Attackers Seize N-central RMM Servers After N-able's Second Fix Falls Short

N-able confirmed that threat actors are actively taking over N-central servers via an authentication-bypass flaw whose first patch proved incomplete — a full RMM compromise with downstream reach into every managed customer. Elsewhere, a China-linked actor was caught wiring a DeepSeek agent into a live attack on a security firm, INC Ransomware seized on the SonicWall SMA 1000 flaws, and OpenAI teased a new frontier model.

Vulnerabilities & Exploits

• N-able N-central auth bypass (CVE-2026-18577) is under active exploitation, and the first fix didn’t hold. Over the weekend N-able discovered a second authentication-bypass vector that grants attackers administrator access to both hosted and on-prem N-central servers, letting them reach the customer systems those servers manage; build 2026.3.1.7 (shipped Aug 2) is the first unaffected version (The Hacker News, BleepingComputer). Huntress has published exploitation details and detection guidance (Huntress). Continues our earlier coverage.
• INC Ransomware has become the dominant actor exploiting SonicWall SMA 1000 flaws. Resecurity reports INC accelerating sharply since the start of August, using the appliance bugs for root access and lateral movement and posting multiple victims to its leak site (The Hacker News, SecurityWeek).
• SharePoint on-prem RCE chain remains actively exploited. CERT-EU updated its advisory noting WatchTowr PoC code and in-the-wild exploitation of CVE-2026-50522, part of an ongoing series alongside CVE-2026-32201, CVE-2026-45659, CVE-2026-56164 and CVE-2026-58644; patch immediately and rotate credentials on exposed servers (CERT-EU).
• Full MariaDB 0-day chain (user→root RCE) published as a lab. A public write-up and reproduction lab demonstrates RCE on MariaDB chained into a full privilege escalation to root (repo).
• Rapid7 dropped a technical teardown of the Rails Active Storage RCE (CVE-2026-66066). “KindaRails2Shell” allows unauthenticated file reads and potential RCE via image processing; the analysis details the exploitation path (Rapid7). Builds on earlier coverage.
• Unpatched NTLM leak via the Windows search: URI handler — no CVE, no fix. Huntress details a coercion primitive functionally identical to CVE-2026-33829 but closed without a CVE, with arguably higher real-world risk; mitigations include blocking outbound SMB, enforcing SMB signing, disabling NTLM, and monitoring URI-handler activity (Huntress).
• FreeBSD local privilege escalation via a Linuxulator AT_SECURE logic bug (CVE-2026-49413). Write-up with technical detail on the flaw (research).
• Two new passkey attack classes surfaced. “Pass-ta-key” shows malware can hijack Google-synced passkeys through password-manager weaknesses to seize passkey-protected accounts (BleepingComputer). Separately, Unit 42 documents relying parties that fail to validate the User Verified flag, quietly downgrading passkey MFA to a single factor (Unit 42) (discussion).
• TP-Link TL-841N ships hardcoded, reset-persistent credentials. Firmware analysis walks through rooting the device and recovering credentials that survive a factory reset (write-up) (discussion).
• Rocket.Chat unauthenticated LFI via path traversal. A high-severity local file inclusion in /custom-sounds/ under FileSystem storage was patched and disclosed on HackerOne (HackerOne).
• Thermo Fisher patched a DNA-file integrity flaw (CVE-2026-17583). In select Applied Biosystems human-identification software, nearly undetectable tampering with .fsa/.hid files could occur before analysis loads them (The Hacker News).

Threat Activity

• A China-linked actor weaponized a DeepSeek AI agent against a security firm. Researchers intercepted and analyzed the model as it attempted to compromise more than 1,200 hosts for proxyjacking to stage further attacks (Dark Reading) — a live example of the AI-as-operator pattern from earlier coverage.
• The Iran-linked water-sector campaign has spread to Georgia and Michigan. Officials now count OT compromises at water and wastewater utilities across at least seven US states, prompting expanded protective measures (The Register, SecurityWeek). Continues earlier coverage.
• Midnight Blizzard’s hotel Wi-Fi campaign uses custom malware to breach M365 accounts. New reporting adds technical detail: DNS and HTTP manipulation of captive-portal infrastructure to intercept Microsoft credentials, plus deployment of Golang RATs across multiple countries (BleepingComputer, The Record). Follows earlier coverage.
• A Chinese-speaking actor is deploying GHOSTBLADE on iOS using the leaked DarkSword kit. Censys tracked 100+ web properties — mostly fake AWS sign-in pages — hosting the exploit chain (The Hacker News).
• DPRK’s Contagious Interview operation adopts “NullReceiver,” a stealthier blockchain C2. Distributed via counterfeit Tailwind CSS npm packages, it evolves EtherHiding by embedding encoded IPv4 addresses inside recipient wallet addresses of zero-value Ethereum transactions — no fixed burn address, minimal gas, no obvious payload signature (limited to 4-byte IPv4) (opensourcemalware.com).
• 18 malicious npm packages deliver a cross-platform RAT to Alibaba tool users. The typosquat campaign targets Chinese-speaking developer environments; one package, “lib-mtop,” impersonates a private Alibaba package (The Hacker News).
• Liechtenstein’s register of company and foundation beneficial owners was breached. Attackers stole about 31,000 records identifying the people behind companies, foundations and trusts, prompting a government crisis unit (The Record, SecurityWeek).

AI & Model Security

• OpenAI teased “Astra,” an unreleased model built for long-running tasks. An internal version reportedly produced ten advances in mathematics and theoretical computer science (BleepingComputer).
• Three high-severity RCE flaws in Hugging Face’s Diffusers library bypass trust_remote_code. Crafted model repositories can stealthily run arbitrary code on any machine that loads them, expanding the AI supply-chain attack surface (The Hacker News).
• Flowise 3.1.1/3.1.2 carry multiple critical RCEs. elttam details unsafe code execution, deserialization, sandbox escapes and configuration issues in the LLM-app builder — and notes existing patches are insufficient (elttam).
• Anthropic attributes last month’s Claude breaches to security gaps, not model flaws. The company says the real-world compromises stemmed from over-permissioning — especially internet access granted to the agent — rather than a model defect (Dark Reading). Continues earlier coverage.
• Open-model releases keep coming in waves. DeepSeek V4 Flash reached GA with a big agentic-capability jump (Terminal Bench 2.1, DeepSWE) and community quantizations already running on a single RTX 4090 or a 128GB Mac; Alibaba shipped Qwen 3.8 (a 27B local variant and a Max frontier variant) (@simonw); and MiniMax H3 became the first open model to top an AI video ranking, with 33B weights on Hugging Face (The Decoder).

New Tools & Releases

• Uber released ADR (Agentic AI Detection & Response), an open-source framework for securing AI agents. It offers agent observability and telemetry, a benchmark suite with 300+ security tasks, detection of risky agent behavior, coverage for 133 MCP servers, and cross-platform support (GitHub).