Backdoored ARTEX Docker image exposes servers to root access

A Docker image for the ARTEX security tool contains a backdoor that grants unauthenticated root access, according to The Hacker News. The tomicdd/artex image recorded 9,000 downloads on Docker Hub.

The modified ARTEX repository changed its Docker configuration to pull that image. The image adds a hidden function to the login handler that executes commands as root when the CAPTCHA field begins with a secret marker, before checking credentials.

As many as 62 internet-facing ARTEX consoles were found serving the backdoored build from November 2 to 4, 2026. In all, 1,645 hosts were found serving an ARTEX console as of November 4.

CERT-In said an AI-assisted threat actor it tracks as Crafty Falcon is using ARTEX and other publicly available AI-driven offensive tools in active attacks against Indian banking and financial organizations, cryptocurrency exchanges, and digital asset providers. ARTEX's developer removed the original repository from GitHub after reports of malicious use, but copies later appeared on GitHub and Docker Hub.

CERT-In has also published Artificial Intelligence Security Auditing Guidelines, which require AI agents to get human approval for consequential actions and high-risk AI systems to include emergency interruption and credential revocation.