Researchers find that ~400 servers running unpatched Docker instances are also cryptojacked, after a flaw was found last month in runC, a command line utility
Sergiu Gatlan / BleepingComputer :
Context & Ripple Effects
This is the second time in a year that Docker's ecosystem has surfaced as an attack surface rather than just a developer tool: researchers had already pulled 17 backdoored Docker Hub images downloaded more than five million times, some used to mine at least $90K in Monero. The new finding extends the problem from poisoned images to the runtime itself — servers left unpatched against last month's runC flaw are now hosting attackers' miners.
The pattern fits a broader one in the corpus: when a severe server-side flaw goes public, opportunistic cryptojacking follows fast, from 350+ sites serving cryptomining scripts after the Drupal disclosures to the later waves hitting unpatched Apache servers via Log4j. Docker matters more here because containers share a host kernel, so one unpatched utility can expose every workload on a machine.
First-order effects
- Operators of the ~400 affected servers are paying real electricity and compute costs to mine cryptocurrency for someone else, and must both patch runC and evict the miners before reclaiming the machines.
- Every organization running Docker on internet-facing hosts faces an immediate patching deadline on the runC flaw, since the same exploit path demonstrably works at scale.
Second-order effects
- Trust in Docker Hub as a distribution channel takes another hit so soon after the image-backdoor incident, pushing enterprises toward vetted registries and image-scanning before deployment.
- Security vendors gain a concrete selling point for container-specific monitoring, because the compromise lives at the shared-runtime layer where traditional per-app tools don't look.
Third-order effects
- If the cycle repeats — public flaw, rapid cryptojacking sweep, slow patching tail — shared container infrastructure will be treated like operating systems: a single runtime vulnerability is a fleet-wide event, and patch latency becomes the primary security metric.
- The recurring monetization of unpatched servers, from Drupal to Docker to Apache, points toward cryptojacking being the default first wave of any new server-side exploit, shaping how defenders prioritize emergency patches.
The trend: Cryptojacking has become the standard immediate payoff for newly disclosed server-side flaws, with shared container runtimes turning one unpatched utility into a whole-host compromise.