Broken Trust: LXD, Polymarket, Binance & NetamLoader: MAG212 CYBER Daily Edition, 1 November 2026
Broken trust: a client certificate accepted as proof it never gave, an analytics script running with a trading page’s full authority, a DevOps laptop that reportedly led to a multi-billion-dollar withdrawal, and signed Windows components loading code they were never meant to. This edition takes each incident apart with trust-boundary diagrams, a minute-by-minute timeline of the Polymarket drainer, console views, indicator tables, and read-only commands and hunting queries for Linux, Kubernetes, PowerShell and Microsoft Defender. Its companion, Edition B, covers PHP2Shell, Ivanti, the poisoned Claude Code extension, GitLab and PAN-OS.
What needs attention today
| Story | ID | Severity | Exploited | Action |
|---|---|---|---|---|
| LXD / MicroCloud API authentication bypass | CVE-2026-112816 | CVSS 10.0 (reported) | Not established | LXD 6.10.1 / 5.21.9 / 5.0.11 / 4.0.15; MicroCloud 2.1.5 / 3.4.1; restrict API reachability |
| Polymarket monitoring script (DebugBear) | No CVE | High | Yes, 29 Oct (about $2.7M affected) | Remove third-party scripts from signing flows; SRI, CSP; revoke sessions |
| Binance theft | No CVE | Critical | Yes, about 29 Oct; FBI attributes to North Korea (TraderTraitor) | Isolate suspect endpoints, reissue workload credentials, restore in stages |
| NetamLoader (targeted Windows loader) | No CVE | Targeted | Yes, one observed victim (Kaspersky) | Correlate signed binaries with config changes, loaded modules and connections |
Inside this edition
- Today at a glance: four headline numbers, what each victim trusted versus what actually happened, and an action order.
- LXD: the certificate chain nobody checked: how a borrowed public certificate became admin access, fixed versions, and commands to check exposure and patch.
- Inside the Polymarket drainer, minute by minute: the UTC timeline, the four steps that emptied wallets, and a network log of a victim’s browser.
- Defend the page that signs: splitting signing pages from third-party scripts, SRI and CSP examples, audit commands and indicators.
- Binance: the keys were safe, the money left anyway: the reported attack path, the scale against earlier thefts, Kubernetes access checks and FBI address screening.
- NetamLoader: the seven-stage chain, the hijacked .config and the AMSI patch, then PowerShell checks, Defender KQL queries, Sysmon examples and file hashes.
Flip through the edition
How we report: sources were checked on 1 November 2026, and publication dates differ from incident dates. Loss figures are estimates, and attribution is an agency assessment, not a court finding. Diagrams are conceptual trust boundaries, not victim-network reconstructions, and verification steps are proposed checks, not tests run by MAG212 on affected systems. Corrections and tips: consultant@mag212.com.