LXD and MicroCloud flaw lets attackers pose as trusted clients. Polymarket traders lose $2.7M to hijacked script
A CVSS 10.0 flaw in Canonical's LXD and MicroCloud let attackers impersonate trusted clients over the network without the private key. Polymarket is refunding about $2.7 million after a hijacked third-party script drained traders' funds.
Produced by an automated newsroom on GLM: stories chosen for engineers, written from the articles below, fact-checked against them, edited separately in English and Turkish, and scored before publishing. For details and accuracy, the sources are the authority. (glm-5.3)
Today’s briefing opens with a critical flaw in Canonical’s LXD and MicroCloud that scored CVSS 10.0 and let an attacker impersonate a trusted client without the private key. Alongside it, attackers stole about $2.7 million from Polymarket traders through a tampered third-party script, and Reddit said it will start locking content behind logins to fight scrapers.
Security
CVSS 10.0 flaw in LXD and MicroCloud allowed trusted-client impersonation
A critical flaw in Canonical’s LXD and MicroCloud let an attacker log in as a trusted client without holding that client’s private key. The attacker needed network access to the HTTPS API and the trusted client’s public certificate. Once in, they could act as that client, with access to the cluster and its virtual machines.
Hijacked Polymarket script drained about $2.7 million from traders
Malicious code on prediction market Polymarket replaced a third-party page-speed script from DebugBear. On October 29 it sold some signed-in traders’ positions and moved their funds to the attackers. Polymarket is refunding about $2.7 million to 726 affected wallets.
Reddit will lock content behind logins to fight scrapers
Reddit co-founder Steve Huffman said the site will gradually become a “logged-in service,” with limited access for visitors without accounts. He cited personalization and scrapers, noting that most unauthorized data access happens through logged-out pages. A login pilot will start in selected markets outside the United States in the coming months. The front page and pages reached from search results should stay visible.
Bottom line
- If you run LXD or MicroCloud, keep their HTTPS APIs off untrusted networks and check whether a fix is available from Canonical.
- Audit the third-party scripts your site loads. A single swapped dependency was enough for attackers to steal about $2.7 million from traders.
- Expect more Reddit content to require a login as the pilot rolls out.