Summary
Attackers can now bypass private key requirements to impersonate trusted clients in Canonical’s LXD and MicroCloud, exposing clusters and virtual machines to unauthorized access. With a CVSS score of 10.0, this flaw could let intruders escalate to root on affected hosts. Cyware.com urges organizations to patch LXD and MicroCloud immediately and restrict API network access until updates are applied.
A trio of Chromium browser vulnerabilities, including two Use After Free bugs and a cache memory corruption flaw, could let attackers execute arbitrary code or cause denial of service on user endpoints. Microsoft’s advisories warn that simply visiting a malicious web page could compromise systems, and patches are now available to address CVE-2026-118344, CVE-2026-118338, and CVE-2026-118352.
Weak cryptographic keys linked to eMudhra have enabled attackers to forge certificates for any domain, undermining browser trust and exposing users to interception. Cloudflare detected around 22,000 TLS handshake attempts using these weak keys and has prioritized patching since October 19. Organizations should reject eMudhra’s weak keys and ensure all software, including bots, is updated to block this threat.
Top Vulnerabilities Reported in Last 24 hours
Critical Canonical LXD bug enables impersonation
A critical flaw in Canonical’s LXD and MicroCloud can let an attacker impersonate trusted clients without possessing a private key, opening the door to unauthorized access across clusters and virtual machines (CVE-2026-112816, CVSS 10.0). In practical terms, that means an intruder could break into a managed environment and potentially reach root access on the host if they successfully impersonate a privileged account. Attackers are not known to be exploiting this in the wild, and the CVE record includes a CISA assessment saying it is not known to have been exploited. The Incus project initially reported the issue, and Canonical confirmed the impact on LXD; affected LXD versions include 4.0.14, 5.0.10, 5.21.8, and 6.9, while Ubuntu’s archive packages of LXD are not affected or not shipped. Fixes are available in LXD 6.10.1, 5.21.9, 5.0.11, 4.0.15, and MicroCloud 3.4.1/2.1.5; restrict network access to the API until updates are applied.
Chromium bugs could enable browser code execution
Microsoft has published advisories for multiple Chromium vulnerabilities that could allow attackers to run arbitrary code through the browser, including two Use After Free issues (CVE-2026-118344 in Layout and CVE-2026-118338 in Animation) and a cache memory corruption flaw (CVE-2026-118352) that could also cause denial of service. For people and organizations that live in web apps all day, successful exploitation can translate into a compromised endpoint after a user visits a malicious page or content is rendered in an unsafe way. No detailed information on active exploitation has been provided in the advisories. The issues were reported by security researchers, though specific names or organizations are not listed in the provided source material. Patches are available via the latest Chromium security updates; the advisories also call out mitigations such as employing security tools that monitor/block suspicious activity, configuring browsers to limit script execution, and using security extensions.
Weak eMudhra keys fuel certificate forgery risk
Weak cryptographic keys tied to eMudhra have created a certificate-forgery risk where attackers could mint convincing certificates for any domain and intercept or impersonate trusted services. In real-world terms, that can undermine the “lock icon” trust model—enabling traffic interception and unauthorized access for systems that still trust those weak keys. Cloudflare says it tracked exploitation attempts using logging and challenge pages, including approximately 22,000 TLS handshake attempts involving weak keys. Cloudflare credits AI-assisted analysis for quickly finding where trust in these keys existed and prioritizing high-impact patching starting October 19, adding that modern browsers are mostly patched while older browsers and bots remain exposed. Cloudflare’s recommended actions include patching systems to reject eMudhra’s weak keys, implementing quick-revocation mechanisms (and considering projects like upki for dynamic trust store updates), and ensuring timely security updates for all software, including bots.
Frequently Asked Questions
What is CVE-2026-112816? A critical flaw in Canonical’s LXD and MicroCloud can let an attacker impersonate trusted clients without possessing a private key, opening the door to unauthorized access across clusters and virtual machines (CVE-2026-112816, CVSS 10.0). In practical terms, that means an intruder could break into a managed environment and potentially reach root access on the host if they successfully impersonate a privileged account.
What is CVE-2026-118344? Microsoft has published advisories for multiple Chromium vulnerabilities that could allow attackers to run arbitrary code through the browser, including two Use After Free issues (CVE-2026-118344 in Layout and CVE-2026-118338 in Animation) and a cache memory corruption flaw (CVE-2026-118352) that could also cause denial of service. For people and organizations that live in web apps all day, successful exploitation can translate into a compromised endpoint after a user visits a malicious page or content is rendered in an unsafe way.
What is eMudhra? Weak cryptographic keys tied to eMudhra have created a certificate-forgery risk where attackers could mint convincing certificates for any domain and intercept or impersonate trusted services. In real-world terms, that can undermine the “lock icon” trust model—enabling traffic interception and unauthorized access for systems that still trust those weak keys.