Penetration Tester: 2026-09-21

1. Guest to host: escaping Docker's hypervisor

   Accomplish, 2026-09-19. Read, 4 min.

   Accomplish published the details of CVE-2026-77179, a sandbox escape it reported in Docker's hypervisor for Mac: the virtio-fs file server running on the host falls back to the path string it saved at first lookup, so a container that holds a file open, deletes the file and its parent folder, then recreates the parent as a symlink makes the server resolve that string to a file outside the mounted folder, giving the container read and write access to the host filesystem in three lines of bash. Docker fixed it in Docker Desktop 4.88.0 and Docker Sandboxes 0.42.0, and the post says Docker Desktop is affected only when Docker VMM is selected in Settings, which is scheduled to become the Docker Desktop default at the end of October 2026.

   Why it matters for this role: Three lines of bash give a container read and write access to the host filesystem when Docker VMM is selected. Worth having in the kit before Docker VMM becomes the Docker Desktop default at the end of October 2026.

2. ZDI-26-716: Cisco Identity Services Engine createDBLink Command Injection

   Zero Day Initiative, 2026-09-18. Read, 1 min.

   ZDI published CVE-2026-20176, CVSS 7.2, in Cisco Identity Services Engine: the createDBLink method does not properly validate a user-supplied string before using it to execute a system call, so a remote attacker can execute arbitrary code. Authentication is required, the code runs in the context of the iseadminportal user, and Cisco has issued an update.

   Why it matters for this role: An authenticated path to code execution as iseadminportal on Cisco Identity Services Engine. The advisory names no affected or fixed version, so follow it through to the Cisco advisory before you scope it for an engagement.

3. From Fork to Framework: What Modifying Apollo Taught Us

   Bishop Fox, 2026-09-18. Read, 16 min.

   Bishop Fox published what happened when its red team forked Mythic's Apollo agent after hardened clients' endpoint detection started consistently flagging the team's tooling: it built a custom obfuscator to strip every detectable string and metadata pattern, then spent months fixing the fallout, because the agent's architecture assumed stable, readable symbol names at every layer. The post says that assumption defeated the fork before any defender did, and that the limits of the approach shaped the architectural decisions the team made when it built an agent from scratch.

   Why it matters for this role: If you modify an existing agent rather than write one, this is the cost accounted for. The assumption that broke the fork is architectural, so it carries over to whatever framework you pick up next.

Penetration Tester