VulnHub

A serious vulnerability has been discovered in Canonical's LXD and MicroCloud, allowing attackers to log in as a trusted client without needing the client's private key. To exploit this flaw, an attacker only requires access to the trusted client's public certificate and the ability to reach the HTTPS API over the network. Once authenticated, the attacker can impersonate the client, gaining access to the entire cluster and its virtual machines. This breach poses significant risks, especially if the impersonated account has elevated privileges, potentially leading to unauthorized data access or manipulation. Users of LXD and MicroCloud should take immediate action to secure their systems against this vulnerability.

On October 29, hackers exploited a vulnerability in the prediction market platform Polymarket, hijacking a debug script to steal approximately $2.7 million from traders. The attackers replaced a legitimate page-speed script with malicious code, which allowed them to sell the positions of signed-in users and transfer their funds to themselves. Polymarket has acknowledged the breach and is in the process of refunding the affected users, totaling 726 wallets. The incident raises concerns about the security of third-party scripts and the potential risks they pose to online platforms. Users of Polymarket and similar services should be vigilant about the security measures in place to protect their assets.

The FBI has linked a North Korean hacking group known as TraderTraitor to a massive theft of over $6 billion in cryptocurrency. This group, also referred to as Jade Sleet and several other names, has been involved in various cybercrimes and is believed to have targeted the Binance cryptocurrency exchange. The investigation involved collaboration with the U.S. Secret Service and the IRS Criminal Investigation unit. This incident raises significant concerns about the security of cryptocurrency exchanges and the ability of state-sponsored actors to carry out large-scale cyber heists. As the cryptocurrency market continues to grow, the risk of such attacks may increase, potentially affecting users and investors alike.

Cybersecurity researchers from Kaspersky have reported a sophisticated malware campaign targeting government systems in Asia. This campaign exploits a custom version of Windows 10 used exclusively by government agencies. The malware, dubbed NetamLoader, employs a new type of .NET assembly-loading framework, which has not been documented before. This is concerning because it could allow attackers to infiltrate sensitive government networks, potentially leading to data breaches or other malicious activities. The use of a previously unknown technique makes it particularly challenging for cybersecurity defenses to detect and mitigate this threat effectively.

Northflank, a cloud application hosting platform, has experienced a security breach that allowed unauthorized access to customers' AI API keys. As a result, the company is advising all users to immediately rotate their credentials and any secrets stored on their platform. This incident raises concerns about the security of sensitive information and the potential misuse of AI tools that rely on these API keys. Affected customers may face risks such as data theft or unauthorized actions performed through their AI services. It is crucial for users to take prompt action to secure their accounts and prevent further exploitation.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities in Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities catalog due to reports of active exploitation. One of the vulnerabilities, identified as CVE-2026-111357, has a CVSS score of 8.8 and involves a lack of authentication for a critical function, which could allow attackers to gain unauthenticated root access. This is particularly concerning for organizations using Ivanti's services, as it poses significant risks to their security infrastructure. Companies relying on Ivanti Connect Secure should take immediate action to assess and mitigate these vulnerabilities to protect their systems from potential breaches.

Cloudflare reported a significant increase in network-layer DDoS attacks in the third quarter of 2026, with a staggering 18.2 million attacks mitigated over the three-month period. This translates to an average of about 8,226 attacks every hour, or roughly 197,400 attacks daily. The scale of these attacks is alarming, especially as they include a massive 14.4 trillion HTTP DDoS requests. This surge in activity indicates that threat actors are becoming more aggressive and sophisticated in their methods. Such attacks can disrupt services for businesses and individuals alike, making it crucial for organizations to bolster their defenses against these persistent threats.

A Chinese-backed hacking group known as Vapor Panda has successfully targeted over 200 organizations across at least 14 countries, managing to compromise 140 sensitive targets in just 11 days. Researchers from CrowdStrike reported that the group utilized an advanced AI pentesting tool, allowing them to execute their attacks with remarkable speed and efficiency. The ongoing campaign raises significant concerns about the security of critical infrastructure and sensitive information globally. As these attacks continue, organizations are urged to bolster their cybersecurity measures to protect against such sophisticated threats, especially given the scale and rapidity of these incidents. This situation underscores the need for vigilance across various sectors, as the implications of these breaches could be far-reaching.

Cursor, an AI-powered integrated development environment (IDE), faced two significant security issues that were reported on the same day. Researchers discovered that a code extension for the IDE had been compromised with a Trojan, which could potentially allow attackers to execute malicious code on developers' machines. This incident raises concerns for developers who rely on such tools for coding, as it highlights the vulnerabilities that can arise in software designed to enhance productivity. The attack emphasizes the need for vigilance when installing extensions or plugins, as they can be a vector for malware. Developers must ensure that they are using trusted sources and remain cautious about the software they integrate into their workflows.