Dero miner spreads inside containerized Linux environments

A new Dero mining campaign is infecting containerized Linux environments through exposed Docker APIs. The attack uses two Golang malware components: 'nginx' for propagation and 'cloud' for mining. The 'nginx' malware scans for vulnerable Docker hosts, creates malicious containers, and compromises existing ones. It maintains persistence and spreads without a command-and-control server. The 'cloud' component is a modified DeroHE CLI miner with hardcoded wallet and node addresses. This campaign demonstrates the potential risks of insecurely published Docker APIs and the need for robust container security measures.

• PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP FlawsExploitedVulnerability2026-10-21
• Issue in the Linux kernel virtio-net/TAP networking path affecting KVM-based hypervisorsHighVulnerability2026-10-15
• CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP ServerMediumVulnerability2026-10-25
• CVE-2026-111943: AWS trust bundles · eMudhra intermediate CA key recoveryHighVulnerability2026-10-25
• GCP-2026-071HighVulnerability2026-10-23