A high-severity path traversal vulnerability was found in Docker Compose's support for OCI artifacts, allowing attackers to write arbitrary files on the host system. This flaw could be triggered by running commands like "docker compose ps" with malicious Compose files, potentially leading to unauthorized access. Users are urged to upgrade to Docker version v2.40.2 or later to mitigate the issue.

Researchers revealed a serious security flaw in Docker's Ask Gordon AI that allowed attackers to execute code and steal sensitive data. The vulnerability, called DockerDash, exploited unverified metadata in Docker images, which the AI treated as executable commands. Docker has fixed the issue in version 4.50.0.

Docker has addressed a critical vulnerability identified as CVE-2025-9074 that could allow unauthorized access to sensitive information. Users are encouraged to update their Docker installations to mitigate potential security risks associated with this flaw.

Docker has introduced Docker Hardened Images (DHI), which are secure-by-default container images that significantly reduce the attack surface and streamline software supply chain security. These images, designed for modern production environments, are continuously updated, minimize vulnerabilities, and integrate seamlessly into existing workflows without sacrificing flexibility or usability.

vAPI is a self-hostable API designed to simulate the OWASP API Top 10 vulnerabilities for educational exercises using PHP and MySQL. It provides setup instructions, including database configuration and integration with Postman for testing, and can also be deployed using Helm in a Kubernetes environment. The article includes references to additional resources and documentation for further exploration.