VulnHub

Real-time Cybersecurity News

Critical

New N-able "4EverAble2Shell" zero-day exploited hours after PoC released

BleepingComputer
Actively Exploited
Zero-dayVulnerabilityPatchUpdate

Overview

Hackers have begun exploiting a newly identified zero-day vulnerability in N-able's N-central software, labeled '4EverAble2Shell'. This vulnerability allows attackers to take control of servers and install cryptocurrency miners, with researchers observing at least 21 systems compromised so far. Notably, 19 of these affected systems had the latest security updates installed, raising concerns about the effectiveness of current protections. The rapid exploitation of this vulnerability, occurring just hours after proof of concept (PoC) code was released, highlights the urgency for companies to assess their security measures and patch their systems promptly. This incident not only poses financial risks due to potential resource theft but also raises questions about the overall security posture of software vendors.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: N-able N-central software, affected systems include at least 21 servers, 19 of which were running the latest security update.
  • Action Required: N-able has not specified any patches or updates, but affected organizations should immediately assess their systems and apply any available security updates.
  • Timeline: Newly disclosed

Original Article Summary

Hackers are actively exploiting a newly disclosed N-able N-central zero-day vulnerability dubbed "4EverAble2Shell" to compromise servers and deploy cryptocurrency miners, with researchers reporting at least 21 affected systems, including 19 running the company's latest security update. [...]

Impact

N-able N-central software, affected systems include at least 21 servers, 19 of which were running the latest security update.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

N-able has not specified any patches or updates, but affected organizations should immediately assess their systems and apply any available security updates. Regular monitoring of server activities and implementing intrusion detection systems may also help mitigate risks associated with this vulnerability.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Zero-day, Vulnerability, Patch, and 1 more.

Read Original Article

Related Coverage

New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks

BleepingComputer

A new malware toolkit called SCKit has been identified in attacks targeting managed service providers (MSPs) using ScreenConnect software. This worm-like malware is designed to spread from infected customer devices to the computers of MSP technicians, allowing attackers to compromise additional networks managed by these providers. Researchers have noted that the malware can significantly increase the risk of data breaches and operational disruptions for affected organizations. The incident raises concerns about the security of remote access tools, particularly as MSPs play a crucial role in managing IT services for various businesses. Companies using ScreenConnect should remain vigilant and implement security measures to protect against such threats.

Nov 12, 2026

Hackers compromise 4,800 GitHub accounts to steal cloud credentials

BleepingComputer

A recent cyber campaign named 'wfx-loot' has led to the compromise of 4,837 GitHub accounts. Attackers used these accounts to explore 61,764 repositories, opening pull requests and pushing malware designed to steal sensitive cloud credentials. This incident raises significant concerns for developers and organizations relying on GitHub for collaboration, as it highlights vulnerabilities in account security and the potential for unauthorized access to sensitive data. Users are urged to strengthen their account security measures to safeguard against such intrusions. The scale of this operation indicates a coordinated effort by the attackers, making it a serious threat to the GitHub community.

Nov 12, 2026

Apache HTTP Server patches critical HTTP/2 remote code execution flaw

BleepingComputer

A serious vulnerability has been identified in the HTTP/2 module of Apache HTTP Server, allowing unauthenticated attackers to execute remote code. This flaw could potentially enable attackers to take control of affected servers and compromise sensitive data. The issue affects various versions of the Apache HTTP Server that use the HTTP/2 module, posing a significant risk to organizations relying on this widely used web server software. Users and administrators are urged to prioritize applying the latest security patches to mitigate this risk, as exploitation could lead to severe consequences. This vulnerability underscores the ongoing need for vigilance in software security and timely updates to protect against potential breaches.

Nov 12, 2026

Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry

The Hacker News

A significant vulnerability in Red Hat Quay has been identified, allowing attackers to read and overwrite private container images within any registry. This flaw is particularly concerning because Quay enables anonymous access by default, meaning attackers can exploit this vulnerability without needing an account. Even if anonymous access is disabled, anyone with a valid account can still take advantage of the flaw. Red Hat has released fixed builds for eight versions of Quay to address this issue. Organizations using Quay should prioritize updating their systems to prevent potential data breaches and unauthorized access to sensitive container images.

Nov 12, 2026

Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass

The Hacker News

Citrix has issued patches for 12 critical vulnerabilities affecting its NetScaler products, including NetScaler ADC, NetScaler Gateway, and NetScaler Console. These flaws could allow attackers to perform authentication bypass or cause denial-of-service (DoS) attacks. One of the most critical vulnerabilities, identified as CVE-2026-120868, has a high severity rating of 9.3 on the CVSS scale, indicating it poses a significant risk. Companies using these products should prioritize applying the patches to protect against potential exploitation. The vulnerabilities could impact the integrity and availability of services relying on these Citrix solutions.

Nov 12, 2026

186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers

The Hacker News

Researchers have discovered a network of 186 fake domains that impersonate legitimate AI tools. These lookalike sites are designed to trick users into clicking on links that lead to malware, specifically ClickFix-style lures that hijack browser functions and manipulate search results. This tactic, referred to as TypoPrompting, exploits users' familiarity with popular AI applications to redirect them to malicious content. As a result, unsuspecting users may unintentionally download harmful software or have their online activities compromised. This incident serves as a reminder for users to be cautious when accessing AI tools and to verify the authenticity of websites before entering any personal information.

Nov 12, 2026