Top all-time · #705
Unit 42
Company blog · unit42.paloaltonetworks.comsecurity
Unit 42 is the company blog at unit42.paloaltonetworks.com, writing about security. Since 2019, 93 different Hacker News readers have linked it 116 times, most often “Cross-Account Container Takeover in Azure Container Instances”. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Rarely recommended · 2 of 35 sampled comments recommend it?
Why HN links it
HN readers link Unit 42 threat research on malware, ransomware, supply-chain attacks, DNS tunneling and container or cloud vulnerabilities. Posts are cited as sources and background for security discussions.
Summarised by Claude from a sample of 35 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Unit 42 brings together world-renowned threat researchers, incident responders and security consultants to create an intelligence-driven, response-ready organization that's passionate about helping you proactively manage cyber risk.
Most-linked posts?
- Cross-Account Container Takeover in Azure Container Instances6 people · 7 mentions · first linked 2021-09-09
- DNS Tunneling: how DNS can be (ab)used by malicious actors4 people · 4 mentions · first linked 2020-02-26
- Attackers Cryptojacking Docker Images to Mine for Monero3 people · 3 mentions · first linked 2020-06-25
- Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident3 people · 3 mentions · first linked 2025-04-05
- Pass the Passkey: A Novel Attack Surface in Passwordless Authentication3 people · 3 mentions · first linked 2026-08-03
- Windows Server Containers Are Open, and Here’s How You Can Break Out3 people · 3 mentions · first linked 2020-07-17
- Martian packets in Kubernetes (CVE-2020-8558)2 people · 2 mentions · first linked 2020-07-28
- FabricScape: Escaping Service Fabric and Taking over the Cluster2 people · 2 mentions · first linked 2022-06-29
- Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild2 people · 2 mentions · first linked 2026-03-10
- Chinese APT Abuses VSCode to Target Government in Asia2 people · 2 mentions · first linked 2024-09-10
What Hacker News says?
https://unit42.paloaltonetworks.com/new-os-x-ransomware-kera... It turned out to be ransomware, for anyone not following.
Comment linking /new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/
on “Can't you just right click?”Submitted Making Containers More Isolated: An Overview of Sandboxed Container Technologies as a story · 144 points
HN discussion>but I personally don't find affidavits on "The Smoking Gun" convincing Are you saying you think the affidavit is fake? Or that the info in the affidavit is not a strong indicator of Russia's involvement? > but it only shows that someone used (outdated!) malware that is available to any script kiddie, not state-level superhackerware. Stuxnet it ain't. Russia sometimes intentionally uses unsophisticated malware becau…
Comment linking /unit-42-technical-analysis-seaduke/
on “Facebook, Twitter block the NY Post from posting”Submitted Rootless Containers as a story · 128 points
HN discussionThat is what the tj-actions attacker did: https://unit42.paloaltonetworks.com/github-actions-supply-ch...
Comment linking /github-actions-supply-chain-attack/
on “We all dodged a bullet”Submitted New Linux vulnerability affecting cgroups: can containers escape? as a story · 123 points
HN discussion> The only sense in which passkeys have anything to do with this at all is that the attackers used the word "passkey" in their emails. That's wrong. They attackers actually go on to create a real passkey that gives their device access to the compromised account. Accounts that are already protected by passkeys can still be vulnerable too. see: https://www.forbes.com/sites/zakdoffman/2025/08/28/yes-your-... https://ww…
Comment linking /passwordless-authentication-security-risks/
on “Passkeys are not a trap”Submitted Cross-Account Container Takeover in Azure Container Instances as a story · 121 points
HN discussionNormal DNS over UDP can also contain arbitrary data, which completely hypothetcally could be used to send identifying data about the client. E.g. https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-ca... But that's not really a strike against the protocol, that would be a fault of the implementation.
Comment linking /dns-tunneling-how-dns-can-be-abused-by-malicious-actors/
on “Mozilla’s DNS over HTTPs”Submitted Understanding REvil: The Ransomware Gang Behind the Kaseya Attack as a story · 94 points
HN discussionThe one in recent memory for me is the KeRanger ransomware that was distributed in the official Transmission installer. https://unit42.paloaltonetworks.com/new-os-x-ransomware-kera... >Transmission representative John Clay told Reuters via email that the ransomware was added to disk-image of its software after the project's server was compromised in a cyber attack. >"We're not commenting on the avenue of attack, oth…
Comment linking /new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/
on “Porting Firefox to Apple Silicon”Submitted AWS Log4Shell HotPatch Introduced a Container Escape Vulnerability as a story · 44 points
HN discussionConsider the possible ways for a string to be injected into any of the following: Apache Solr Apache Druid Apache Flink ElasticSearch Flume Apache Dubbo Logstash Kafka If you've got any of them, they're likely exploitable too. That list comes from: https://unit42.paloaltonetworks.com/apache-log4j-vulnerabili... The attack surface is quite a bit larger than many realize. I recently had a conversation with a person wh…
Comment linking /apache-log4j-vulnerability-cve-2021-44228/
on “Summary of the AWS Service Event in the Northern Virginia (US-East-1) Region”Submitted Full Docker Breakout Exploit as a story · 19 points
HN discussionDefinitely not secure. The author did a great job explaining container runtimes in basic terms, but there's a lot of security features missing. Mainly: * Reducing the container's capabilities * Restricting access to resources through cgroups * Applying seccomp filters to prevent certain syscalls. As another comment suggested, user namespaces are another hardening feature, but not all container runtimes enable it by…
Comment linking /breaking-docker-via-runc-explaining-cve-2019-5736/
on “Linux containers in a few lines of code”Submitted Iranian Cyber Actors Impersonate Model Agency in Suspected Espionage Operation as a story · 11 points
HN discussionI did apologize, didn't I? :-) Perspective is everything, I guess. You look at that three year old comment and think it's not particularly informative. I look at that comment and see an experienced infosec pro at Fly.io, who runs billions of container workloads and doesn't trust the cgroups+namespaces security boundary enough so goes to the trouble of running Firecracker instead. (There are other reasons they landed…
Comment linking /cve-2022-0492-cgroups
on “Python on the Edge: Fast, sandboxed, and powered by WebAssembly”Submitted The History of DNS Vulnerabilities and the Cloud as a story · 11 points
HN discussionThe dark remix version of this is fast flux hosting and what a lot of the bulletproof hosting providers use. https://unit42.paloaltonetworks.com/fast-flux-101/
Comment linking /fast-flux-101/
on “Understanding Round Robin DNS”Submitted Pass the Passkey: A Novel Attack Surface in Passwordless Authentication as a story · 10 points
HN discussionPalo Alto Networks - Unit 42 | Principal Security Automation Engineer | Full-Time | Remote | https://unit42.paloaltonetworks.com/ We are looking for a principal level engineer with experience in React and Python to work on the Unit 42 Engineering organization inside Palo Alto Networks. Day to day, the candidate will help build the tools/services that Palo Alto Networks researchers rely on to better understand threat…
Comment linking /
on “Ask HN: Who is hiring? (August 2021)”Submitted Previously unknown spyware used in 0-day attacks on Samsung phones as a story · 6 points
HN discussionCVEs for breaking out of a docker container come along as well [1]. Usually you need root in the docker container, but if you combine it with an escalation from non-root to root.. well, you can see how that's less secure than a VM [1] https://unit42.paloaltonetworks.com/breaking-docker-via-runc...
Comment linking /breaking-docker-via-runc-explaining-cve-2019-5736/
on “No support Linux hosting shutting down from hack”Submitted Cross-Account Container Takeover in Azure Container Instances as a story · 5 points
HN discussion> While in no ways perfect, Apple's walled garden gets rid of a huge amount of the enshittification found on other platforms, and makes it so that downloading a random app is relatively safe and unlikely to nuke your phone, steal your data, etc. Yes all the "allow access to location/photos/etc." are annoying, but at least the user has some level of control and consent. Better than Android sure, but let's not get too…
Comment linking /novel-malware-xcodeghost-modifies-xcode-infects-apple-ios-apps-and-hits-app-store/
on “Y Combinator files brief supporting Epic Games, says store fees stifle startups”Submitted Windows Server Containers Are Open, and Here’s How You Can Break Out as a story · 5 points
HN discussionyour code may be secure, but your cloud neighbor or VM host may be not. if VM host machine is taken over, then your VMs are at risk too https://unit42.paloaltonetworks.com/azure-container-instance...
Comment linking /azure-container-instances/
on “A call to reconsider memory address-space isolation in Linux”Submitted Palo Alto retracts claim of PHP2Shell exploitation at European government agency as a story · 4 points
HN discussionHow Azure isolates VM's is completely unrelated, because containers are not VM's . And if you meant to assert that Azure uses hardware assisted isolation between tenants in general, that was not the case for azurescape [1] or chaosDB [2]. [1] https://unit42.paloaltonetworks.com/azure-container-instance... [2] https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-v...
Comment linking /azure-container-instances/
on “Building a Linux Container Runtime from Scratch”Submitted New spyware exploited a Samsung 0-day delivered through WhatsApp messages as a story · 4 points
HN discussion
