November 1, 2026

Limited retained coverage centers on a cluster-management trust-boundary flaw and a third-party script compromise affecting traders. They show distinct routes from trusted access or dependencies to consequential harm; this small set does not characterize the broader security environment. [1][2]

What happened

A critical flaw in Canonical’s LXD and MicroCloud allowed an attacker to log in as a trusted client without possessing that client’s private key. [1]

Exploitation required network access to the products’ HTTPS API and the trusted client’s public certificate. [1]

Why it matters

After successful impersonation, the attacker could act as the client and access the cluster and its virtual machines. [1]

What happened

Malicious code on Polymarket’s website sold some signed-in traders’ positions and moved their funds to hackers on October 29. [2]

The malicious code replaced a page-speed script that Polymarket loaded from an outside company. [2]

Why it matters

Polymarket says it is refunding about $2.7 million to 726 affected wallets. [2]