CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key

The Hacker News · Sunday, 1 November 2026 at 08:51 (3d ago) · Original article ↗

A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client's public certificate.

Once in, the attacker would act as that client, with access to the cluster and its virtual machines. If the impersonated account is

You're reading a preview. The full article is published by The Hacker News on their website.

Read the full story on The Hacker News

Security

Hackers hijack cPGuard autoupdate to deploy backdoor, steal data

Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script. [...]

BleepingComputer 4h ago

Security

North Korean fake job interview led to $6.3B Binance heist

'It was not a single isolated breach or a simple phishing incident,' exchange says

The Register 4h ago

Security

Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist

The largest crypto theft to date was pulled off by combining some well-known hacking techniques over the course of a few months, according to Binance. A postmortem from the company says the process started in June with one developer downloading a tampered installer apparently…

The Verge 4h ago

CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key

More Security & Privacy

Hackers hijack cPGuard autoupdate to deploy backdoor, steal data

North Korean fake job interview led to $6.3B Binance heist

Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist