WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2026 Europe β€’ Jul 10, 2026 β€’ Session details

From Build to Breach: Hacking Kubernetes Through the Supply Chain

Ali Alp

How does a seemingly harmless NPM package bypass your Kubernetes firewalls? Watch a realistic supply chain attack exploit AI-generated code and DNS tunneling to stealthily extract cluster secrets.

Pause
Mute Enter Fullscreen
#1 about 3 min

Adopting AI tools for developer container workflows

How developers rely on artificial intelligence to build software architectures and automated unit tests.

#2 about 2 min

Implementing standard Kubernetes cluster security practices

Operations teams establish secure baselines utilizing admission controllers, system call monitors, and restricted network policies.

#3 about 3 min

Infiltrating the open source software supply chain

Malicious actors compromise dependencies in package registries and artificially inflate repository reputation to target AI training sets.

#4 about 4 min

Understanding dependency trees and DNS resolution mechanics

Attackers leverage deeply nested leaf dependencies and legitimate cluster DNS structures to conceal unauthorized network traffic.

#5 about 6 min

Executing a DNS exfiltration attack in Kubernetes

A live demonstration shows how a compromised container payload leaks service account tokens through encoded subdomain queries.

#6 about 4 min

Analyzing the failure of standard admission controllers

Standard defense configurations overlook stealthy transport mechanisms because default monitoring policies ignore capability-free UDP traffic.

#7 about 4 min

Auditing AI-generated dependencies for multi-vector threats

Organizations must perform contextual security analysis on interconnected software packages instead of blindly trusting automated deployments.

#8 about 3 min

Enforcing DNS hygiene and repository reputation boundaries

Monitoring outbound resolution protocols and avoiding unwarranted repository endorsements significantly restricts automated supply chain vulnerabilities.

#9 about 6 min

Exploring advanced threat detection and monitoring configurations

Advanced configurations allow system call monitors to inspect sensitive environment variables and catch complex hidden exploits.

Matching moments

1:39 min

Introduction to Kubernetes security challenges and opportunities

Marc Nimmerrichter Β· World Congress 2022

3:36 min

Understanding software supply chain threats and security risks

Andrei Epure Andrei Epure Β· World Congress 2024

3:39 min

Exploring the mechanics of software supply chain attacks

Chris Heilmann +2 Β· LIVE

1:03 min

Highlighting supply chain vulnerabilities from obfuscated package manager backdoors

Daniel Cranney +1 Β· LIVE

4:40 min

Assessing common Kubernetes security incidents and misconfigurations

Rico Komenda Rico Komenda Β· World Congress 2025

5:13 min

Identifying sophisticated supply chain attacks and simulated software vulnerabilities

Mohamed Shiralizadeh Β· Coffee With Developers

More from World Congress 2026 Europe

Building the Nervous System of AI - Michael Kagan (NVIDIA) thumbnail
29:17
2 months ago

Building the Nervous System of AI - Michael Kagan (NVIDIA)

Michael Kagan, Sead Ahmetović

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote thumbnail
19:41
2 months ago

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote

Christian Heilmann

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend thumbnail
32:06
2 months ago

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend

David vonThenen

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes thumbnail
35:13
2 months ago

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes

Irina Branovic

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬 thumbnail
24:23
2 months ago

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬

Jeremy Murray

Angstfreude - AI and Corporate Culture - The Thrill and the Threat thumbnail
30:26
2 months ago

Angstfreude - AI and Corporate Culture - The Thrill and the Threat

Axel Ebert, Karin Krobath

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 25, 2026 Β· 09:40–10:10

Stage 4

Your registry can't stop a valid login. What happens then?

Khushboo Verma

Systems Engineer at Cloudflare

Khushboo Verma
Open session

World Congress 2026 North America

September 24, 2026 Β· 11:40–12:10

Stage 3

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

September 23, 2026 Β· 15:45–17:45

Stage 10

Securing the Agentic Stack: Docker Hardened Images and Supply Chain Security

Ajeet Raina

Developer Advocate at Docker

Ajeet Raina
Open session

World Congress 2026 North America

September 25, 2026 Β· 15:30–16:00

Mainstage

One Boundary for the Agentic Era

Mark Lechner

Chief Information Security Officer of Docker

Mark Lechner
Open session

World Congress 2026 North America

September 24, 2026 Β· 12:15–12:45

Stage 6

AI vs. AI: Defending the open source supply chain with agentic workflows

Manfred Moser

Senior Principal DevRel Engineer at Chainguard

Manfred Moser
Open session

World Congress 2026 North America

September 25, 2026 Β· 12:30–14:30

Stage 13

Docker sandboxes: protect your secrets, tokens, and personal data from AI agent mistakes

Kristiyan Velkov

Front-End Advocate | Speaker | AI & DevOps | Docker Captain | Cursor Ambassador | DevReal | Tech Blogger | Book Author

Kristiyan Velkov

Related videos

Hacking Kubernetes: Live Demo Marathon thumbnail
46:36
World Congress 2022 β€’ about 4 years ago

Hacking Kubernetes: Live Demo Marathon

Andrew Martin

Supply Chain Security and the Real World: Lessons From Incidents thumbnail
24:47
World Congress 2025 β€’ about 1 year ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Kubernetes Security Best Practices thumbnail
23:08
World Congress 2025 β€’ about 1 year ago

Kubernetes Security Best Practices

Rico Komenda

Kubernetes Security - Challenge and Opportunity thumbnail
42:45
World Congress 2022 β€’ about 4 years ago

Kubernetes Security - Challenge and Opportunity

Marc Nimmerrichter

Beyond SBOMs: The Future of Container Supply Chain Security thumbnail
30:38
World Congress 2026 Europe β€’ 2 months ago

Beyond SBOMs: The Future of Container Supply Chain Security

Mohammad-Ali A'rΓ’bi

Walking into the era of Supply Chain Risks thumbnail
37:36
LIVE β€’ over 4 years ago

Walking into the era of Supply Chain Risks

Vandana Verma

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.