da Agency

ActiveState Partners with Docker to Secure the Open Source in Enterprise Containers

Even security teams that have invested in a hardened base image often can’t say what’s running on top of it. In a recent survey of 250 North American DevSecOps leaders, 91% named visibility into container components as their single biggest blind spot. Not the base image, but everything layered onto it. And 90% said their teams still run lightly modified public images with little to no hardening. 

That gap is getting harder to ignore. AI coding assistants are adding dependencies faster than teams can review them. Vulnerability databases can no longer keep pace with the volume of submissions. New regulatory requirements, including the EU Cyber Resilience Act, are also increasing expectations around vulnerability handling, remediation, and software supply chain transparency. 

Docker Hardened Images meet ActiveState’s Curated Catalog

Docker, Inc. and ActiveState today announced a reselling partnership that brings Docker Hardened Images (DHI) together with ActiveState’s curated open source packages, giving enterprises a more consistent way to secure both the container base and the software dependencies layered on top.

DHI provides secure-by-default, minimal container images, with 4,000+ images built from source, near-zero CVEs, signed SBOMs, and SLSA Build Level 3 provenance. The catalog is free and open source under Apache 2.0, with production tiers backed by a 7-day SLA for critical and high-severity CVEs. 

ActiveState extends that trusted foundation to the open source dependencies developers add on top. Its curated components span more than a dozen language ecosystems, including Python, JavaScript, Java, Perl, Tcl, and Ruby. Components are built from source, continuously maintained and remediated against contractual SLAs, and delivered through the package managers, pipelines, IDEs, and AI coding tools development teams already use. 

Trust across the software stack

A more consistent approach to trusted open source: Pair a hardened container base with curated open source dependencies, reducing the need to source and manage each layer separately

Verifiable provenance across the stack: With both Docker and ActiveState building from source to SLSA Build Level 3 standards, teams get a more consistent evidence trail across the software supply chain

Fewer vulnerabilities, without slowing teams down : DHI delivers near-zero CVEs, 95% smaller attack surface, 7-day SLA on critical/high CVEs. ActiveState provides 95% fewer CVEs and 90% faster remediation than community open source, backed by a 5-day SLA on critical vulnerabilities.

Available Now

The Docker and ActiveState reselling partnership is available now. Explore the partnership.

Quelle: https://blog.docker.com/feed/

da Agency

Security Update on PHP2Shell: Impact for Docker Customers

Summary

On Tuesday, October 20, 2026, Docker began tracking two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, commonly known as PHP2Shell. The vulnerabilities allow attackers to execute code remotely in PHP core, and they affect PHP packages going back to version 5.4: the supported versions 8.2 through 8.5, and the end-of-life versions 5.x, 7.x, 8.0, and 8.1.

To address these vulnerabilities, PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and advised anyone running PHP to update to the latest version immediately.

Although this is a vulnerability in PHP itself, not in Docker’s systems, it nonetheless affects Docker users who build on PHP images and packages. In response, we have updated the Docker Hardened Images and Docker Official Images on Docker Hub, and advise customers to immediately update.

What Happened

Along with other package repositories and secure package providers, Docker has been made aware of and is tracking two recently discovered critical vulnerabilities in PHP packages distributed since version 5.4. The two critical vulnerabilities, now commonly referred to as “PHP2Shell,” are identified and tracked as CVE-2026-109618 and CVE-2026-109619. (The PHP Foundation has published a detailed report on the discovery that we recommend reading for full context.)

In short: these vulnerabilities could allow remote code execution in PHP core by malicious actors. Both are flaws in how PHP manages request memory. In CVE-2026-109618, when PHP runs out of memory mid-request and aborts, some code paths leave memory uninitialized, and PHP’s cleanup step then reads it. In CVE-2026-109619, PHP’s internal state can keep pointing at memory that has already been freed, and a later request then uses that stale state. Attackers have multiple ways to trigger either condition and turn it into remote code execution.

Affected versions include the currently supported versions (8.2 through 8.5), as well as the EOL and unsupported versions 5.x, 7.x, 8.0, and 8.1.

Impact to Anyone Using PHP

Whether you are a Docker user or not, if you are using any of the above affected versions of PHP, you should immediately upgrade to the latest version. That includes PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or a later release in the corresponding branch.

There is no other comprehensive remediation for the affected versions. Updating is the only complete mitigation path.

If for any reason you are unable to complete an immediate update, we strongly recommend taking your system offline until such time that you can initiate mitigation. This the guidance of not only Docker, but of the FBI, and numerous experts throughout the cybersecurity community.

Impact to and Actions for Docker Users

While this vulnerability exists in PHP itself and not directly in Docker’s systems, there is nonetheless potential risk and exposure to Docker customers who run PHP in their applications, including anyone using PHP images or packages from Docker Hub, Docker Official Images, or Docker Hardened Images.

For users of Docker Official Images:Docker Official Images have already been updated and released to Docker Hub and mirrored to Amazon ECR. Customers using either of these sources should update immediately.

For users of Docker Hardened Images (DHI):Docker Hardened Images have already been updated and released to Docker Hub. The currently supported versions of PHP were updated as follows:

8.2.34 → 8.2.35

8.3.35 → 8.3.36

8.4.26 → 8.4.27

8.5.11 → 8.5.12

The updates to our images were completed and released within 24-hours of the upstream patches being made available. These images were made available after successfully executing the DHI testing and verification processes.

What’s next

If you have any issues accessing the updated images or migrating to the new versions, please contact Docker Support at app.docker.com/support/contact. As always when it comes to matters of security, we appreciate your diligence.
Quelle: https://blog.docker.com/feed/

da Agency

AWS Lambda MicroVMs is now available in 4 additional AWS regions

AWS Lambda MicroVMs is now available in 4 additional AWS Regions: Asia Pacific (Hong Kong), Asia Pacific (Malaysia), Asia Pacific (Thailand), and Europe (Spain). With this launch, you can use Lambda MicroVMs in a total of 14 AWS Regions.
Lambda MicroVMs is a serverless compute primitive that provides VM-level isolation, near-instant launch and resume speeds, and state preservation for executing user or AI generated code.  Developers can use Lambda MicroVMs to give each user or job their own isolated compute environment without managing virtualization infrastructure or choosing between isolation, speed, and state retention. MicroVMs enable secure, stateful, and responsive code execution for applications including AI coding assistants, interactive development environments, and vulnerability scanners.
With today’s launch, developers can run Lambda MicroVMs closer to their end-users in 4 additional Regions, helping meet latency and data residency requirements. To get started, create a MicroVM image from your Dockerfile, then launch MicroVMs from that image. Give each user or job their own MicroVM with a dedicated HTTPS URL that supports popular connectivity protocols such as HTTP/2, gRPC, and WebSockets. You can use MicroVMs through the AWS Lambda console, AWS CloudFormation, AWS Cloud Development Kit, or with your preferred Agentic development tools using the Agent Toolkit for AWS.
To learn more, visit the AWS Lambda MicroVMs developer guide. For information on pricing, see Lambda MicroVMs pricing. Visit the AWS Capabilities by Region page for the latest region availability.
Quelle: aws.amazon.com

da Agency

Amazon SageMaker AI now supports serverless model customization for Muse Glimmer, Qwen 3.8 and Ministral 3 models

Amazon SageMaker AI now supports serverless model customization for Muse Glimmer, Qwen3.8 27B, and Ministral 3 3B, 8B, and 14B models. In addition to deploying these models on SageMaker AI, you can now adapt them to your specific domains and workflows, using supervised fine-tuning (SFT), direct preference optimization (DPO), and reinforcement fine-tuning (RFT) techniques. You can also adapt these models with either low-rank adaptation (LoRA) or full fine-tuning techniques. This launch adds these models to a wide variety of models available for serverless customization on SageMaker AI, including models from the Nova, Gemma 4, Nemotron 3.5, Qwen, Llama, gpt-oss, and DeepSeek families.
Model customization lets you tailor foundation models with your proprietary data so a smaller, right-sized model can match frontier-model quality on your tasks, while also reducing cost and latency. You can use labeled data with SFT to improve accuracy on domain-specific tasks, preference data with DPO to align outputs with your organization’s tone, or reward signals with RFT to improve performance on new tasks. With serverless customization, SageMaker AI handles all infrastructure provisioning and training orchestration, so you can focus on your data and evaluation rather than cluster management, and only pay for what you use.
Serverless model customization on SageMaker AI is available in US East (N. Virginia), US West (Oregon), Asia Pacific (Tokyo), and Europe (Ireland). To get started, navigate to the Models page in Amazon SageMaker Studio to launch a customization job, use the SageMaker Python SDK or use our Agent skills with your choice of coding assistant. To learn more and see the full supported list of models, see the Amazon SageMaker AI model customization documentation.
Quelle: aws.amazon.com

da Agency

AWS announces AWS Interconnect – last mile preview with Megaport

AWS launches AWS Interconnect – last mile preview with Megaport, a fully managed connectivity offering that allows customers to connect their branch offices, data centers, and remote locations to AWS with just a few clicks, eliminating the friction and complexity of network setup. As a milestone collaboration between AWS and Megaport, AWS Interconnect – last mile combines AWS cloud innovation with Megaport operating one of the world’s largest Software Defined Networks (SDN), with 1,200+ enabled data centers across 31 countries.
Through the AWS Management Console, customers can now instantly establish private, high-speed connections to AWS by simply choosing their preferred AWS Region, bandwidth speed, Direct Connect Gateway ID and partner subscriber ID. Once initiated, AWS generates an activation key to complete connectivity provisioning with Megaport. The launch simplifies the connectivity experience by pre-provisioning capacity and automating complex network configuration including BGP peering, VLAN configuration, and ASN assignment. At GA, customers will also be able to dynamically scale bandwidth from 1 Gbps to 100 Gbps through the AWS Console. The service is designed for high availability, with zero down-time maintenance, backed by a 99.99% SLA. 
AWS Interconnect – last mile is available in the San Jose (us-west-1) and N. Virginia (us-east-1) metros through Megaport. You can create a preview Interconnect using the AWS Management Console, Command Line Interface (CLI), or API. Partners can also easily adopt via a published open API package on GitHub. For more information, see the AWS Interconnect – last mile documentation and pricing pages.
Quelle: aws.amazon.com