Tag
Google is donating the gVisor sandboxed container runtime project, including its name and trademarks, to the CNCF (a Linux Foundation subsidiary), shifting governance to a maintainers- and org-based model and moving toward CNCF Incubation status.
Vex8s is an experimental tool that generates VEX documents by analyzing Kubernetes security contexts and vulnerability data with an embedded ML model to determine which CVEs are actually exploitable in a cluster.
Security researcher Simcha Kosman discusses his team's Black Hat USA 2026 research on breaking out of ChatGPT's secure sandbox, highlighting vulnerabilities in container isolation and AI supervision through attack chains.
Echo and NanoClaw collaborated to eliminate 1,400 CVEs in NanoClaw's container images through scanning, patching, and backporting fixes. The article details their agentic hardening process, including safe version bumps and manual patch research.
The author praises Lu Qi for his insights on sandbox/container security from a year ago, which have since been validated, emphasizing the core role of sandboxes in observing reward hacking.
Trivy is a comprehensive, open-source security scanner by Aqua Security that detects vulnerabilities, misconfigurations, secrets, and license issues across containers, filesystems, git repos, and Kubernetes.