VulnHub

A new malware toolkit called SCKit has been identified in attacks targeting managed service providers (MSPs) using ScreenConnect software. This worm-like malware is designed to spread from infected customer devices to the computers of MSP technicians, allowing attackers to compromise additional networks managed by these providers. Researchers have noted that the malware can significantly increase the risk of data breaches and operational disruptions for affected organizations. The incident raises concerns about the security of remote access tools, particularly as MSPs play a crucial role in managing IT services for various businesses. Companies using ScreenConnect should remain vigilant and implement security measures to protect against such threats.

A recent cyber campaign named 'wfx-loot' has led to the compromise of 4,837 GitHub accounts. Attackers used these accounts to explore 61,764 repositories, opening pull requests and pushing malware designed to steal sensitive cloud credentials. This incident raises significant concerns for developers and organizations relying on GitHub for collaboration, as it highlights vulnerabilities in account security and the potential for unauthorized access to sensitive data. Users are urged to strengthen their account security measures to safeguard against such intrusions. The scale of this operation indicates a coordinated effort by the attackers, making it a serious threat to the GitHub community.

Hackers have begun exploiting a newly identified zero-day vulnerability in N-able's N-central software, labeled '4EverAble2Shell'. This vulnerability allows attackers to take control of servers and install cryptocurrency miners, with researchers observing at least 21 systems compromised so far. Notably, 19 of these affected systems had the latest security updates installed, raising concerns about the effectiveness of current protections. The rapid exploitation of this vulnerability, occurring just hours after proof of concept (PoC) code was released, highlights the urgency for companies to assess their security measures and patch their systems promptly. This incident not only poses financial risks due to potential resource theft but also raises questions about the overall security posture of software vendors.

A serious vulnerability has been identified in the HTTP/2 module of Apache HTTP Server, allowing unauthenticated attackers to execute remote code. This flaw could potentially enable attackers to take control of affected servers and compromise sensitive data. The issue affects various versions of the Apache HTTP Server that use the HTTP/2 module, posing a significant risk to organizations relying on this widely used web server software. Users and administrators are urged to prioritize applying the latest security patches to mitigate this risk, as exploitation could lead to severe consequences. This vulnerability underscores the ongoing need for vigilance in software security and timely updates to protect against potential breaches.

A significant vulnerability in Red Hat Quay has been identified, allowing attackers to read and overwrite private container images within any registry. This flaw is particularly concerning because Quay enables anonymous access by default, meaning attackers can exploit this vulnerability without needing an account. Even if anonymous access is disabled, anyone with a valid account can still take advantage of the flaw. Red Hat has released fixed builds for eight versions of Quay to address this issue. Organizations using Quay should prioritize updating their systems to prevent potential data breaches and unauthorized access to sensitive container images.

Citrix has issued patches for 12 critical vulnerabilities affecting its NetScaler products, including NetScaler ADC, NetScaler Gateway, and NetScaler Console. These flaws could allow attackers to perform authentication bypass or cause denial-of-service (DoS) attacks. One of the most critical vulnerabilities, identified as CVE-2026-120868, has a high severity rating of 9.3 on the CVSS scale, indicating it poses a significant risk. Companies using these products should prioritize applying the patches to protect against potential exploitation. The vulnerabilities could impact the integrity and availability of services relying on these Citrix solutions.

Researchers have discovered a network of 186 fake domains that impersonate legitimate AI tools. These lookalike sites are designed to trick users into clicking on links that lead to malware, specifically ClickFix-style lures that hijack browser functions and manipulate search results. This tactic, referred to as TypoPrompting, exploits users' familiarity with popular AI applications to redirect them to malicious content. As a result, unsuspecting users may unintentionally download harmful software or have their online activities compromised. This incident serves as a reminder for users to be cautious when accessing AI tools and to verify the authenticity of websites before entering any personal information.

A recent campaign is exploiting a serious vulnerability in ConnectWise ScreenConnect, a remote access software used by many managed service providers (MSPs). Researchers from Blackpoint Cyber's Adversary Pursuit Group found that attackers are leveraging a previously patched flaw identified as CVE-2026-84869, which has a high severity score of 9.9. This vulnerability allows unauthorized access during support sessions, potentially opening the door for further attacks on MSPs and their clients. The ongoing exploitation of this flaw underscores the need for users to ensure they have applied the latest security updates. Companies relying on ScreenConnect should take immediate action to protect their systems from potential compromises.

PTC has introduced patches for a serious vulnerability in its Windchill and FlexPLM software that could allow attackers to execute code remotely. This flaw, identified as CVE-2026-126325, has a high severity rating of 9.2 out of 10, indicating a significant risk to users. The issue stems from improper input validation and the deserialization of untrusted data, which can potentially be exploited by malicious actors. Companies using these applications should prioritize applying the patches to protect their systems from potential breaches. This vulnerability underscores the importance of timely software updates in maintaining cybersecurity.

A serious vulnerability has been discovered in MongoDB Server, identified as CVE-2026-118383. This flaw allows attackers to send two specific requests that can cause the database server to crash. The issue arises particularly when a server, which is lagging behind in updates, is promoted to the main server role. MongoDB has responded quickly, releasing fixed versions to address this vulnerability. It's crucial for users of MongoDB to apply these updates to prevent potential disruptions in their database operations, especially in environments that rely on server failover for continuity.

Node.js has patched 16 vulnerabilities, including critical flaws in its HTTP/2 support that could allow unauthenticated users to crash servers running versions 24.x and 26.x. One vulnerability could lead to a denial-of-service attack, while another could expose sensitive data by sending memory contents from the server to clients, potentially revealing information meant for other connections. The fixed versions are 22.23.5, 24.22.3, and 26.13.1. It’s crucial for developers and organizations using Node.js to update their systems to these latest versions to protect against these issues and ensure server stability and data security.

An attacker has exploited stolen credentials from 4,837 GitHub accounts to deploy a secret stealer in over 1,800 repositories. This malicious code is designed to extract sensitive information, including secrets and cloud credentials, from the continuous integration (CI) workflows associated with these repositories. The incident, reported by Aikido Security, raises significant concerns for developers and organizations that rely on GitHub for version control and collaboration. If attackers successfully collect these secrets, they could gain unauthorized access to critical systems and data. This incident underscores the need for users to strengthen their account security and monitor their repositories closely.

A serious vulnerability has been discovered in the Apache HTTP Server's HTTP/2 module, known as mod_http2. This flaw, cataloged as CVE-2026-119618, allows remote attackers to execute code on servers running versions 2.4.55 through 2.4.70, provided that HTTP/2 is enabled. The vulnerability was addressed with the release of version 2.4.71, which became available just yesterday. Red Hat, which distributes Apache as part of Red Hat Enterprise Linux, has confirmed that only servers with HTTP/2 enabled are at risk. This vulnerability is particularly concerning as it could allow unauthorized access and control over server operations, making timely updates crucial for affected users.

ConnectWise has disabled five third-party extensions used with its ScreenConnect software after discovering unauthorized access affecting at least 288 endpoints across 48 organizations. The company reassured users that there is no evidence of a breach in its own infrastructure or any vulnerabilities in the ScreenConnect software itself. The incident appears to involve rogue clients exploiting these extensions. This situation raises concerns about the security of third-party tools connected to major software platforms, as they can introduce risks even when the primary software remains secure. Organizations using these extensions should review their security practices and consider additional safeguards to protect against similar incidents.