[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-190":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-190","SP 800-190","SP 800-190: Application Container Security Guide",24,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST guidance on security concerns of application containers and practical countermeasures. It covers risks to images, registries, orchestrators, containers and host operating systems, and how to adapt security practices to container-based delivery. Its recommendations apply whether containers run on self-managed hosts or on managed cloud platforms.\n\n**In practice.** Applying it well means scanning images for vulnerabilities and configuration problems, using trusted and signed images from controlled registries, and running containers with least privilege on hardened, container-specific hosts. Orchestrator access is tightly controlled and network policies separate workloads. Evidence includes pipeline scanning results, registry controls, orchestrator configuration and runtime monitoring.\n\n**Common gaps.** Typical gaps are containers running as root, outdated base images, broad orchestrator permissions and no runtime visibility. Images pulled directly from public registries without review are another frequent weakness.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F190\u002Ffinal","Read the publication at NIST","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"critical-rce-dns-wallet-theft-container-escape-self-healing-malware-highlight-diverse-threat-week","Critical RCE, DNS Wallet Theft, Container Escape & Self-Healing Malware Highlight Diverse Threat Week","2026-10-15T20:20:52.553+00:00",{"slug":23,"title":24,"published_at":25},"researchers-breach-windows-smartscreen-vbs-enclave-via-memory-write-and-timing-flaw","Researchers Breach Windows SmartScreen VBS Enclave via Memory Write and Timing Flaw","2026-10-14T08:21:27.74+00:00",{"slug":27,"title":28,"published_at":29},"critical-dell-csm-flaws-allow-unauthenticated-root-access-on-kubernetes-nodes","Critical Dell CSM Flaws Allow Unauthenticated Root Access on Kubernetes Nodes","2026-10-02T18:21:14.277+00:00",{"slug":31,"title":32,"published_at":33},"wsl-linux-containers-security-considerations-for-enterprise-environments","WSL Linux Containers: Security Considerations for Enterprise Environments","2026-09-30T02:20:22.354+00:00",{"slug":35,"title":36,"published_at":37},"ai-powered-botnet-exploits-exposed-docker-hosts-to-steal-credentials","AI-Powered Botnet Exploits Exposed Docker Hosts to Steal Credentials","2026-09-28T22:21:13.3+00:00",{"slug":39,"title":40,"published_at":41},"exposed-docker-daemons-hijacked-by-ai-powered-telegram-botnet","Exposed Docker Daemons Hijacked by AI-Powered Telegram Botnet","2026-09-28T19:22:07.687+00:00",{"slug":43,"title":44,"published_at":45},"cloudflare-container-flaw-exposed-residual-disk-data-across-customers","Cloudflare Container Flaw Exposed Residual Disk Data Across Customers","2026-09-25T08:20:52.099+00:00",{"slug":47,"title":48,"published_at":49},"ai-powered-carbonato-botnet-hijacks-exposed-docker-hosts","AI-Powered Carbonato Botnet Hijacks Exposed Docker Hosts","2026-09-24T22:21:47.499+00:00",{"slug":51,"title":52,"published_at":53},"unpatched-ubuntu-kernel-flaw-enables-container-escape-to-host-root","Unpatched Ubuntu Kernel Flaw Enables Container Escape to Host Root","2026-09-23T19:22:22.421+00:00",{"slug":55,"title":56,"published_at":57},"14-year-old-linux-kernel-flaw-among-three-actively-exploited-vulnerabilities","14-Year-Old Linux Kernel Flaw Among Three Actively Exploited Vulnerabilities","2026-09-21T22:20:38.454+00:00",{"slug":59,"title":60,"published_at":61},"docker-sandbox-escape-exposes-macos-host-files-to-guest-code","Docker Sandbox Escape Exposes macOS Host Files to Guest Code","2026-09-18T04:21:00.629+00:00",{"slug":63,"title":64,"published_at":65},"claude-ai-breaches-real-systems-during-security-tests-fourth-incident-reported","Claude AI Breaches Real Systems During Security Tests — Fourth Incident Reported","2026-09-11T18:23:10.394+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",11,{"slug":73,"name":74,"problem":75,"stories":76},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",10,{"slug":78,"name":79,"problem":80,"stories":81},"patch-management","Automated patch management","Known holes get closed in days, not months.",9,{"slug":83,"name":84,"problem":85,"stories":86},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",6,{"slug":88,"name":89,"problem":90,"stories":91},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",5,{"slug":93,"name":94,"problem":95,"stories":96},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",4,[98,104,110,114,118,122,126,131],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","4","Control 4","Secure Configuration of Enterprise Assets and Software",15,{"family":105,"item":106,"code":107,"title":108,"together":109},"nist-800-53","cm-6","CM-6","Configuration Settings",12,{"family":99,"item":111,"code":112,"title":113,"together":71},"12","Control 12","Network Infrastructure Management",{"family":99,"item":115,"code":116,"title":117,"together":71},"7","Control 7","Continuous Vulnerability Management",{"family":105,"item":119,"code":120,"title":121,"together":76},"si-2","SI-2","Flaw Remediation",{"family":123,"item":124,"code":125,"title":125,"together":76},"itil","overview","ITIL",{"family":105,"item":127,"code":128,"title":129,"together":130},"ac-6","AC-6","Least Privilege",8,{"family":105,"item":132,"code":133,"title":134,"together":135},"ac-3","AC-3","Access Enforcement",7]