> Markdown version of [/events/world-congress-2026-north-america/sessions/1755-how-docker-caught-a](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1755-how-docker-caught-a). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# How Docker caught a supply chain attack in 83 minutes


- **Event:** World Congress 2026 North America

## Description

On April 22, 2026, a threat actor used stolen Checkmarx credentials to push malicious images to a trusted Docker Hub repository. The payload quietly collected scan output, encrypted it, and exfiltrated it to attacker-controlled infrastructure. It was live for 83 minutes before Docker caught it.

This talk is about how. Not the incident itself, but the detection model behind it: what signals fired, why no single one was enough, and what it means to build a supply chain posture where the question is not "can we prevent every breach" but "how fast can we find it and how small is the blast radius."

We cover the structural pattern behind Trivy, KICS, LiteLLM and axios: stolen credentials, legitimate publishing flows, short exposure windows. Then we get into what Docker actually does differently: provenance-linked builds, digest pinning, cooldown periods, cross-registry signal sharing, and Docker Hardened Images as the foundation that sits outside the attack surface entirely.

You leave with a concrete checklist your team can act on tomorrow, and a mental model that holds regardless of which tool gets hit next.

## Speaker

### [Khushboo Verma](https://www.wearedevelopers.com/@khushboo-verma)

Systems Engineer at Cloudflare


## Related talks at this congress

- [Stop Running Mystery Meat in Production](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1726-stop-running-mystery) — Jeroen van Erp
- [rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1718-rm-rf-horror-stories) — Rishab Kumar
- [Docker sandboxes: protect your secrets, tokens, and personal data from AI agent mistakes](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1762-docker-sandboxes) — Kristiyan Velkov
- [On the Public Clock: Open-Source Defense When You're Not in the Club](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1683-on-the-public-clock) — Nicholas Muy

## Watch remotely

Can’t make it to San José? Watch this session live with Pro. You also get:

- All full videos, bookmarks, and playlists
- World Congress livestreams

[See pricing](https://www.wearedevelopers.com/pricing)

## Links

- [Get tickets](https://www.wearedevelopers.com/world-congress-north-america/tickets)