[backdoor]

November 7, 2026

• ARTEX's Docker images were themselves backdoored: commands placed in the login form's captcha field executed before the password check, giving anyone who knew the trick a root shell. BadByte counts 7,946 pulls of tomicdd/artex and congdonglinux/artex before disclosure, 46 of 62 internet-exposed consoles still serving the backdoored build on 4 November, and 637 GitHub repos still pointing their compose file at it. Docker removed both images on 5 November; existing installs are unaffected by the takedown (BadByte). · Agentic Tooling in the Wild

in SSHole Exploitation Lands Within Hours of Disclosure