Dero miner zombies biting through Docker APIs to build a cryptojacking horde

A new Dero mining campaign exploits insecurely published Docker APIs to spread through containerized Linux environments. The attack uses two Golang malware implants: 'nginx' for propagation and 'cloud' for cryptocurrency mining. The 'nginx' malware scans for vulnerable Docker APIs, creates malicious containers, and compromises existing ones. It maintains persistence and spreads without a command-and-control server. The 'cloud' miner is based on the open-source DeroHE CLI project, with hardcoded wallet and node addresses. This campaign differs from previous attacks on Kubernetes clusters by actively spreading and compromising more networks. The threat highlights the importance of securing containerized infrastructures and monitoring for malicious activities.

• PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP FlawsExploitedVulnerability2026-10-21
• Issue in the Linux kernel virtio-net/TAP networking path affecting KVM-based hypervisorsHighVulnerability2026-10-15
• CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP ServerMediumVulnerability2026-10-25
• CVE-2026-111943: AWS trust bundles · EMudhra Intermediate CA Key RecoveryHighVulnerability2026-10-25
• Plex vulnerabilities being exploited in the wild to drop a cryptominerMalware2026-10-19