Docker cp Flaw Lets Containers Take Over Hosts; Zoom Zero-Click RCE Hits All Clients

Docker cp Vulnerability Allows Container-to-Host Takeover, Patched in Latest Release

Imperva Red Team discovered CVE-2026-17106, a critical container-to-host arbitrary file-write vulnerability in Docker’s docker cp command, which also affects sbx cp in Docker Sandboxes. The flaw chains a filesystem race in the archive producer with a symlink-following extraction flaw, allowing a malicious container to overwrite files on the host machine running the Docker CLI. This can lead to code execution, with the proof of concept successfully replacing /usr/bin/runc on Linux and launching Safari on macOS.

CopyEscape: Taking Over Docker Hosts with docker cp | Imperva →

Critical Zoom Flaws Enable Zero-Click Remote Code Execution on All Platforms

A security researcher, Ⓐ Security, has disclosed a set of critical vulnerabilities in Zoom that allow an attacker in a meeting to achieve zero-click remote code execution on all participants across Windows, Mac, iPhone, Android, and Linux clients. The flaws, tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415 with a 9.0 CVSS score, are memory-corruption bugs in Zoom’s annotation feature. The exploit requires no action from the victim and leaves no visual cue, allowing attackers to steal data, activate microphones, or install malware.

Ⓐ Cyber Security | Blog | ZOOMSDAY →

Hackers Shut Down Turbine at Polish Power Plant via Private Cellular Network

CERT Polska disclosed a December 2025 cyberattack on a Polish combined heat and power (CHP) plant where attackers shut down a steam turbine and the process-water treatment system. The intrusion was carried out by breaching the private cellular network (APN) used by the local grid operator, marking the first known real-world attack using this vector. The attackers pivoted from a compromised wind farm network to a controller at the CHP plant, which still had default admin credentials.

Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine →

DeadLock Ransomware First to Use Blockchain for C2, Over 80 Victims Hit

Microsoft Threat Intelligence has published an analysis of the DeadLock ransomware operation, which has breached more than 80 organizations across Europe, Asia, the Americas, and Africa. DeadLock is the first financially motivated ransomware group to move its command-and-control infrastructure onto a public blockchain, using the Polygon network to store proxy URLs and leak content. This technique, called EtherHiding, eliminates the need for domains or hosting providers that law enforcement could seize.

DeadLock Ransomware Hides C2 on Polygon Blockchain, 80-Plus Victims Hit →

Poland Charges Russians for Water Plant Hacks Exploiting Default Passwords

Poland has formally charged two Russian nationals for a campaign of 17 cyberattacks on critical infrastructure, including seven water and wastewater treatment plants. The charges, filed by the District Prosecutor’s Office in Białystok, are the first criminal prosecution under Polish law targeting Russian-linked hackers for water supply attacks. The accused remain at large in Russia, and the charges have been suspended pending apprehension.

Poland’s Water Hack Prosecution Names Russians But Can’t Reach Them: Default Passwords Opened Plants →

BBC Prepares FM Radio as Last-Resort Comms for Russian Cyber Attack

The BBC has developed emergency plans to keep broadcasting during a national crisis, including a major power outage caused by a cyber attack. Analogue FM radio would be the corporation’s communication medium of last resort, according to Rhodri Talfan Davies, the deputy director-general. The plans, unveiled to the House of Lords, involve prioritizing public information messages on two major radio frequencies, with back-up generators in place.

Inside the BBC’s emergency plans for a Putin cyber attack →

New Zealand Sanctions Russian Cyber Actors, GRU Unit, and Propaganda Outlets

New Zealand announced a new round of sanctions against Russia, targeting 33 individuals and entities, including cyber actors from the pro-Russian hacktivist group Cyber Army of Russia Reborn (CARR), members of GRU Unit 29155, and the Kremlin-backed Internet Development Institute (IRI). The package also targets individuals involved in the forced relocation of Ukrainian children and entities supporting Russia’s military-industrial complex.

New Zealand Targets Russian Cyber Actors With Fresh Sanctions →

BTCPay Server Offers $190,000 Bounty After Lightning Network Exploit

BTCPay Server is funding a bounty for the return of bitcoin stolen from merchants in an exploit last week, offering 10% of any recovered funds up to a maximum of 3 BTC, worth roughly $190,000. The theft stemmed from a vulnerability that let attackers obtain credentials for LND, the most widely used software for running a Lightning node, and drain associated wallets. Hardware-wallet maker Foundation and the bitcoin publication Citadel21 both reported losing funds.

BTCPay offers $190,000 bounty after bitcoin payment servers drained in exploit →