Critical CVSS 10.0 flaw lets attackers impersonate trusted LXD and MicroCloud clients
On the radar
05 TOP STORIESThe Hacker News · 4 min read
Critical CVSS 10.0 flaw lets attackers impersonate trusted LXD and MicroCloud clients
Canonical's LXD and MicroCloud share a flaw rated CVSS 10.0 that lets network attackers impersonate trusted clients without their private key. The summary gives no patch status or sign of exploitation. Anyone running LXD clusters or MicroCloud should check Canonical's advisory and limit network access to the API until patched.
The Hacker News · 4 min read
FBI formally ties $6.43 billion Binance heist to North Korea's TraderTraitor
The FBI, USSS and IRS-CI attribute the theft to TraderTraitor, upgrading yesterday's attribution by blockchain firms to a government one. The figure is $6.43 billion, slightly above the $6.3 billion reported earlier. Binance's CEO separately says 90 percent of the stolen assets have been replenished, while withdrawals remain paused.
The Hacker News · 5 min read
Hijacked DebugBear script drains about $2.7 million from Polymarket traders
A compromised DebugBear page-speed script ran in signed-in Polymarket sessions and drained users' positions and funds. A third-party analytics or performance script on an authenticated page has the same access as the site's own code. Any app handling funds needs to treat such scripts as a direct theft path.
LWN.net · 1 min read
Hacktron compromised GNU Savannah and could have backdoored upstream Bash
Researchers took over the GNU Savannah forge and showed they could have pushed malicious code into the Bash repository. They reported it to the FSF in May 2026. Bash ships on nearly every Linux system, so the forge hosting its source is a high-value supply-chain target.
BleepingComputer · 3 min read
Chainalysis breached by attackers using offensive agentic techniques
Chainalysis disclosed that attackers used agentic techniques to reach internal tools, exposing customer names, emails and user IDs. The victim is a firm that supports crypto investigations, including the Binance case. The disclosure is another sign that AI-driven intrusion is moving from research into real incidents.
Go a little deeper
EXPLORE BY TOPIC- 16 articles
Cyber security
Third-party code and supply chains dominate: a hijacked script, a compromised forge, and a CVSS 10.0 in container tooling. AI shows up on both sides, as attacker tooling and as a target. Several public proof-of-concept exploits and critical kernel bugs also need patching attention.
Read 8 updates - 11 articles
Tech industry
Regulation and infrastructure dominate: a French per-gigabyte traffic tax, the UK landline shutdown date, and local fights over data centers. OpenAI's lower funding target adds to the financing story.
Read 6 updates - 10 articles
AI
A quiet day for models, with product-policy items instead: OpenAI merging usage limits, Apple's cautious stance and a report of Anthropic blocking some prompts. The rest is small open-source experiments.
Read 6 updates - 15 articles
IT & infrastructure
Linux 7.4 dominates after a record merge window, with a revert showing the early churn. Desktop news is light, with Enlightenment 0.28 and CDE's open-source release. Jepsen published a new database report.
Read 7 updates - 9 articles
CS & research
A light day. The strongest items are about measurement and performance: unreliable hardware counters and the continuing limits of memory latency.
Read 5 updates