Today's cybersecurity landscape is marked by a flurry of critical vulnerabilities, with several platforms facing active exploitation or newly disclosed flaws. We're also seeing ongoing campaigns targeting development environments and managed service providers, emphasizing the constant need for vigilance and timely patching.
N-able N-central Zero-Day Actively Exploited After DisclosureVulnerability
Hackers are rapidly exploiting a newly revealed zero-day vulnerability, dubbed '4EverAble2Shell,' in N-able N-central remote monitoring and management software. Reports indicate at least 21 servers, including some running the latest hotfix, have been compromised to deploy cryptocurrency miners. N-able is implementing additional security measures and investigating further claims of new vulnerabilities.
Why it matters: If you use N-able N-central, prioritize applying all available patches immediately and review your configurations, especially for the Legacy API, to prevent unauthorized access and potential system compromise.
Read more at The Hacker News ↗
Critical Apache HTTP Server Flaw Allows Remote Code ExecutionVulnerability
A severe vulnerability (CVE-2026-119618) in Apache HTTP Server's mod_http2 module has been patched. This flaw could allow an unauthenticated attacker to achieve remote code execution on affected servers if HTTP/2 is enabled. Versions 2.4.55 through 2.4.70 are impacted, with version 2.4.71 providing the fix.
Why it matters: Ensure your web servers running Apache HTTP Server are updated to version 2.4.71 or later, especially if HTTP/2 is active, to prevent attackers from taking control of your server.
Read more at The Hacker News ↗
New Windows Zero-Day 'SignDrop' Grants SYSTEM PrivilegesVulnerability
A public exploit, known as SignDrop, has been released that leverages a vulnerability in the Windows Common Log File System (CLFS) driver. This zero-day allows a local Windows user to escalate their privileges to SYSTEM, providing attackers with full control over the compromised system.
Why it matters: Protecting against local privilege escalation is crucial; regularly update your Windows systems and ensure strong endpoint security to minimize the impact of such exploits if an attacker gains initial access.
Read more at The Hacker News ↗
GitHub Accounts Hijacked to Steal Cloud CredentialsBreach
A recent campaign utilized nearly 5,000 compromised GitHub accounts to inject secret-stealing malware into over 1,800 repositories. The malware targets secrets and cloud credentials accessible by continuous integration (CI) workflows, potentially giving attackers access to sensitive development and production environments.
Why it matters: If your business uses GitHub, enforce strong authentication like multi-factor authentication (MFA) for all accounts and regularly review access tokens and credentials in your CI/CD pipelines to prevent unauthorized secret exfiltration.
Read more at The Hacker News ↗
SCKit Malware Targets MSPs in ScreenConnect AttacksThreat
A new worm-like malware, SCKit, is being deployed in attacks targeting managed service providers (MSPs) through ConnectWise ScreenConnect. This sophisticated toolkit aims to spread from infected customer devices to MSP technicians' computers, compromising additional managed networks and potentially leading to widespread incidents.
Why it matters: For any business using or providing managed IT services, securing remote access tools like ScreenConnect is paramount; ensure all patches are applied and implement strict access controls to prevent your systems from becoming a pivot point for attackers.
Read more at The Hacker News ↗
Critical Red Hat Quay Flaw Exposes Private Container ImagesVulnerability
A critical vulnerability in Red Hat Quay allows attackers with access to a Quay registry to read and overwrite private container images across all repositories. If anonymous access is enabled, no account is needed for exploitation; otherwise, any valid account can still leverage the flaw. Red Hat has released patches for affected builds.
Why it matters: If you use Red Hat Quay for container image management, immediately apply the latest patches and review your anonymous access settings to prevent unauthorized manipulation or theft of your private container images.
Read more at The Hacker News ↗
Citrix Patches Multiple NetScaler and Secure Access Client FlawsVulnerability
Citrix has released updates to address 12 security vulnerabilities in NetScaler ADC, NetScaler Gateway, and NetScaler Console. These flaws include critical issues that could lead to denial-of-service (DoS) or authentication bypass, significantly impacting availability and security.
Why it matters: If your business relies on Citrix NetScaler or Secure Access Client, ensure all components are updated with the latest patches to prevent potential service disruptions and unauthorized access to your network resources.
Read more at The Hacker News ↗
Fake AI Domains Lead to Malware and Search HijackersThreat
Researchers have uncovered a 'TypoPrompting' campaign where 186 lookalike domains, impersonating popular AI tools, redirect users to malicious sites. These sites serve ClickFix lures, browser-hijacking malware, and extensions designed to hijack user searches, posing a significant risk to unsuspecting users.
Why it matters: Always verify URLs before clicking, especially for popular tools, and use trusted browser extensions. Educate employees about the dangers of phishing and typo-squatting to prevent them from inadvertently downloading malware.
Read more at The Hacker News ↗
Critical MongoDB Flaw Can Crash Servers on FailoverVulnerability
A critical pre-authentication vulnerability (CVE-2026-118383) in MongoDB Server could allow an unauthenticated attacker to cause a database crash. This issue specifically affects replica set members if a lagging server is promoted to primary, potentially leading to service disruption.
Why it matters: If you use MongoDB in a replica set configuration, update to the patched versions immediately. Ensure your database servers are always up-to-date to prevent unauthenticated attackers from impacting your database availability.
Read more at The Hacker News ↗
Law Enforcement Dismantles Gootloader, CastleRAT, and StealC Malware InfrastructurePolicy
Europol, in collaboration with law enforcement agencies from nine countries, successfully dismantled the infrastructure supporting the Gootloader, CastleRAT, and StealC malware operations. This action involved seizing hundreds of servers and domains, significantly disrupting these persistent threats.
Why it matters: While law enforcement efforts help, always maintain robust endpoint protection and user awareness training; even with infrastructure taken down, new variants or platforms can emerge, requiring continuous defense.
Read more at BleepingComputer ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.