The HTTPS listener never verified client certificate chains, so anyone who can reach it can append a trusted certificate's public part and be treated as that client, or even as a cluster member. LXD's version is CVE-2026-112816. Upgrade Incus to 7.6.0 or LXD to 4.0.15, 5.0.11, 5.21.9 or 6.10.1 (snap users: refresh lxd); until then, firewall the API to trusted hosts. More: ubuntu.com.
CISA gave agencies until Mon Nov 2 to fix the exploited privilege-escalation bug CVE-2026-111357 and until Nov 13 for CVE-2026-118527. If you installed 25.1.1.2 or 22.8R2.5 for last month's auth bypass, you're still exposed to the chain: move to 25.1.1.3 or 22.8R2.6.
The FBI, Secret Service and IRS-CI published 608 Ethereum, 19 Bitcoin and one Solana address tied to the Oct 29 heist and asked exchanges, THORChain and RPC node operators, DeFi services and analytics firms to block funds that touch them. The stolen assets are mostly being converted to ETH ahead of further laundering. More: coindesk.com.
A performance-monitoring script loaded from DebugBear's CDN was swapped for a drainer on Oct 29 and emptied about $2.7M from 726 wallets in under an hour; DebugBear says its DNS was hijacked through its registrar. Every other host the drainer used was already allowed by Polymarket's CSP. Lesson: keep third-party code off pages where users sign, and pin scripts with Subresource Integrity.
CVE-2026-58882 is a zero-click bug in Android's WAP Push handling that crashes the phone process, dropping calls (including emergency calls), and about 20 messages can cause a reboot loop. Google's fix shipped for Android 14 through 17 in the October update; Android 12 and 13 devices stay exposed, so retire or replace them.
Update to Saturday's story: if you installed versions 2.1.312 or 2.1.313 on Oct 29, check authorized_keys for an "svc-telemetry" key using Cursor's macOS or Windows command, then run its remediation script. Cursor says the attacker's server is offline, the marketplace was rebuilt with rotated keys, and the SSH step fails on most machines without admin rights; rotate credentials anyway.
Japan's Official Gazette shows Toshihiro Nagoshi's studio was dissolved by shareholder resolution on Oct 31, after NetEase reportedly cut funding for Gang of Dragon. More: videogameschronicle.com.
Nuclei · MIT license
Nuclei is a fast, template-driven scanner that checks your own hosts and web apps for known vulnerabilities, misconfigurations and exposed services, using thousands of community-written YAML templates. It's for defenders and sysadmins who need to answer "are any of our boxes exposed to this new CVE?" quickly, like an Ivanti appliance or an LXD API left reachable from the internet. Only scan systems you own or are authorized to test.