erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: November 5, 2025

1 editorial brief and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Patch this week: runc Container Escapes: Three Mount-Race CVEs Fixed. Operators of shared CI/build runners, multi-tenant Kubernetes, and any host that runs third-party images or untrusted Dockerfiles on runc below 1.2.8/1.3.3.
  • PyPI: 1 critical advisory (django). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Patch this week

· Vulnerability · CVE-2025-31133, CVE-2025-52565

runc Container Escapes: Three Mount-Race CVEs Fixed

Not remotely exploitable and not seen in attacks, but anyone who runs or builds images they do not fully trust (CI runners, multi-tenant clusters) should roll out patched runc this week.

Must act: Operators of shared CI/build runners, multi-tenant Kubernetes, and any host that runs third-party images or untrusted Dockerfiles on runc below 1.2.8/1.3.3.

Can relax: Single-tenant hosts that only run images you build from reviewed sources, and rootless or user-namespaced setups, where impact is largely neutralized; patch on the normal cycle.

  1. Check the runtime on each node: runc --version (or docker info | grep -i runc; containerd ships its own runc binary)
  2. Upgrade runc to 1.2.8, 1.3.3 or later via your distro, Docker Engine, containerd or managed-Kubernetes node image updates
  3. Prioritize CI runners, BuildKit/buildx builders and multi-tenant nodes that run untrusted images or Dockerfiles

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 1

Check: pip-audit (or: pip show <package>)