulnerability in a popular PostgreSQL extension was discovered, leading to code execution in services like NeonDB and Supabase.

Source: Reddit

No other systems had notable news/forum mentions.

Cloud Security

The most urgent items this cycle are two unrelated CVSS 9.9 CRITICAL vulnerabilities: CVE-2026-14450 in the MaaS API (Kubernetes/Red Hat OpenShift AI ecosystem), which lets any pod forge trusted headers to mint ServiceAccount tokens and exfiltrate model configs across tenant namespaces, and CVE-2026-72862 in Dokploy (Docker-based PaaS), where user-controlled database image fields are interpolated unquoted into `docker pull` shell commands, yielding remote code execution on the host. Neither has a CISA KEV listing, so both remain theoretical-but-severe; prioritize patching MaaS/RHOAI overlays and Dokploy 0.29.13+ immediately. Kubernetes also carries a cluster-admin escalation via Vault Secrets Operator (CVE-2026-8715, CVSS 9.6) and multiple OpenChoreo auth bypasses; Docker Engine 29.5.1 addresses a container-breakout via trojanized decompression binaries (CVE-2026-41567, CVSS 7.2).

Formal Vulnerabilities

Kubernetes — CVE-2026-14450 (CVSS 9.9 CRITICAL)

Summary: The MaaS API trusts `X-MaaS-Username` and `X-MaaS-Group` headers verbatim without first-party authentication. Any pod in the cluster can forge these headers to bypass Kuadrant AuthPolicy, mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate sensitive model access configuration. No authentication required; network reachability within the cluster suffices.

Affected Features / Interoperability: MaaS API gateway authentication (Kuadrant AuthPolicy), cross-tenant ServiceAccount token issuance, API key management, model access configuration storage. Downstream impact on any workload relying on MaaS for multi-tenant authZ.

Source: https://access.redhat.com/errata/RHSA-2026:53262, https://access.redhat.com/security/cve/CVE-2026-14450, https://bugzilla.redhat.com/show_bug.cgi?id=2496373

Actions:

• Fix: Apply RHSA-2026:53262 (Red Hat OpenShift AI overlay patch)
• Workaround: Enforce strict network policies to limit pod-to-pod communication; deploy a sidecar/proxy that strips or validates `X-MaaS-*` headers before they reach the MaaS API
• Tradeoff: Network policies may break legitimate inter-service calls; header-stripping proxy adds latency and operational complexity

Kubernetes — CVE-2026-73843 (CVSS 9.6 CRITICAL)

Summary: OpenChoreo <1.0.2 and <1.1.2 serves management APIs (`/api/proxy/`, `/api/exec/`) on an externally reachable agent listener without authentication. Network-reachable attackers can proxy the data-plane Kubernetes API and execute commands in workload pods across clusters.

Affected Features / Interoperability: OpenChoreo cluster-gateway agent listener, management API endpoints, multi-cluster data-plane Kubernetes API proxy, pod exec functionality.

Source: https://github.com/openchoreo/openchoreo/commit/047d80ddc63b4b4b9dd67044d5cffcdbd77685ce, https://github.com/openchoreo/openchoreo/commit/0aa0ffe1623bd8eb4235cb2a5854336695953c3a, https://github.com/openchoreo/openchoreo/commit/b42eeb0f5dce95195a9781d7c5a1fe9e38f5da8f, https://github.com/openchoreo/openchoreo/pull/4122, https://github.com/openchoreo/openchoreo/releases/tag/v1.0.2

Actions:

• Fix: Upgrade to OpenChoreo 1.0.2 or 1.1.2
• Workaround: Block external access to the agent listener port (typically 9443) via network policy or firewall; disable the agent listener if not required
• Tradeoff: Blocking the listener may break legitimate multi-cluster management workflows

Kubernetes — CVE-2026-8715 (CVSS 9.6 CRITICAL)

Summary: Vault Secrets Operator 1.3.0–1.4.1 allows a tenant with limited Kubernetes RBAC to read arbitrary files from the operator pod's filesystem via the AppRole `secretIdPath` field and exfiltrate them to a tenant-controlled endpoint, enabling privilege escalation.

Affected Features / Interoperability: Vault Secrets Operator AppRole authentication configuration, operator pod filesystem, tenant-controlled egress endpoints. Impacts any cluster running VSO with multi-tenant AppRole usage.

Source: https://discuss.hashicorp.com/t/hcsec-2026-28-vault-secrets-operator-vulnerable-to-arbitrary-file-read-via-approle-secretidpath/77645

Actions:

• Fix: Upgrade to Vault Secrets Operator 1.5.0
• Workaround: Restrict AppRole `secretIdPath` to known-safe paths via admission policy; disable AppRole auth method if not needed; enforce egress network policies to block operator pod from reaching tenant-controlled endpoints
• Tradeoff: Admission policy requires OPA/Gatekeeper or Kyverno; egress blocking may break legitimate secret sync workflows

Kubernetes — CVE-2026-73842 (CVSS 9.0 CRITICAL)

Summary: OpenChoreo <1.0.3, <1.1.3, <1.2.0-rc.2 exposes `/api/proxy/`, `/api/exec/`, `/api/wirelogs/` on an internal listener without client cert or token auth. Any network-reachable caller can read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes.

Affected Features / Interoperability: OpenChoreo cluster-gateway internal listener, tenant secret access, workload mutation, cross-data-plane command execution.

Source: https://github.com/openchoreo/openchoreo/commit/50fcae3f1753fd0ac3ae655a3fc080a761c49c04, https://github.com/openchoreo/openchoreo/commit/93e6f10953cfc249af2222ddb6730d4b0a729129, https://github.com/openchoreo/openchoreo/commit/e3da3c63dcf0895c693cb17ce142ef95e959b62a, https://github.com/openchoreo/openchoreo/pull/4256, https://github.com/openchoreo/openchoreo/pull/4258

Actions:

• Fix: Upgrade to OpenChoreo 1.0.3, 1.1.3, or 1.2.0-rc.2
• Workaround: Restrict network access to the internal listener port via network policies; disable unused endpoints
• Tradeoff: May disrupt legitimate intra-cluster OpenChoreo control-plane traffic

Kubernetes — CVE-2026-18951 (CVSS 8.8 HIGH)

Summary: Red Hat OpenShift AI overlay incorrectly aggregates `trainjobs` management permissions into the native Kubernetes `edit` ClusterRole. Combined with a separate flaw (TRN-01) allowing arbitrary pod configs, a namespace editor can escalate to arbitrary code execution.

Affected Features / Interoperability: RHOAI training operator, `edit` ClusterRole aggregation, TrainJob CRD, pod template passthrough.

Source: https://access.redhat.com/errata/RHSA-2026:53262, https://access.redhat.com/errata/RHSA-2026:53263, https://access.redhat.com/security/cve/CVE-2026-18951, https://bugzilla.redhat.com/show_bug.cgi?id=2511187

Actions:

• Fix: Apply RHSA-2026:53262 and RHSA-2026:53263
• Workaround: Remove `trainjobs` permissions from `edit` ClusterRole via custom RBAC; restrict `edit` role bindings to trusted users only
• Tradeoff: Custom RBAC increases management overhead; may break legitimate data scientist workflows

Kubernetes — CVE-2026-18982 (CVSS 8.8 HIGH)

Summary: RHOAI training-operator aggregates training job permissions onto native `edit` and `admin` ClusterRoles with unrestricted PodTemplateSpec passthrough. A namespace editor/admin can impersonate service accounts, access host filesystem, and achieve remote code execution via training job creation.

Affected Features / Interoperability: RHOAI training-operator, `edit`/`admin` ClusterRole aggregation, PodTemplateSpec validation, service account impersonation, host filesystem access.

Source: https://access.redhat.com/errata/RHSA-2026:53261, https://access.redhat.com/errata/RHSA-2026:53262, https://access.redhat.com/errata/RHSA-2026:53263, https://access.redhat.com/security/cve/CVE-2026-18982, https://bugzilla.redhat.com/show_bug.cgi?id=2511648

Actions:

• Fix: Apply RHSA-2026:53261, RHSA-2026:53262, RHSA-2026:53263
• Workaround: Restrict training job creation via admission controller; disable hostPath/hostNetwork in PodTemplateSpec via policy
• Tradeoff: Admission controller adds complexity; policy restrictions may block legitimate training workloads

Kubernetes — CVE-2026-73667 (CVSS 8.8 HIGH)

Summary: OpenChoreo <1.0.4, <1.1.4, <1.2.0-rc.2 interpolates developer-controlled workflow parameters into shell commands (`sh -c`) in workflow templates instead of using `container.env`. Privileged Podman templates also lack `hostUsers: false`, enabling arbitrary command execution in workflow pods.

Affected Features / Interoperability: OpenChoreo Workflow Plane templates (samples/getting-started/workflow-templates/), shell command interpolation, Podman privileged templates.

Source: https://github.com/openchoreo/openchoreo/commit/017c3c6d8b27c21d11c8c2b43da1846aa7ae73b9, https://github.com/openchoreo/openchoreo/commit/65c081ff74618714cb0c82b5d0e0fad2c2cbc46b, https://github.com/openchoreo/openchoreo/commit/b274127a4342e5433c5035384cef57478b5b65ed, https://github.com/openchoreo/openchoreo/commit/fb2b659b9884eb45fa4f02b9cc7e89718a0276b7, https://github.com/openchoreo/openchoreo/pull/4193

Actions:

• Fix: Upgrade to OpenChoreo 1.0.4, 1.1.4, or 1.2.0-rc.2
• Workaround: Avoid using affected workflow templates; rewrite templates to pass parameters via `container.env`; add `hostUsers: false` to Podman templates
• Tradeoff: Template rewrites require developer effort and testing

Kubernetes — CVE-2026-73841 (CVSS 8.8 HIGH)

Summary: OpenChoreo 1.2.0-rc.1 through 1.2.0 authorizes `component:exec` and `wirelogs:view` using the caller-supplied `project` query parameter instead of the component's actual owner project. A user with project-scoped grants can execute commands in and read wirelogs from components owned by other projects in the same namespace.

Affected Features / Interoperability: OpenChoreo API handlers for exec and wirelogs, project-scoped RBAC, multi-project namespace tenancy.

Source: https://github.com/openchoreo/openchoreo/security/advisories/GHSA-52gf-6rpq-fgmx

Actions:

• Fix: Upgrade to OpenChoreo 1.2.0
• Workaround: Enforce single-project-per-namespace isolation; restrict exec/wirelogs API access via network policy
• Tradeoff: Single-project namespaces reduce resource sharing efficiency

Kubernetes — CVE-2026-18608 (CVSS 8.7 HIGH)

Summary: Data Science Pipelines Operator (DSPO) ClusterRole includes excessive privileges (pod exec, cluster-wide role management). If the DSPO pod is compromised, an attacker gains full cluster admin control.

Affected Features / Interoperability: DSPO ClusterRole, pod exec permissions, cluster-wide RBAC management, operator pod compromise blast radius.

Source: https://access.redhat.com/errata/RHSA-2026:53261, https://access.redhat.com/errata/RHSA-2026:53262, https://access.redhat.com/errata/RHSA-2026:53263, https://access.redhat.com/security/cve/CVE-2026-18608, https://bugzilla.redhat.com/show_bug.cgi?id=2510296

Actions:

• Fix: Apply RHSA-2026:53261, RHSA-2026:53262, RHSA-2026:53263
• Workaround: Manually downscope DSPO ClusterRole to least privilege; run DSPO in dedicated namespace with restricted PSP/SCC; monitor DSPO pod for anomalous exec activity
• Tradeoff: Manual downscoping may break pipeline features; dedicated namespace adds operational overhead

Kubernetes — CVE-2026-73666 (CVSS 8.2 HIGH)

Summary: OpenChoreo Backstage backend <1.0.4, <1.1.4, <1.2.1 hardcodes `dangerouslyDisableDefaultAuthPolicy: true` and `guest.dangerouslyAllowOutsideDevelopment: true`, exposing `/api/*` without authentication. Allows unauthenticated catalog reads, scaffolder log reads, and catalog location creation/deletion.

Affected Features / Interoperability: OpenChoreo Backstage backend authentication, software catalog API, scaffolder logs, catalog location management.

Source: https://github.com/openchoreo/backstage-plugins/commit/114a215689924b917da5fd28c56e679aaccaef07, https://github.com/openchoreo/backstage-plugins/commit/dfa3fc8bd1ffef1346442c891e3e3dd54bc26501, https://github.com/openchoreo/backstage-plugins/commit/f6df89c15834506902b2f706a9e8fbe1f6ef1474, https://github.com/openchoreo/backstage-plugins/commit/fdaceeb737938e830c48a150d5bec24f5f487e52, https://github.com/openchoreo/backstage-plugins/pull/709

Actions:

• Fix: Upgrade to OpenChoreo 1.0.4, 1.1.4, or 1.2.1
• Workaround: Place Backstage behind an authenticating reverse proxy (OAuth2-Proxy, Keycloak Gatekeeper); disable guest provider in app-config.yaml
• Tradeoff: Reverse proxy adds infrastructure complexity; disabling guest provider removes unauthenticated catalog browsing

Docker — CVE-2026-72862 (CVSS 9.9 CRITICAL)

Summary: Dokploy <0.29.13 passes user-controlled `dockerImage` fields unquoted into `docker pull ${dockerImage}` shell commands in database service deployment functions (MariaDB, Mongo, MySQL, Postgres, Redis, libsql). Attackers can inject shell commands via crafted image names, achieving RCE on the remote server.

Affected Features / Interoperability: Dokploy database service deployment (mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, libsql.ts), remote-server code path, docker pull command construction.

Source: https://github.com/Dokploy/dokploy/commit/b24202e69b244f0ece8d2f56e99cad9bb5e1a248, https://github.com/Dokploy/dokploy/releases/tag/v0.29.13, https://github.com/Dokploy/dokploy/security/advisories/GHSA-6jrh-8qmg-jj3p

Actions:

• Fix: Upgrade to Dokploy 0.29.13
• Workaround: Restrict Dokploy API access to trusted admins only; validate/sanitize `dockerImage` input via admission webhook before it reaches Dokploy
• Tradeoff: API restriction limits self-service; admission webhook requires development and maintenance

Docker — CVE-2026-41567 (CVSS 7.2 HIGH)

Summary: Moby/Docker Engine <29.5.1 and moby/moby v2 <v2.0.0-beta.14 resolves decompression binaries (`xz`, `unpigz`) from the container's filesystem when handling `PUT /containers/{id}/archive` or `docker cp -` with compressed archives. A malicious image with trojanized binaries achieves arbitrary code execution as host root with full capabilities.

Affected Features / Interoperability: Docker daemon archive upload endpoint (`PUT /containers/{id}/archive`), `docker cp` stdin piping, container filesystem binary resolution, host root privilege escalation.

Source: https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r, https://access.redhat.com/errata/RHSA-2026:37387, https://access.redhat.com/errata/RHSA-2026:41030, https://access.redhat.com/errata/RHSA-2026:42852, https://access.redhat.com/errata/RHSA-2026:44622

Actions:

• Fix: Upgrade to Docker Engine 29.5.1 or moby/moby v2.0.0-beta.14
• Workaround: Only run containers from trusted/signed images; use authorization plugins (e.g., Docker AuthZ) to restrict `PUT /containers/{id}/archive`; avoid piping compressed archives into untrusted containers
• Tradeoff: Trusted-image-only policy reduces flexibility; AuthZ plugins add latency and config complexity

Docker — CVE-2026-33997 (CVSS 6.8 MEDIUM)

Summary: Moby/Docker Engine <29.3.1 incorrectly validates plugin privileges during `docker plugin install`. The daemon may accept a privilege set differing from user approval; single-privilege plugins bypass comparison entirely.

Affected Features / Interoperability: Docker plugin installation privilege validation, plugin permission model, user consent flow.

Source: https://github.com/moby/moby/releases/tag/docker-v29.3.1, https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9, https://access.redhat.com/errata/RHSA-2026:21769, https://access.redhat.com/errata/RHSA-2026:22347, https://access.redhat.com/errata/RHSA-2026:23345

Actions:

• Fix: Upgrade to Docker Engine 29.3.1+
• Workaround: Manually inspect plugin `config.json` privileges before install; restrict plugin install to admins via AuthZ plugin
• Tradeoff: Manual inspection slows workflows; AuthZ restriction limits self-service

News & Community Mentions

Unverified chatter — separate from formal vulnerabilities above.

AWS

• Beacon CRM confirms full database theft after AWS access key breach — CyberSecurityNews — https://news.google.com/rss/articles/CBMibEFVX3lxTE90YXMzNjdPMlFwY3FIZ3AxTVRvVFBuay13aEhmeS1rUlZfZF9sUEFRWU1INDI2Z0lER3h5TE5hbDZQZUV2bUR3blY3QlZOa21NbHEwSVVHNE1reTdWbWxrSjV5WUZkUkJuQlZoedIBbEFVX3lxTE90YXMzNjdPMlFwY3FIZ3AxTVRvVFBuay13aEhmeS1rUlZfZF9sUEFRWU1INDI2Z0lER3h5TE5hbDZQZUV2bUR3blY3QlZOa21NbHEwSVVHNE1reTdWbWxrSjV5WUZkUkJuQlZoeQ
• Corma raises $60M seed funding — CyberWire — https://news.google.com/rss/articles/CBMia0FVX3lxTE9hcUxCelkzbzEwRnJna3VUNXU3ZmdpSzBUSVNGUW5XblNpZHFKUENab255Q0x3WHE3Y3ZON1VCZmt4STlXRlFURW1yRFFZbHNsMEZxdzdiVmJFTnpscVpxUENiUlBVTDhDQllZ

Microsoft Azure

• Microsoft Azure Linux 3.0.20260809 delivers 233+ security fixes — finance.biggo.com — https://news.google.com/rss/articles/CBMidkFVX3lxTE5hUW5Hc3lVZjlrTjlSRUltOXllTi1EaS1fTy1RamlkcGd1Ykd3YmxpR01rSmtudDZGZHBVNm5TMlZmRFp2NGtDS0VFVmhzZ0YwdE1SbUtCSXUzMW50Y0oyeUxic3VCU2Zrd09UdG5sRnRUQUJIb3c
• Microsoft August 2026 Patch Tuesday fixes 400+ vulnerabilities — LinkedIn — https://news.google.com/rss/articles/CBMiiwFBVV95cUxNdTNudVhLUlVVdkM4Sm1mYlJhc0l6OXppR0ItTDdoQ05USTZIRUh5M29lNF9hWnQ1b0ZZMi03V1V2dEhfTjZJdkpEVEE3cnJvRkR4b1l6cnBjcHZkRng1Wk52NlpTREpKTXl1ZlhablBXNFhBamVYYnp3T2VtQ2lURlRETFlhVW5qUENj

Google Cloud Platform

• Zero Keys, Two Clouds: AWS-hosted Terraform CI/CD deploys to GCP — HackerNoon — https://news.google.com/rss/articles/CBMiowFBVV95cUxNc2ZnTEdhczlIQU94S3NsS2hIT09sbVN2OFpvcWpyTlBtenFmNHRiNk5faE5sVTZ4R0tDTDN1SmdOWVJkdFFQUEdGcks5bHh1UGR2YlhOeHdaYW96bVA5VmZHNy1sWGk4QVdwQ01za3hNTjliNnFTQjdyd0xYcUlvQzVSbnRiQjVUUTV2YUducVJVN0xRcHZPZnlkNzc4UWExamZB

Kubernetes

• How eBPF sensors are closing the Kubernetes runtime detection gap — CyberSecurityNews — https://news.google.com/rss/articles/CBMijwFBVV95cUxQenJTQXlEMVc4OTBVcWJERVRFeDktWkQ0c1ROc1NtLV9PNjh6ZGdTLWY2bjEzV1loNjZhb2lIRFo4NG1SNnA4SnJOWGtEVkNuaXBZczdjanI1TGNqMjZfSWIyRThYMVdaYVVoSVFVTmRYRWRPX1lLX1JuZzJPNGtLek1SdldueXBKRFRGY2RnTQ
• Top unified security tools in 2026 — aikido.dev — https://news.google.com/rss/articles/CBMiZEFVX3lxTE1rZWVpYzgwVFZSWEViUk1SOU9lT3dmeWFwQnEtaHkzaFpiaEZPY2RjTzEyTmJFMFpkOEktZXhzWnh6SlVYR2dMNW1TZE1hSnlxMjRTa3VlSzFKZmhNdWxxd2pYamM

Docker

• Podman 6.1 adds volume renaming, machine restart — Linuxiac — https://news.google.com/rss/articles/CBMieEFVX3lxTE02NXNtbmxxTnpROWlnb3l6c2M2aXhxU0NINDEwQnVRNkxPUjJxTi05bjY5X2FqMTQ5OG84RmFYSElUQmlWbVRIYzFLekFWSEZqRFRWZU1Tb19RNDlwUWh6Z0RjeFFWMVlhdFA0ZGhDYkhyUFA3QzVmYQ