VulnHub

Real-time Cybersecurity News

Critical

ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients

The Hacker News
Actively Exploited
Vulnerability

Overview

ConnectWise has disabled five third-party extensions used with its ScreenConnect software after discovering unauthorized access affecting at least 288 endpoints across 48 organizations. The company reassured users that there is no evidence of a breach in its own infrastructure or any vulnerabilities in the ScreenConnect software itself. The incident appears to involve rogue clients exploiting these extensions. This situation raises concerns about the security of third-party tools connected to major software platforms, as they can introduce risks even when the primary software remains secure. Organizations using these extensions should review their security practices and consider additional safeguards to protect against similar incidents.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: ScreenConnect, third-party extensions
  • Action Required: Disable the affected third-party extensions and review security practices.
  • Timeline: Newly disclosed

Original Article Summary

ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access. In an advisory posted on its site, the company said there is no evidence that the incident involves a compromise of its infrastructure or a vulnerability in the ScreenConnect software. "Our initial assessment suggests the activity may involve

Impact

ScreenConnect, third-party extensions

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Disable the affected third-party extensions and review security practices.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Vulnerability.

Read Original Article

Related Coverage

Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover

The Hacker News

A serious vulnerability has been discovered in MongoDB Server, identified as CVE-2026-118383. This flaw allows attackers to send two specific requests that can cause the database server to crash. The issue arises particularly when a server, which is lagging behind in updates, is promoted to the main server role. MongoDB has responded quickly, releasing fixed versions to address this vulnerability. It's crucial for users of MongoDB to apply these updates to prevent potential disruptions in their database operations, especially in environments that rely on server failover for continuity.

Nov 12, 2026

Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data

The Hacker News

Node.js has patched 16 vulnerabilities, including critical flaws in its HTTP/2 support that could allow unauthenticated users to crash servers running versions 24.x and 26.x. One vulnerability could lead to a denial-of-service attack, while another could expose sensitive data by sending memory contents from the server to clients, potentially revealing information meant for other connections. The fixed versions are 22.23.5, 24.22.3, and 26.13.1. It’s crucial for developers and organizations using Node.js to update their systems to these latest versions to protect against these issues and ensure server stability and data security.

Nov 12, 2026

Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories

The Hacker News

An attacker has exploited stolen credentials from 4,837 GitHub accounts to deploy a secret stealer in over 1,800 repositories. This malicious code is designed to extract sensitive information, including secrets and cloud credentials, from the continuous integration (CI) workflows associated with these repositories. The incident, reported by Aikido Security, raises significant concerns for developers and organizations that rely on GitHub for version control and collaboration. If attackers successfully collect these secrets, they could gain unauthorized access to critical systems and data. This incident underscores the need for users to strengthen their account security and monitor their repositories closely.

Nov 12, 2026

Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

The Hacker News

A serious vulnerability has been discovered in the Apache HTTP Server's HTTP/2 module, known as mod_http2. This flaw, cataloged as CVE-2026-119618, allows remote attackers to execute code on servers running versions 2.4.55 through 2.4.70, provided that HTTP/2 is enabled. The vulnerability was addressed with the release of version 2.4.71, which became available just yesterday. Red Hat, which distributes Apache as part of Red Hat Enterprise Linux, has confirmed that only servers with HTTP/2 enabled are at risk. This vulnerability is particularly concerning as it could allow unauthorized access and control over server operations, making timely updates crucial for affected users.

Nov 12, 2026

Chinese AI Project Scouts Spies in Taiwan Chip Industry

darkreading

A new report reveals that the Chinese Communist Party (CCP) has developed a Big Data system aimed at gathering extensive information about individuals in Taiwan's semiconductor industry. This initiative appears to target key figures in the chip sector, potentially for espionage or other exploitative purposes. By collecting vast amounts of personal data, the CCP seeks to identify and manipulate individuals who could be of strategic interest. This situation raises significant concerns about the security of sensitive technologies and the integrity of supply chains, especially in a region critical to global tech infrastructure. The implications for Taiwan's chip manufacturers and their international partners are profound, as they may face increased risks of infiltration and manipulation.

Nov 12, 2026

Japan Pushes Emergency Funding for Cybersecurity as AI-Assisted Breaches Rise

darkreading

Japan is responding to a rise in cyber threats, particularly those involving AI, by pushing for emergency funding to bolster its cybersecurity measures. The new initiative will include the establishment of public-private cyber response teams and an AI-focused task force under the economic ministry. Additionally, the government will have increased authority to implement active cyber-defense strategies. This move comes as concerns grow over the sophistication of cyber attacks, making it essential for Japan to enhance its defenses and protect both public and private sectors. The urgency of this funding reflects a broader recognition that cybersecurity is critical for national security and economic stability.

Nov 12, 2026