If your cluster management API answers from anywhere outside your own network, this week handed an attacker three different ways in.
The Hacker News reported a critical flaw in Canonical's LXD and MicroCloud, CVSS 10.0: an attacker could log in as a trusted client without holding that client's private key. All they needed was network reach to the HTTPS API. Unit 42 published a threat brief on critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. CISA added CVE-2026-118527 in Ivanti Connect Secure, a predictable-identifier flaw that lets a remote authenticated attacker upload files with attacker-controlled content to a known location on disk, and listed it as actively exploited in the wild.
The shape is the same in each case: the bug pays off only if the attacker can reach the endpoint. And in most infrastructure I inherit, the management and upload paths are the ones nobody wrote down. So patching is the second step. The first is knowing which admin APIs answer from the open internet, and treating trust certificates as rotatable credentials rather than permanent furniture.
I do security reviews of payment and account flows, and that includes this kind of exposure inventory: which endpoints are reachable, what authenticates to them, what rotation actually looks like. It takes days, not months, and you get cost and timeline in writing within a day.
If you want that review on your stack, message me and tell me what you're running.