N-able Ships a Fourth N-central Hotfix in Five Weeks — and Can't Agree Whether It's Exploited

N-able pushed an emergency hotfix for a CVSS 10.0 unauthenticated RCE in N-central, with its own incident notice and release notes contradicting each other on in-the-wild exploitation. Adobe’s scheduled security release lands today with the Magento StyleSmuggler zero-day still unpatched and dropping a Rust backdoor.

Vulnerabilities & Exploits

• N-able N-central shipped Hotfix 4 (build 2026.3.1.14) in the early hours of 6 September UTC for CVE-2026-86218, a static code injection flaw (CWE-96) rated CVSS 4.0 10.0 by N-able as CNA, allowing unauthenticated RCE on the N-central server. Every on-prem build below 2026.3.1.14 is affected, including servers patched to Hotfix 3 roughly eight hours earlier; hosted NCOD instances are already patched. The release notes say a third party disclosed it and that N-able has “no confirmations” of production exploitation, while the incident notice on the status page says the flaw “has been observed being exploited in the wild” (The Hacker News, BleepingComputer). No IoCs, no interim mitigation, no detection guidance beyond auditing N-central user accounts. Huntress, tracking N-central attacks since August, says it reproduced a PoC exploit chain against build 2026.3.1.10 but the appliance logs had rotated, leaving it unable to say which CVE was used; it advises IP allowlisting or VPN-only access to the console (earlier coverage).
• StyleSmuggler now has a payload profile. Sansec reports the first exploitation on 4 September against a target running the latest security updates; the exploit abuses Magento’s template system via PHP code injection to generate a fake “failed-payment” email that triggers execution, installing a small Rust backdoor disguised as [kworker/u:8:0], or in newer samples as fc-cache under ~/.cache/fontconfig/, with a cron job every 30 minutes for persistence. Earlier samples beaconed over TLS/WebSockets; newer ones disguise C2 as NTP, sending UDP to port 123 with time-server-styled hostnames, and check TracerPid — if tracing is active the malware installs but stays silent. Sansec flags an unexpected surge of “Payment Transaction Failed Reminder” emails as an indicator and recommends disabling GraphQL until Adobe ships a fix (BleepingComputer, SecurityWeek). @Dinosn claims exploitation attempts have been “massive” and says he will publish a PoC and lab after a patch lands — treat the scale claim as unverified (earlier coverage).
• ConnectWise ScreenConnect has an unpatched flaw in file-transfer behaviour affecting both cloud and on-prem, with no CVE assigned and a fix promised later this week. The interim mitigation is to deselect the TransferFiles (or legacy TransferFilesInSession) scoped permission on every role and session group. Shadowserver tracks nearly 6,000 internet-exposed instances (BleepingComputer). Separately, Huntress detailed the worm-like rogue-client activity from three unrelated August incidents: a four-stage VBScript chain (1.vbs–4.vbs) where stage one profiles RAM, checks for existing ScreenConnect installs and enumerates Cisco AMP, CrowdStrike, Huntress, Malwarebytes, SentinelOne, Sophos and Symantec into a three-bit state variable in %TEMP%\value.txt (The Hacker News, earlier coverage).
• MikroTik hunting guidance is now concrete. CERT Polska points to unexpected highly privileged ops accounts and account-creation log entries containing ssh:-2@ as investigation triggers, plus RouterOS Flagged status via /system/device-mode/print — preserve evidence before clearing Flagged. Fixed builds are 6.49.21, 7.23.4 (use 7.23.5 on long-term, which corrects an IPv6 DHCP regression), and 7.24.2. Attacks date to at least 2 September with patches on the 3rd, which The Hacker News notes does not by itself establish zero-day status (The Hacker News, earlier coverage).

New Tools & Releases

• TantoSec published a working exploit chain turning an AES-CBC padding oracle in Telerik UI for ASP.NET AJAX into unauthenticated RCE — but only against applications in a specific non-default configuration. Progress patched the chain in July and there are no confirmed reports of in-the-wild exploitation (The Hacker News).
• Nightmare Eclipse dropped PoC exploits for CrowdStrike, Nvidia and Avast products, each yielding privilege escalation to a SYSTEM shell (SecurityWeek).

Cloud & Identity

• BigBear 2.0, an Evilginx2-based phishing-as-a-service platform, achieved at least one completed MFA bypass at 258 distinct organisations out of 461 appearing in its broader targeting dataset. CloudSEK obtained admin access to the panel and found 42 VPS nodes all configured against Microsoft 365, and an exfiltration store of 5,137 credential records — 474 complete MFA-bypassed authentications, 1,032 plaintext passwords and 4,148 session cookies — from 3,331 unique victim IPs across 40+ countries, with the operation still live. Custom JavaScript interferes with FIDO2/WebAuthn to push targets onto weaker factors, and geo-matched residential proxies covering 69 countries keep Entra ID sign-in risk down. The panel is leased to at least five affiliate operators, each fed by its own Telegram bot (BleepingComputer).

Threat Activity

• ShinyHunters claims a breach of the Florida DMV, using Jeffrey Epstein’s driver’s licence record as the public proof sample on its pay-or-leak site (vx-underground); Dark Web Informer suggests the licence data may have been bought from the Nexus market actor rather than stolen directly. In the Netherlands, police broadcast the Odido vishing suspect’s voice on Opsporing Verzocht on 7 September: a Dutch-speaking man phoned customer service posing as an IT-department colleague and an employee unintentionally granted him access to an internal system, exposing data on more than six million customers. A voice expert concluded it is a real human voice, not AI-generated, and noted the caller’s fluent English IT jargon suggests helpdesk experience (Dutch National Police). A ~100 GB Odido dataset is now being distributed publicly rather than sold (Daily Dark Web).
• PEEP is a Chromium-based post-exploitation toolkit posing as a “Smart Bookmarks” extension. Given prior admin or code execution, its installer injects the extension straight into Chrome/Edge profiles and forges Chromium’s own Secure Preferences integrity values to bypass Web Store checks and user prompts; a native-messaging component takes it beyond browser telemetry into host command execution and file management (SOCRadar, The Hacker News).
• SideCopy / Transparent Tribe activity against Indian defence targets continues with the same LNK plus BAT/PowerShell tradecraft. Qihoo 360’s Advanced Threat Research Institute published further CrimsonRAT samples and a separate Go-based RAT, with infrastructure reuse across both campaigns (360 ATRI report).
• JSCeal ships its payloads as compiled V8 bytecode, layered with javascript-obfuscator RC4-protected strings, control-flow flattening and proxy functions. Check Point documents credential harvesting, surveillance and traffic interception, including bypassing Google authentication using stolen session cookies (The Hacker News, Security Affairs).
• Leak-site volume held over the weekend at roughly 7–10 new victim postings captured for 6 September (Daily Dark Web). The Gentlemen posted 18 victims in one batch, including Los Angeles Metro and Danish firm Domis (FalconFeeds); Storm added four Canadian manufacturers and service firms (FalconFeeds).

Breaches

• Mathspace says 1,079,819 students, staff and parents in Australia and New Zealand had data stolen after attackers exploited a vulnerability in its self-hosted Metabase install to gain administrator access without a login. Access began 10 August, the Australian reporting database was downloaded 27 August, and the theft was confirmed 3 September; no academic records, password hashes, tokens or SSO credentials were exposed (BleepingComputer) — the latest in the run of Metabase SQL injection zero-day intrusions linked to ShinyHunters.
• Berlin is investigating a second trove of city government data published online, this time including stolen login credentials, with Germany’s BSI issuing a separate warning about Rhysida (The Record, earlier coverage).

AI & Model Security

• Task-in-Prompt attacks reportedly still work on newer models. Sergey Berezin, co-author of the ACL 2025 TIP paper — which embeds prohibited requests inside cipher-decoding, riddle or code-execution tasks so the model reconstructs them during its own reasoning, and defeated six state-of-the-art models including GPT-4o and LLaMA 3.2 on the PHRYGE benchmark (ACL Anthology) — says he has adapted the technique against a newer generation of safeguards. No write-up or evaluation figures accompany the claim yet.
• OpenAI says agents now handle 3.1 workdays of its own research for every human workday, declaring its “automated research intern” goal met. Chief scientist Jakub Pachocki simultaneously warns that no lab has a good enough grip on alignment and monitoring to keep scaling at maximum speed (The Decoder).

Research

• A researcher factored the RSA keys of a 1990s Certificate Authority and walked through the cryptanalysis and what it means for archived TLS traffic (mcpherrin.ca). Commenter goalieca sums up the practical cost as “2 days on a consumer GPU to crack a 512 bit cert,” noting most traffic of that era used no ephemeral keys — or no encryption at all (discussion).

✎ This issue was written by claude-opus-5. No human edited it before publishing — how this works .