Three critical vulnerabilities in runc, the container runtime powering Docker, Kubernetes, and other containerization platforms.

These flaws could allow attackers to escape container isolation and gain root access to host systems. However, no active exploits have been detected yet.

The vulnerabilities leverage race mount conditions and procfs write redirects to break out of container boundaries.

Attackers need the ability to start containers with custom mount configurations, making malicious container images and Dockerfiles the primary attack vectors.

The Sysdig Threat Research Team analyzed all three vulnerabilities and provided detailed mitigation recommendations for affected organizations worldwide.

runc Vulnerabilities Lead to Container Isolation

CVE-2025-31133 exploits weaknesses in runc’s maskedPaths feature, which protects sensitive host files from container access.

By replacing /dev/null with a symlink during container creation, attackers can trick runc into mounting arbitrary host paths and writing to critical system files, such as /proc/sys/kernel/core_pattern, thereby enabling container escape.

CVE-2025-52565 targets the /dev/console mount operation during container initialization.

Insufficient validation allows attackers to redirect mounts and gain write access to protected procfs files.

The attack succeeds because the mount happens before maskedPaths and readonlyPaths protections are correctly applied.

CVE-2025-52881 enables attackers to bypass Linux Security Module protections through race conditions with shared mounts.

Attackers can redirect runc writes to fake procfs files and manipulate dangerous system files such as/proc/sysrq-trigger or /proc/sys/kernel/core_pattern, potentially crashing systems or escaping from containers.

Affected Versions and Patches

CVE-2025-31133 and CVE-2025-52881 impact all known runc versions, while CVE-2025-52565 affects versions 1.0.0-rc3 and later.

All three vulnerabilities are patched in runc versions 1.2.8, 1.3.3, and 1.4.0-rc.3 or later.

Organizations using containerized environments should immediately update Runc to patched versions.

The Sysdig Threat Research Team recommends enabling user namespaces for all containers, which blocks critical attack vectors by restricting access to the procfs file system.

Using rootless containers further limits the scope of vulnerability. Cloud providers, including AWS, ECS, and EKS, released security updates on November 5, 2025.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Critical runc Vulnerabilities Put Docker and Kubernetes Container Isolation at Risk appeared first on Cyber Security News.

A critical remote code execution vulnerability in Monsta FTP, a popular web-based FTP client used by financial institutions and enterprises worldwide.

The flaw, now tracked as CVE-2025-34299, affects multiple versions of the software and has been exploited in the wild.

Monsta FTP is a browser-based file transfer client that allows users to manage files on remote servers without dedicated FTP software.

With at least 5,000 instances exposed on the internet, the platform serves a diverse user base, including financial organizations and large enterprises.

The Vulnerability and Patch Available

The security flaw enables attackers to achieve pre-authenticated remote code execution on vulnerable Monsta FTP servers.

WatchTowr Labs researchers discovered that despite developers adding extensive input validation functions in recent updates, critical vulnerabilities remained unpatched across multiple versions.

The attack works through a simple three-step process: An attacker tricks Monsta FTP into connecting to a malicious SFTP server. Downloads a crafted payload file.

Writes that file to an arbitrary path on the target server. This grants complete control over the vulnerable system.

The vulnerability affects versions 2.10.3 through 2.11, and researchers found that previously reported security flaws were never properly fixed.

WatchTower Labs Analysis revealed minimal code changes between versions 2.10.3 and 2.10.4, leaving known vulnerabilities intact with version updates.

Monsta FTP released version 2.11.3 on August 26, 2025, which addresses this critical vulnerability.

Organizations running Monsta FTP should immediately upgrade to the latest version to protect their systems.

The discovery highlights ongoing security challenges in web-based file management systems, particularly when legacy vulnerabilities persist despite multiple software updates.

The post Monsta web-based FTP Remote Code Execution Vulnerability Exploited appeared first on Cyber Security News.