Cyber Threat Brief — November 12 2026
1. N-able N-central — CVE-2026-125883 and related flaws
TL;DR: N-able says hosted N-central shows scanning only, and on-prem servers should move to build 2026.4.1.26 and confirm Legacy API is off. Upgrade Agents before Probes, and review the console for anonymous agent sessions and new admin accounts.
What’s New:
- N-able’s 11 Nov post says it is observing scanning tied to the public proof-of-concept and has seen no compromise of hosted N-central servers. Hosted servers are on 2026.4 HF2, build 2026.4.1.26. N-able says HF2 closes every flaw an unauthenticated user could reach, later hotfixes will cover the authenticated ones, and on-prem servers should stay off the internet until upgraded.
- The HF2 notes name seven fixed CVEs: CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882 (Nate Fair, Sprocket Security), and CVE-2026-91000. Upgrade on-prem servers, then Agents, then Probes.
- Huntress says a later N-able advisory limits a new server issue, called 4EverAble2Shell by the researcher, to on-prem servers where Legacy API is turned on and exposed to the internet. Legacy API is off by default, and Huntress says the researcher’s repository now confirms the chain needs it. Huntress says it has not observed exploitation of these issues, and it has not confirmed whether Agent2Shell depends on Legacy API.
- The Hacker News, citing Ryan Dewhurst of Previdian, says probing of 4EverAble2Shell came from 157.20.241.16 and there is no evidence it succeeded. SecurityWeek, citing Defused, says scanners on 10 Nov opened anonymous agent sessions, pulled appliance config, and hit the remote-control endpoint without authentication.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| N-central on-prem before 2026.4.1.26 | Vulnerable version | T1190 | Software inventory | Upgrade on-prem N-central to 2026.4.1.26 for CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882, and CVE-2026-91000. HF2 notes |
| N-central 2026.4.1.26 | Fixed build | T1190 | Software inventory | Install N-central 2026.4.1.26. It fixes CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882, and CVE-2026-91000. HF2 notes |
| N-central before 2025.4 | Vulnerable version | T1190 | Software inventory | Move N-central before 2025.4 to a build the HF2 notes list as supported, then install 2026.4.1.26. HF2 notes |
| N-central Agent before 2026.4.1.26 | Vulnerable version | T1059 | Software inventory | Upgrade the N-central Agent to 2026.4.1.26 before you upgrade the Probe. HF2 notes |
| N-central Probe before 2026.4.1.26 | Vulnerable version | T1059 | Software inventory | Upgrade the N-central Probe to 2026.4.1.26 after its Agents. N-able pushes the matching PME update itself. HF2 notes |
| Legacy API enabled on on-prem N-central | Configuration | T1190 | N-central network settings | Disable Legacy API on on-prem N-central, or keep it off the internet if you still need it. How to disable Legacy API |
| 157.20.241.16 | Network address | T1190 | N-central web log | Alert on N-central web or API requests from 157.20.241.16. |
| Anonymous agent session on N-central | Session behavior | T1078 | N-central API log | Review N-central logs for an anonymous agent session, an appliance-config pull, or an unauthenticated remote-control request. |
| New N-central administrator account | Account | T1078 | N-central admin audit log | Review N-central administrator accounts created since 9 Nov and disable any account your operators did not create. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule names N-central or Legacy API. |
| Elastic | None — verified | No rule names N-central or Legacy API. |
| Sigma | None — verified | No rule names N-central or these CVEs. |
Hunt hint: Install N-central 2026.4.1.26 on on-prem servers using a supported path from the HF2 notes. Upgrade Agents to 2026.4.1.26 before you upgrade Probes, or an upgraded Probe stops talking to older Agents. Confirm Legacy API is disabled, and do not expose it to the internet if you still need it. Review N-central web and API logs since 11 Nov for anonymous agent sessions, Legacy API calls, and new administrator accounts. On managed Windows hosts, look for unexpected PowerShell or cmd.exe started by the N-able Agent or Probe. Huntress says it has not confirmed that Agent2Shell is limited to Legacy API, so keep that endpoint review even when the server API is off.
Sources: N-central 2026.4 HF2 notes · N-able HF2 update · Disable Legacy API · Huntress Able2Shell update · Previdian · The Hacker News · SecurityWeek
2. ConnectWise ScreenConnect — SCKit via the RMM+ extension
TL;DR: Huntress says rogue ScreenConnect clients and a toolkit called SCKit reached 288 endpoints across 48 organizations on 11 Nov. Disable the RMM+ family of extensions, including on-prem servers, and do not open an interactive ScreenConnect session to a host you suspect.
What’s New:
- Huntress says the activity started about 17:47 UTC on 11 Nov and hit all 288 hosts within 90 minutes. ConnectWise says it has found no ScreenConnect vulnerability and no compromise of ConnectWise infrastructure.
- ConnectWise disabled five extensions across about 400 partner environments: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. On-prem partners have to disable them themselves. Their presence alone does not mean the environment was compromised.
- Huntress says RMM+ 1.0.31 and 1.0.32 accepted a blank access key when none was set, so requests could skip ScreenConnect accounts, roles, and MFA. Commands showed up as RMM+ with no matching login.
- The rogue client writes C:\Windows\Temp\sckit-run.bat, installs under C:\ProgramData\RelayTrap, and creates a SYSTEM scheduled task named TrapWatch. Huntress says the cookie-relay jump to a technician workstation has not been observed succeeding. Do not connect to a suspected host with ScreenConnect.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Labtech Plus | Extension | T1219 | ScreenConnect extension list | Disable the Labtech Plus extension and do not reinstall it. ConnectWise advisory |
| RMM Plus | Extension | T1219 | ScreenConnect extension list | Disable the RMM Plus extension and do not reinstall it. ConnectWise advisory |
| RMM+ 1.0.31 and 1.0.32 | Extension | T1190 | ScreenConnect extension list | Disable RMM+ as the ConnectWise advisory directs. Huntress says 1.0.31 and 1.0.32 accepted a blank access key. ConnectWise advisory Huntress SCKit |
| RMM Plus Password Link | Extension | T1219 | ScreenConnect extension list | Disable the RMM Plus Password Link extension and do not reinstall it. ConnectWise advisory |
| RMM+ Password Link | Extension | T1219 | ScreenConnect extension list | Disable the RMM+ Password Link extension and do not reinstall it. ConnectWise advisory |
| Scheduled task named TrapWatch | Process behavior | T1053.005 | Windows Security 4698 or Sysmon | Alert when a scheduled task named TrapWatch is created, and remove it if your operators did not create it. |
| C:\ProgramData\RelayTrap\ | File path | T1219 | Sysmon 11 or EDR file | Alert on creation of C:\ProgramData\RelayTrap\ and remove that directory after you confirm it is not yours. |
| C:\Windows\Temp\sckit-run.bat | File path | T1059 | Sysmon 11 or EDR file | Alert on C:\Windows\Temp\sckit-run.bat and remove the file if your operators did not place it. |
| 185.99.255.28 | Network address | T1071 | Firewall or proxy | Block outbound connections to 185.99.255.28 and alert when a host contacts it. |
| 155.94.150.39 | Network address | T1071 | Firewall or proxy | Block outbound connections to 155.94.150.39 and alert when a host contacts it. |
| ns.mo7sen.dev | Domain | T1071 | DNS or proxy | Block ns.mo7sen.dev, including the path EadF.php, and alert on a query for that name. |
| ScreenConnect client id 2588ef5c15954b10 | Client id | T1219 | ScreenConnect audit log | Hunt ScreenConnect logs and endpoint services for client id 2588ef5c15954b10. |
| ScreenConnect client id ed630cc2c873b091 | Client id | T1219 | ScreenConnect audit log | Hunt ScreenConnect logs and endpoint services for client id ed630cc2c873b091. |
| .aspxauth cookie replay to a ScreenConnect panel | Session behavior | T1539 | ScreenConnect web log | From a clean machine, revoke ScreenConnect web sessions and reset credentials if a technician opened a session to a suspected host. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | 2024 SetupWizard rules do not match RMM+ or SCKit. |
| Elastic | Partial — Suspicious ScreenConnect Client Child Process | Sees client-spawned curl, msiexec, and schtasks, not the blank key. |
| Sigma | Partial — Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution | Sees cmd or curl from a Run command run.cmd, not the blank key. |
Hunt hint: Disable Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link, and do not turn them back on. From a clean machine, revoke ScreenConnect sessions and reset those credentials. Search endpoints for the scheduled task TrapWatch, the directory C:\ProgramData\RelayTrap, and C:\Windows\Temp\sckit-run.bat. Review ScreenConnect Run Command and Toolbox history for commands you did not start. If a technician already connected to a suspected host, investigate that workstation from another machine.
Sources: ConnectWise advisory · Huntress SCKit · The Hacker News · BleepingComputer · SecurityWeek
3. GitHub Actions — wfx-loot secret stealer
TL;DR: Aikido and SafeDep both report a GitHub Actions secret stealer that used stolen accounts starting 10 Nov. Treat a pull request titled docs: dependency audit notes as a compromised account, rotate the repository’s secrets, and delete Entra credentials named wfx-ci- that you did not create.
What’s New:
- Aikido says 4,837 accounts opened those probe pull requests from a branch named wfx-docs in 61,764 repositories, and that the payload ran in at least 1,806 of them. Aikido’s summary also says at least 1,835.
- SafeDep credits Aikido with the first report but ran its own search. It says 8,093 repositories received malicious commits between 10 Nov 12:46 UTC and 12 Nov 04:36 UTC. That count is every repository that received a commit, not only runs of the stealer.
- Aikido says the payload can add Entra federated credentials prefixed wfx-ci- so a workflow can sign in after tokens are rotated. It posts stolen data to 194.150.166.244 or 18.143.168.96 on port 8080. SafeDep also names 153.75.82.159.
- Aikido says Packagist package digitalelvis/neuronai-studio 3.14.3 is malicious. SafeDep says the same, and also names Go modules github.com/onuragtas/docker-env v1.0.278, v1.0.280, and v1.0.282, plus github.com/vkuznet/gocurl pseudo-version v0.0.0-20261111095532-8d5aad0cb0da. The Go payload is in a workflow file, not the module source.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Pull request title docs: dependency audit notes | Repository change | T1195.002 | GitHub audit log | Search GitHub for a pull request titled docs: dependency audit notes since 10 Nov, and revoke that author’s tokens and sessions. |
| Branch name wfx-docs | Repository change | T1195.002 | GitHub audit log | Search for a branch named wfx-docs and treat the account that pushed it as compromised. |
| Commit message ci: refresh build cache | Repository change | T1195.002 | GitHub audit log | Review commits titled ci: refresh build cache since 10 Nov and rotate every Actions secret that repository can read. |
| Entra federated credential prefix wfx-ci- | Cloud credential | T1098.001 | Entra ID audit log | Delete Entra federated credentials whose names start with wfx-ci- if your operators did not create them. |
| AWS role session name prefix wfx- | Cloud credential | T1098.001 | AWS CloudTrail | Review CloudTrail for role sessions named wfx-, new access keys, and role trust policy edits since 10 Nov. Revert any you did not make. |
| digitalelvis/neuronai-studio 3.14.3 | Malicious package | T1195.002 | Dependency inventory | Block digitalelvis/neuronai-studio 3.14.3 and treat any machine that installed it as compromised. |
| github.com/onuragtas/docker-env v1.0.278 | Malicious package | T1195.002 | Dependency inventory | Remove github.com/onuragtas/docker-env v1.0.278. The payload is in the workflow file. |
| github.com/onuragtas/docker-env v1.0.280 | Malicious package | T1195.002 | Dependency inventory | Remove github.com/onuragtas/docker-env v1.0.280. The payload is in the workflow file. |
| github.com/onuragtas/docker-env v1.0.282 | Malicious package | T1195.002 | Dependency inventory | Remove github.com/onuragtas/docker-env v1.0.282. The payload is in the workflow file. |
| github.com/vkuznet/gocurl v0.0.0-20261111095532-8d5aad0cb0da | Malicious package | T1195.002 | Dependency inventory | Block github.com/vkuznet/gocurl pseudo-version v0.0.0-20261111095532-8d5aad0cb0da. |
| SHA-256 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf | File hash | T1059 | EDR file hash | Alert on SHA-256 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf and isolate the host. |
| 194.150.166.244 | Network address | T1041 | Firewall or proxy | Block outbound HTTP to 194.150.166.244 port 8080 and alert on that connection. |
| 18.143.168.96 | Network address | T1041 | Firewall or proxy | Block outbound HTTP to 18.143.168.96 port 8080 and alert on that connection. |
| 153.75.82.159 | Network address | T1041 | Firewall or proxy | Block outbound HTTP to 153.75.82.159 port 8080 and alert on that connection. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Azure AD Federated Identity Credential Added To Service Principal | Sees the Entra wfx-ci- credential, not the workflow commit or exfil. |
| Elastic | Partial — Entra ID Federated Identity Credential Modified | Sees the Entra wfx-ci- credential, not the workflow commit or exfil. |
| Sigma | None — verified | No rule matches the wfx-loot script hash. |
Hunt hint: Search GitHub for a pull request titled docs: dependency audit notes or a branch named wfx-docs since 10 Nov. If that probe exists, revoke the author’s tokens, SSH keys, and sessions, and rotate every Actions secret the repository can read. In Entra, delete federated credentials named wfx-ci- that you did not create. Block digitalelvis/neuronai-studio 3.14.3 and the named Go versions. Block outbound HTTP to 194.150.166.244, 18.143.168.96, and 153.75.82.159 on port 8080. In AWS, review role sessions named wfx- and recent trust policy edits.
Sources: Aikido · SafeDep · The Hacker News
Detection index: ESCU 4c1652e (2026-11-03) · elastic detection-rules 032ac5e (2026-11-12) · SigmaHQ d7c9da1 (2026-11-10). GitHub code search on those commits covered ScreenConnect, N-central, N-able, Legacy API, wfx-loot, GitHub Actions workflow edits, and federated credentials. Elastic “Suspicious ScreenConnect Client Child Process” matches curl.exe, quiet msiexec, schtasks /create, and cmd.exe /c under ScreenConnect.ClientService.exe or ScreenConnect.WindowsClient.exe. Sigma “Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution” matches cmd.exe, powershell.exe, or curl.exe whose parent command line runs run.cmd from C:\Windows\TEMP\ScreenConnect. ESCU “Azure AD Federated Identity Credential Added To Service Principal” and Elastic “Entra ID Federated Identity Credential Modified” alert when a federated credential is added to an Entra application. Sigma has no federated-credential rule. ESCU ScreenConnect analytics target CVE-2024-1709 SetupWizard.aspx and CVE-2024-1708 path traversal.
Status Updates
- GPUStack (CVE-2026-102895): Due today. SANS ISC reports attempts from 144.91.73.103 with header X-Gpustack-Real-IP: 127.0.0.1. Still move builds before 2.2.0 to 2.3.0 or later. Releases SANS 10 Nov brief
- OpenSSH (CVE-2026-123158): Due today. Scope remains musl with PAM disabled. The fix remains 10.6p2. OpenSSH notes 10 Nov brief
- FreeSWITCH (CVE-2026-116779): Due today. No new material. The fix remains 1.11.3 or later. v1.11.3 10 Nov brief
- IBM Aspera Faspex (CVE-2026-123218): Due today. No new material. The fix remains 5.0.19 PL1. IBM bulletin 10 Nov brief
- Barracuda ESG (CVE-2026-116606): Still due 13 Nov, with CVE-2026-111560. No new material. 11 Nov brief
- VMware ESX (CVE-2026-41709): KEV is now overdue (due 11 Nov). No new build. Prior brief
- eMudhra (CVE-2026-111943): eMudhra’s 10 Nov report on Mozilla bug 2083449 says it revoked eight RSA-4096 intermediates (G2B and G2C) on 7 Nov, reason cessation of operation, and that private-key integrity stayed intact. eMudhra also says it will exit the public TLS business. CVE-2026-91403 is unchanged. Bug 2083449 27 Oct brief
- Cisco BroadWorks (CVE-2026-20320): Still not briefed. KEV remains due 24 Nov. Cisco still says it is not aware of malicious use. The fix remains RI.2026.07. Advisory 11 Nov brief
- Openwave Webtop (CVE-2026-111793): Still not briefed. KEV remains due 24 Nov. The vendor fix remains 1.1.22.0, with a move to Media Server 2.0. Advisory 11 Nov brief
- Microsoft Outlook (CVE-2026-124194): Watching (no change). KEV remains due 24 Nov. 11 Nov brief
- Google Chrome (CVE-2026-125350): Watching (no change). KEV remains due 24 Nov. 11 Nov brief
- Brotli (CVE-2026-111497): KEV remains overdue (due 10 Nov). The PAN-OS fix builds remain as listed on 10 Nov. Palo Alto 10 Nov brief
- Adobe Commerce (CVE-2026-48356): KEV remains overdue (due 10 Nov). No new material. Prior brief
- European refrigeration controllers (Refrigeration-Controllers-EU-2026-11): Watching (no change). France’s C4 still attributes the 11–12 Oct attacks on about 700 French retail sites to IRGC unit Shahid Kaveh; that attribution does not cover the November wave. 10 Nov brief
- LNbits (LNbits-server-shutdown-2026-11): Watching (no change). The latest release is still v1.6.2 from 18 Sep, so there is no fixed release. Keep self-hosted LNbits stopped and the Paywall extension disabled. Releases 9 Nov brief
- Plex Media Server (Plex2Shell-CVE-2026-96652): Watching (no change). QNAP’s 6 Nov FAQ still applies: install 1.43.3.10861 or later, and clean-reinstall any NAS whose Plex was reachable from the internet. CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 remain KEV overdue. QNAP FAQ 6 Nov brief
- Synology DSM (Cerber-Synology-DSM-2026-10): Watching (no change). Synology still has not identified which of CVE-2024-10441, CVE-2024-50629 or CVE-2024-10445 was used. 2 Nov brief
- ARTEX (ARTEX-Software-Vendors-2026-11): Watching (no change). WorkOS attributes its incident to an escaped test agent. Microsoft’s Storm-3358 financial claim stays deferred. 3 Nov brief
- WordPress Core (WordPress-Core-CVE-2026-119977): Watching (no change). KEV remains overdue. Before a full-package update, deny
/wp-content/upgrade/and verify 403. 7 Nov brief - SonicWall SonicOS (SonicWall-SonicOS-CVE-2026-19868): Watching (no change). KEV remains due 20 November. SNWLID-2026-0014 7 Nov brief
- Apple (Apple-CVE-2024-27834-2026-11): Watching (no change). CVE-2024-27834 remains KEV due 18 November. Prior brief
- Zyxel GS1900 (Zyxel-GS1900-CVE-2026-107441): Watching (no change). The 3 Nov advisory and the separate CVE-2026-7273 KEV bug remain as briefed. Prior brief
- GitLab (CVE-2026-110264): Watching (no change). Prior brief
- Canonical LXD (CVE-2026-112816): Watching (no change). Prior brief
- Binance (Binance-TraderTraitor-2026-11): Watching (no change). Prior brief
- Cursor marketplace Claude Code (Cursor-Claude-Code-2.1.313-2026-10): Watching (no change). Prior brief
- XCPE Android TV (XCPE-Botnet-2026-11): Watching (no change). Prior brief
- Retired from watch: Storm2603-ToolShell-Fileless-2026-11 (SharePoint ToolShell, last update 2026-11-05); Tailworm-Tailscale-SSH-2026-10 (Tailscale SSH, last update 2026-10-29). 5 Nov brief 29 Oct brief