Devsecops on HackingPassion.com : root@HackingPassion.com-[~]

Your Gitea Docker Runner Gives Up Root Even With Privileged Mode Off

Sun, 28 Jun 2026 15:28:45 +0200

A Docker container on a Gitea build runner can break out to root on the host, the setting built to stop that does nothing, and there is no patch yet. CVSS 9.9. A working proof of concept went public the same day the flaw was disclosed. The attacker only needs permission to run a workflow on a Docker-backed runner. The setting that fails here is privileged: false. It switches off one flag and leaves the rest of the dangerous options live. This is CVE-2026-58053.

PHP Composer Command Injection CVE-2026-40261

Wed, 15 Apr 2026 10:38:02 +0200

PHP Composer Has Two Flaws That Run Arbitrary Commands on Developer Machines PHP Composer, the package manager that almost every PHP developer uses to build websites and applications, has two serious vulnerabilities that allow an attacker to run arbitrary commands on any machine running a vulnerable version. Neither one requires Perforce to be installed, configured, or even known about. Patches came out on April 14, 2026, and many environments will still be running vulnerable versions. 😏