Carbonato Botnet Installs an AI Agent on Every Docker Host It Hijacks
An open Docker socket used to be a server breach. Now it also comes with a robot. ThreatDown disclosed Carbonato on 24 September, a botnet that spreads by finding Docker hosts with the daemon API exposed on port 2375, no password, no TLS. The exposed port itself is old news; that same misconfiguration has been…