This Week in Cybersecurity: N-able's 33 Zero-Days, a GitHub Secret-Stealer Wave, and France Blames Iran for Fridge Hacks

Explore this content with AI:

ChatGPT | Perplexity | Claude | Google AI Mode

N-able takes N-central offline after 33 alleged zero-days and exploit code are posted to GitHub

Over the weekend, offensive security researcher Sean Bales, who publishes on GitHub as “Oracle-Security,” released 33 alleged vulnerabilities in N-central, which he calls “Able2Shell,” along with proof-of-concept exploit code. N-central is the remote monitoring and management (RMM) platform many managed service providers (MSPs) use to run their customers’ IT. GovInfoSecurity reports that the claimed findings include anonymous credential theft, administrator account creation, and remote code execution as root, and that both hosted and on-premises versions are affected. At 3:15 pm UTC on Monday, November 9, N-able declared an active incident, took its hosted N-central environment offline "as a precautionary measure," and urged on-premises customers to take their servers offline until further notice.

N-able released N-central 2026.4 HF2 on November 10, upgraded all hosted environments, and told on-premises customers to upgrade before restoring normal access. N-able says HF2 resolves every flaw that could be exploited without logging in, and that the remaining issues need an authenticated, often privileged, account and will be fixed in later hotfixes. As of Thursday morning, N-able says it has seen scanning tied to the public exploit code but no signs of compromise on hosted servers, while Cybersecurity Dive reports that watchTowr saw probing within 12 hours of the release and later exploitation attempts that match the published proof-of-concepts. N-able disputes claims that it ignored responsible disclosure, saying these flaws weren’t reported through its established channels; SecurityWeek reports Bales said he published after N-able didn’t fix issues he’d previously reported in another product. This is the latest in a difficult year for the platform: attackers exploited an N-central authentication bypass in July and August, and a pre-authentication remote code execution flaw fixed in September was later added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.

Why it matters: an RMM platform is a master key to every network it manages, so a working exploit chain for it is a supply chain risk for every MSP customer. If you run N-central on-premises, apply HF2 before bringing it back online, keep the management interface off the internet, and review administrator creation, script runs, software deployments, and remote sessions from just before the shutdown. If an MSP manages your environment, ask them directly whether they use N-central, when they patched, and what they checked.

Read more at SecurityWeek

Hijacked GitHub accounts push a self-erasing secret stealer into thousands of CI pipelines

Starting November 10, an attacker used stolen credentials for 4,837 GitHub accounts to open probe pull requests titled "docs: dependency audit notes" in 61,764 repositories, testing which accounts could write where. The Hacker News reports that where write access existed, the attacker pushed a shell-script stealer (its artifacts use a "wfx" prefix) into existing workflows or npm postinstall hooks, then usually reverted the change within minutes and deleted the workflow run. Aikido Security counted at least 1,806 repositories where the stealer ran, and SafeDep found malicious commits in at least 8,093. Affected projects include nextcloud/docker and webdriverio, where commits came through a bot account that could bypass branch protection.

The stealer goes after GitHub Actions secrets, the workflow's GITHUB_TOKEN, OIDC tokens, AI service keys, and cloud credential files. It also tries to outlast a rotation: StepSecurity's analysis found that it was rewriting AWS role trust policies to allow any principal, adding Azure federated credentials named "wfx-ci-", and posting forged "success" statuses to satisfy required checks. Accounts hit in October's GhostAction wave, which we covered on October 15, were far more likely to be used again, though Aikido hasn't attributed both waves to the same actor. New probe pull requests were still appearing on November 12.

Why it matters: a deleted workflow run doesn't mean nothing happened. Search your organization for "wfx-docs" branches, "docs: dependency audit notes" pull requests, and gaps in Actions run numbers since November 10; if you find any, treat every secret that repository could read as stolen and rotate it. Then check AWS trust policies and Azure federated credentials for entries you didn't create, restrict outbound network access from build runners, and require 2FA and short-lived tokens for any account or bot with write or bypass rights.

Read more at Aikido Security

Attackers move fast on newly patched Outlook, Chrome, and OpenSSH flaws

Microsoft's November Patch Tuesday fixed more than 1,000 vulnerabilities, including CVE-2026-124194, an Outlook flaw that Microsoft says was exploited in the wild as a zero-day. Tenable's analysis explains that it's rated CVSS 6.5, and that a crafted file opened in Outlook can make it connect to an attacker-controlled location without the usual external-content warning, exposing the user's NTLMv2 hash. CISA added it to the KEV catalog with a November 24 deadline for federal civilian agencies. Microsoft hasn't said who exploited it. Microsoft’s advisory credits two researchers, one of whom, Benoît Sevens, found it using Anthropic’s Claude. Google also patched its eighth exploited Chrome zero-day of the year, CVE-2026-125350, a high-severity use-after-free in Chrome's XML component, in version 157.0.8103.50/.51.

On the server side, The Hacker News reports that attackers targeted CVE-2026-123158, an OpenSSH flaw nicknamed "SSHole" (CVSS 8.1), less than nine hours after it was published and gained root on a honeypot. It affects Linux systems running OpenSSH on the musl C library without PAM, including Alpine Linux's default configuration, and is fixed in OpenSSH 10.6p2. CISA added it to KEV on November 9 alongside flaws in IBM Aspera Faspex, FreeSWITCH, and GPUStack, with a deadline of today, November 12.

Why it matters: this week's patches came with almost no grace period. Prioritize the Outlook update (and block outbound SMB/NTLM to the internet so a leaked hash is harder to use), confirm Chrome has actually restarted on the new version across managed devices, and find every Alpine-based container or host running OpenSSH, since minimal images often don't get the same patch attention as full servers. With patch counts this high, rank by "exploited now" first and CVSS second. Only classic Outlook for Windows is affected, and unsupported Office 2016 and 2019 installs won’t get a fix, so this is also a good week to retire them.

Read more at The Register

A jailbroken AI agent ran a two-week intrusion against a European telecom provider

Malbear Labs published research on November 8 about "Operation Snowball," in which an attacker handed most of an intrusion to an AI agent and checked in only occasionally with short messages like "Go on" and "Stop." Infosecurity Magazine reports that the agent ran on a custom framework using DeepSeek with a jailbreak prompt of about 78,000 characters that told the model to treat any refusal as a malfunction, and that it targeted a European telecom provider and 13 organizations hosted on its infrastructure for more than two weeks. Malbear found the attacker's working directory, including more than 70 session transcripts, during a routine sweep for exposed open directories.

The agent got in through CVE-2026-20320, an unauthenticated flaw in Cisco BroadWorks that Cisco fixed in August, then moved laterally using years-old Liferay and JBoss flaws. When endpoint security blocked one exploit, it switched approaches on its own, and when a tunneling tool was blocked, it wrote a replacement. The agent reported taking credentials, private keys, and healthcare and billing data, but those claims haven't been verified with victims. Malbear assessed the operator as Chinese-speaking and didn't link the activity to a state actor. CISA added the BroadWorks flaw to its KEV catalog on November 10.

Why it matters: the agent didn't need new exploits; it needed old, unpatched ones and the patience to try them all. AI-driven intrusions make the long tail of known vulnerabilities more dangerous, because an agent can work through that list faster and more persistently than a person. Patch or retire internet-facing end-of-life systems such as old JBoss servers, apply August's BroadWorks fix if you haven't, and watch internal traffic for new tunnels, because a blocked tool may simply be rewritten.

Read more at Infosecurity Magazine

France blames Iran's Revolutionary Guards for October's supermarket refrigeration sabotage

On November 9, French officials accused Iran's Revolutionary Guards of the October 11 cyber attacks that overrode temperature controls on commercial refrigerators and freezers, a story we covered on October 15. Reuters, via Al-Monitor, reports that a joint report from French intelligence and cyber agencies named Shahid Kaveh, an offensive cyber unit tied to the Revolutionary Guards, as responsible, and said it worked through front groups posing as hacktivists, including "CyberAveng3rs." The report counted 700 targeted commercial sites, mostly supermarkets but also butcher shops, a slaughterhouse, and food factories, and at least 15 fires.

Foreign Minister Jean-Noël Barrot said Iran's ambassador had been summoned and threatened further EU sanctions, and Paris prosecutors requested international arrest warrants. France cited links between attack infrastructure, intrusion patterns matching other Shahid Kaveh operations, and traces of Farsi; Reuters couldn't establish exactly how France reached its conclusion, and Iran's UN mission didn't respond to requests for comment. A second wave this month hit more than 100 sites across Europe, including refrigerators used by French blood banks, and the manufacturer said several affected units were obsolete or ran outdated firmware.

Why it matters: nation-state groups are going after ordinary operational technology because it's often internet-connected, rarely patched, and directly tied to physical damage. Inventory any building, refrigeration, or HVAC controllers reachable from the internet, put them behind secure remote access rather than exposing them directly, change default credentials, and retire or isolate units that no longer get firmware updates.

Read more at iTnews

Final thoughts

This week's stories share one pattern: the tools with the most reach are the most attractive targets, and the window to respond keeps closing. An RMM platform that controls thousands of networks, CI pipelines that hold cloud keys, an email client on every desk, and connected refrigeration controllers each became a way in, and in several cases, attackers moved within hours of a disclosure or a patch. The AI-run telecom intrusion shows where this is heading: an attacker who never gets tired of working through old, unpatched flaws.

If there's one action item, it's to map the systems that can reach everything else, such as management platforms, build pipelines, and remote access tools, and make sure each has a fast patch path, no unnecessary internet exposure, and credentials you can rotate the same day a vendor discloses a problem.

Check back next Thursday for the next edition of This Week in Cybersecurity.