A quiet Sunday carried over into this digest: no model or harness launches in the past day, so the list is short. Simon Willison documents a lockfile gotcha that puzzles uv users, and the security section covers four incidents — a CVSS 10.0 flaw in Canonical’s LXD that lets attackers skip private-key auth, a $2.7M draining of Polymarket traders through a hijacked page-speed script, the FBI attributing record Binance losses to North Korea’s TraderTraitor crew, and a three-flaw Ivanti chaining attack now in CISA’s KEV catalog.
Worth your time
- If in doubt, delete the uv.lock file — Simon Willison
Beyond AI
- CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key — The Hacker News
- Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script — The Hacker News
- FBI Links North Korea’s TraderTraitor to Record $6.43 Billion Binance Crypto Heist — The Hacker News
- Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access — The Hacker News