Cyber Threat Brief — November 1 2026
⚠️ This report is AI-generated. Always validate findings.
1. LXD and MicroCloud — CVE-2026-112816
TL;DR: Canonical and Incus both describe an mTLS authentication bypass in LXD and MicroCloud, and exploitation is unconfirmed. Refresh the snap for your channel, and check whether the remote API is exposed.
What’s New:
- Canonical says the HTTPS API treated every certificate in the client chain as a trusted identity.
- Incus reported the same flaw and fixed it in Incus 7.6.
- CISA’s 30 October assessment lists exploitation as none.
- On MicroCloud, a joining member’s public certificate is enough to impersonate that member.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| lxd 6.10.1 (snap channel 6/stable) | Fixed build | T1190 | Snap inventory | On channel 6/stable, install lxd 6.10.1. Confirm with snap list lxd. |
| lxd 5.21.9 (snap channel 5.21/stable) | Fixed build | T1190 | Snap inventory | On channel 5.21/stable, install lxd 5.21.9. Confirm with snap list lxd. |
| lxd 5.0.11 (snap channel 5.0/stable) | Fixed build | T1190 | Snap inventory | On channel 5.0/stable, install lxd 5.0.11. Confirm with snap list lxd. |
| lxd 4.0.15 (snap channel 4.0/stable) | Fixed build | T1190 | Snap inventory | On channel 4.0/stable, install lxd 4.0.15. Confirm with snap list lxd. |
| microcloud 3.4.1 (snap channel 3/stable) | Fixed build | T1190 | Snap inventory | On channel 3/stable, install microcloud 3.4.1. Confirm with snap list microcloud. |
| microcloud 2.1.5 (snap channel 2/stable) | Fixed build | T1190 | Snap inventory | On channel 2/stable, install microcloud 2.1.5. Confirm with snap list microcloud. |
| Incus 7.6.0 | Fixed build | T1190 | Incus version | If you run Incus, upgrade to 7.6.0 or later. Restrict the HTTPS listener to management hosts until that upgrade is in place. |
| core.https_address | Config key | T1190 | LXD config | Run lxc config get core.https_address. If it prints an address, the remote API is exposed. Restrict that listener to management hosts until the snap is on the fixed build for its channel. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No LXD or client-certificate rule. |
| Elastic | None — verified | No LXD API or trust-store rule. |
| Sigma | None — verified | No LXD or Incus listener rule. |
Detection index: ESCU dcd2560 (2026-10-30) · elastic detection-rules 56b642f (2026-10-31) · SigmaHQ 05d1031 (2026-10-21).
Hunt hint: Run snap list lxd and snap list microcloud. Refresh any channel that is below the fixed build in the table. On LXD, run lxc config get core.https_address. If that key is set, read the API log for sessions from unexpected IPs. Run lxc config trust list and remove certificates you did not add.
Sources: Canonical advisory · Incus GHSA-xg75-xf37-cph9 · CVE-2026-112816 · The Hacker News
Status Updates
- CVE-2026-97229 (GitLab): KEV is due today, 1 November 2026. Confirm self-managed GitLab is on 19.2.8, 19.3.5, or 19.4.2. 30 October brief.
- Ruby-Onigmo-2026-10-23 (GitLab packaged Ruby): KEV is due today, 1 November 2026. Fixed Rubies remain 3.3.13, 3.4.12, and 4.0.9. 30 October brief.
- CVE-2026-76418 (Cisco ASA/FTD): KEV is due today, 1 November 2026. No new fixed release or IOC. 30 October brief.
- CVE-2026-111357 (Ivanti Connect Secure): KEV is due 2 November 2026, with forensic triage. Correction: upgrade 25.1.2.2-and-prior nodes to the fixed 25.1.3.x release per Ivanti’s advisory, not to 25.1.1.3 or 22.8R2.6; the 31 October brief now says so. 31 October brief. CISA alert, updated 30 October.
- CVE-2026-46300 (Fragnesia, Linux kernel): KEV was due 31 October 2026 and is now overdue. Confirm hosts have booted the fixed kernel from the 29 October brief. 29 October brief.
- CVE-2026-102764 (BeyondTrust Remote Support): One sensor operator, Previdian, saw probes on its decoys from one Hong Kong IP, with no success. Search the Remote Support access log for
POST /api/start_sessionwith bodyissue_menu=1&id=1&c2cjs=1&platform=thin, and apply BT26-05-RS; Metasploit PR 22083 is still open. 26 October brief. Previdian on X. PR 22083. - Retired from watch: Candiru-AdFection-DiscoverTech-2026-10, InfinityCore-2026-10 (last update 2026-10-18). No new report or IOC set. 18 October brief.
- Watching (no change): LiteLLM-1.107.0-2026-10 (10-22); CVE-2026-105192 (10-22); CVE-2026-110264 (10-22); Siemens-Software-Center-CVE-2026-110936 (10-21, KEV due 2026-11-03, fixed 4.0.9.8); Plex2Shell-CVE-2026-96652 (10-21, KEV due 2026-11-03); CVE-2026-114625 (10-23, retirement eligible 2026-11-02); CVE-2026-110447 (10-15, retirement eligible 2026-11-02); GhostAction-2026-10 (10-10); UpdraftCentral-2026-10 (10-19); OVHcloud-CLI-2026-10 (10-20); RankMath-SEO-Pro-3.0.123 (10-20); ConnectWise-CloudBackup-SkyKick-2026-10 (10-22, original 10-17); eMudhra-CVE-2026-111943 (10-27); CVE-2026-111497 (10-28, KEV due 2026-11-10); Tailworm-Tailscale-SSH-2026-10 (10-28); CVE-2026-48356 (10-28, KEV due 2026-11-10); CVE-2026-41709 (10-29); CVE-2026-20127 (10-29); PHP2Shell-CVE-2026-109618 (10-28, retire-eligible 2026-11-07); Cursor-Claude-Code-2.1.313-2026-10 (10-31).