Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

engine

desktop

sandboxes

CVE-2026-17106, known as CopyEscape, is a high-severity vulnerability in Docker's 'docker cp' command that allows a malicious container to write arbitrary files to the host filesystem. The flaw stems from a filesystem race condition during archive creation combined with unsafe symbolic link handling during extraction. This can lead to arbitrary file creation or overwriting on the host and potentially code execution depending on the privileges of the Docker CLI user. Docker has released official fixes in Docker Engine/CLI version 29.7.2 and later, Docker Desktop 4.86.0 and later, and Docker Sandboxes 0.38.0 and later.

CopyEscape (CVE-2026-17106) is a vulnerability in Docker's 'docker cp' command caused by a race condition during archive creation and unsafe symbolic link handling during extraction. This allows a malicious container to write or overwrite arbitrary files on the host filesystem. The impact can escalate to code execution depending on the privileges of the user running the Docker CLI. Docker confirmed that the sandbox copy command (sbx cp) was also affected. Official patches addressing this vulnerability were released in Docker Engine/CLI 29.7.2+, Docker Desktop 4.86.0+, and Docker Sandboxes 0.38.0+.

Detailed information about CopyEscape: Container-to-host arbitrary file write via docker cp (CVE-2026-17106). Get real-time updates, technical details, and miti

CopyEscape: Container-to-host arbitrary file write via docker cp (CVE-2026-17106) - Live Threat Intelligence - Threat Radar | OffSeq.com

<a href="https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp/">https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp/</a> Author here. I discovered a vulnerability in <code>docker cp</code> that allows a malicious container to create or overwrite files on the machine running the Docker CLI. The exploit combines a filesystem race in Docker’s archive creation with unsafe symlink handling during extraction. Depending on the CLI user’s privileges, this can lead to code execution. Docker confirmed that <code>sbx cp</code> was also affected. Fixed versions: <ul> <li>Docker Engine/CLI 29.7.2+</li> <li>Docker Desktop 4.86.0+</li> <li>Docker Sandboxes 0.38.0+</li> </ul> Happy to answer technical questions.

https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-with-docker-cp/
 Author here. I discovered a vulnerability in docker cp that allows a malicious container to create or overwrite files on the machine running the Docker CLI.
 The exploit combines a filesystem race in Docker’s archive creation with unsafe symlink handling during extraction. Depending on the CLI user’s privileges, this can lead to code execution. Docker confirmed that sbx cp was also affected.
 Fixed versions:
 Docker Engine/CLI 29.7.2+
 Docker Desktop 4.86.0+
 Docker Sandboxes 0.38.0+
 Happy to answer technical questions.

CopyEscape: Container-to-host arbitrary file write via docker cp (CVE-2026-17106)

Reddit Discussion: CopyEscape: Container-to-host arbitrary file write via docker cp (CVE-2026-17106)

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional