Security news.
Critical authentication flaws and supply chain incidents dominate today's updates, led by a maximum-severity impersonation flaw in Canonical's LXD and MicroCloud. Threat actors are also actively targeting developer tools and cloud services, deploying trojanized extensions and hijacking web infrastructure to drain funds. Additionally, CISA has added high-impact flaws in Ivanti and GitLab to its Known Exploited Vulnerabilities catalog amid active in-the-wild attacks.
CVSS 10.0 Flaw in Canonical LXD and MicroCloud Allows Client Impersonation
A critical vulnerability allows network-adjacent attackers possessing a trusted client's public certificate to authenticate to the HTTPS API without a private key, enabling full control over clusters and virtual machines.
CISA Adds Actively Exploited Ivanti Connect Secure Flaws to KEV Catalog
Attackers are chaining three vulnerabilities, including missing authentication bug CVE-2026-111357 and predictable identifier issue CVE-2026-118527, to gain unauthenticated root execution on affected appliances.
Max-Severity GitLab RCE Flaw Exploited in the Wild
Tracked as CVE-2026-97229, an integer overflow vulnerability in GitLab Community and Enterprise editions allows unauthenticated remote code execution and has been targeted against Alpine Linux systems.
Polymarket Drained of $2.7 Million via Compromised Third-Party Script
Attackers modified a hosted page-speed monitoring script from DebugBear to execute malicious code on Polymarket, hijacking signed-in user sessions to liquidate and transfer cryptocurrency.
Linux Kernel Bug Grants Remote Root Access via MPTCP
Researchers demonstrated a functional exploit for a critical Linux kernel flaw that allows unauthenticated adversaries to execute arbitrary root commands against servers running Multipath TCP listeners.
Malicious Claude Code Extension Distributed on Cursor Marketplace
A rogue extension mimicking Anthropic's Claude Code infected up to 5,000 developers over an 11-hour window, planting persistent SSH backdoors on compromised developer workstations.
Northflank Breach Results in Customer AI API Key Abuse
Cloud hosting platform Northflank has urged all users to rotate stored secrets and credentials after unauthorized intruders accessed systems and abused customers' AI provider tokens.
Proof-of-Concept Released for Android "SMS of Death" Flaw
Exploit code is now public for CVE-2026-58882, a vulnerability allowing remote threat actors to crash unpatched Android devices or disrupt cellular connectivity using crafted SMS messages.