November 12, 2026

What happened

Over one week in October, an online marketplace recorded 414,210 visits using the name of a widely used consumer AI agent; every visit targeted its sign-in page and returned errors. [1] [2]

The traffic was attributed to a credential-stuffing operation that tested stolen username-and-password pairs against the marketplace in bulk. [3]

Why it matters

The operation generated more traffic than the real agents, reaching about one and a half times their volume. [4] [5]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Over one week in October, an online marketplace took 414,210 visits from traffic wearing the name of a widely used consumer AI agent.

2. [2]

   Every visit went for the sign-in page, and every one returned errors.

3. [3]

   Behind the name was a credential stuffing operation, with attackers running stolen username and password pairs against the site in bulk.

4. [4]

   The fake agent was busier than the real ones.

5. [5]

   Its volume came to about one and a half times … More → The post Bots pose as AI agents, AI agents pose as humans, and defenses believe both appeared first on Help Net Security .

Read the original article →

What happened

Apache HTTP Server’s mod_http2 has a critical flaw that can allow a remote attacker to execute code on the server. [1]

The flaw is tracked as CVE-2026-119618, affects versions 2.4.55 through 2.4.70, and is fixed in version 2.4.71. [2]

Only servers with HTTP/2 enabled are affected, according to Red Hat, which ships Apache HTTP Server in Red Hat Enterprise Linux. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server.

2. [2]

   Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday.

3. [3]

   Only servers with HTTP/2 enabled are affected, according to Red Hat, which ships the server as part of Red Hat Enterprise Linux.

Read the original article →

What happened

Poland temporarily took ePUAP, a nationwide platform for submitting official documents, communicating with government agencies, and completing administrative procedures online, offline after detecting and stopping a cyberattack. [1] [2] [3]

The shutdown made ePUAP electronic mailboxes unavailable to citizens and public institutions and disrupted access to public services. [4] [5]

Officials said the platform was taken offline as a precaution, that the attack caused no reported damage or disruption, and that the Central Information Technology Center remained secure. [6] [7] [8]

Security teams were conducting technical work and checks before restoring full functionality, but the source does not state when services would return. [9] [14]

Why it matters

The disruption could briefly affect the Trusted Profile digital identity system, which supports access to public services and electronic signing of official documents; no restoration timeline was provided. [9] [10]

Known limitations

Authorities have not explained how the attack was carried out or who was responsible, and there is no public confirmation that attackers accessed government systems or stole sensitive data. [11] [12] [13]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Poland temporarily shut down ePUAP, the government platform citizens and businesses use to reach public services, after detecting and stopping a cyberattack.

2. [2]

   ePUAP is a nationwide system for submitting official documents, communicating with government agencies and completing administrative procedures online.

3. [3]

   Digital Affairs Minister Krzysztof Gawkowski said on social media that the attack was detected and stopped.

4. [4]

   Poland takes its e-government platform ePUAP offline after stopping a cyberattack, disrupting access to public services.

5. [5]

   A notice on the government’s website says ePUAP electronic mailboxes are unavailable to citizens and public institutions.

6. [6]

   “The infrastructure of the Central IT Center remains secure.” He added that security teams responded immediately and are working to restore full functionality.

7. [7]

   Officials explained that the platform was taken offline as a precaution, not because the attack caused any damage.

8. [8]

   Marek Gieorgica, a spokesperson for the Digital Affairs Ministry, told the Polish news agency PAP that the system had not been compromised or disrupted by the attack.

9. [9]

   The ministry has not provided a timeline for restoring services, saying they will return once security experts complete their checks.

10. [10]

    The disruption could also briefly affect the Trusted Profile digital identity system, which lets people use public services and sign official documents electronically.

11. [11]

    Many details are still unknown.

12. [12]

    Authorities have not explained how the attack was carried out or who was behind it.

13. [13]

    There is also no public confirmation that attackers accessed government systems or stole sensitive data.

14. [14]

    The teams responsible for the system’s security took immediate action to maintain its stability, and technical work is currently underway to restore full functionality.” the Minister wrote on X.

Read the original article →

What happened

Dagster is an open-source orchestrator for data pipelines that determines what runs, in what order, and when. [1] [2]

Dagster tracks connections between the tables, datasets, machine-learning models, and reports it manages and their source data. [3]

Why it matters

When a source table is corrupted, downstream tables can carry the problem forward; Dagster’s lineage graph identifies downstream assets to help start remediation of a broken dashboard. [4] [5]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Dagster is an open source orchestrator for data pipelines.

2. [2]

   It decides what runs, in what order, and when.

3. [3]

   It also tracks how the tables, datasets, machine learning models, and reports it manages connect to the data they came from.

4. [4]

   When a source table goes bad, the tables built from it carry the problem forward.

5. [5]

   Dagster’s lineage graph shows which ones sit downstream, and that list is the starting point for fixing a broken dashboard or … More → The post Dagster: Open-source cloud-native data pipeline orchestrator appeared first on Help Net Security .

Read the original article →

What happened

Aikido Security said an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to. [1]

The stealer was designed to take secrets and cloud credentials accessible to a repository’s CI workflows. [2]

The stealer ran in at least 1,806 repositories; the supplied evidence truncates the sentence before stating what the attacker likely collected. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company.

2. [2]

   The stealer is built to take the secrets and cloud credentials that a repository's CI workflows can reach.

3. [3]

   It ran in at least 1,806 repositories, where the attacker has likely collected

Read the original article →

What happened

Node.js fixed an HTTP/2 flaw that lets unauthenticated clients crash servers using the built-in HTTP/2 support on the 24.x and 26.x release lines. [1]

A separate HTTP/2 flaw can cause a server to send a client pieces of memory, including responses intended for other connections. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines.

2. [2]

   A second HTTP/2 flaw can cause a server to send a client pieces of its memory, including responses intended for other connections.

Read the original article →

What happened

Microsoft released .NET 11 as a Standard Term Support release with two years of support. [1]

.NET 10 remains the Long Term Support option. [2]

The release covers C# 15, ASP.NET Core, .NET MAUI, and Windows development. [3]

Why it matters

The release includes changes affecting software supply-chain integrity, authentication handling, and platform lifecycle. [4]

.NET 8 and .NET 9 are out of support; the source identifies this as the most urgent defender issue rather than a new feature. [5]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Microsoft has released .NET 11, a Standard Term Support (STS) release that will receive two years of support.

2. [2]

   .NET 10 is still the Long Term Support (LTS) option.

3. [3]

   The release covers C# 15, ASP.NET Core, .NET MAUI, and Windows development.

4. [4]

   Several of the changes affect software supply chain integrity, authentication handling, and platform lifecycle.

5. [5]

   .NET 8 and .NET 9 are out of support The most urgent item for defenders isn’t a new feature.

Read the original article →

What happened

A threat actor using stolen GitHub credentials pushed a credential-stealing payload into tens of thousands of repositories since November 10. [1]

In more than 1,800 repositories, the malware ran and sent GitHub Actions secrets and cloud credentials to the attacker. [2]

Aikido identified the campaign and named it wfx-loot, based on the attacker’s labels for the malware and stolen material. [3] [4]

Why it matters

Aikido counted 4,837 compromised accounts opening probe pull requests, but the supplied text is truncated before providing further context. [5]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A threat actor using stolen GitHub credentials has pushed a credential-stealing payload into tens of thousands of repositories since November 10.

2. [2]

   In more than 1,800 of them, the malware ran and shipped GitHub Actions secrets and cloud credentials to the attacker.

3. [3]

   Aikido spotted the campaign and named it wfx-loot.

4. [4]

   The name comes from the attacker’s own labels, “wfx” for the malware and “loot” for what it steals.

5. [5]

   Aikido counted 4,837 compromised accounts opening probe pull … More → The post Check your GitHub repos: A secret stealer hit tens of thousands of them appeared first on Help Net Security .

Read the original article →

What happened

A critical MongoDB Server flaw, CVE-2026-118383, allows an unauthenticated attacker to send two requests that crash the database server. [1]

The crash occurs only when the affected server is later selected to take over as the main server while it lacks some recent changes. [2]

MongoDB released fixed versions earlier this week. [3]

Known limitations

The supplied evidence truncates the description of the affected servers, so their complete configuration and scope are unknown. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server.

2. [2]

   The crash occurs only if that server is later chosen to take over as the main server while it still lacks some recent changes.

3. [3]

   MongoDB, the company that makes the database, released fixed versions earlier this week.

4. [4]

   The affected servers are members of a replica

Read the original article →

What happened

A London hotel displayed its Booking.com administrative username and password in plain English on a whiteboard in a room behind the front desk. [1] [2] [3]

The credentials were reportedly used as a shared team login, and the hotel changed its practices after Tepavicharov alerted its manager. [7] [8] [9]

Why it matters

Anyone near the desk could see or photograph the credentials; the source reports that access could enable changing or cancelling reservations, viewing guest names and contact details, or messaging guests while impersonating the hotel. [4] [5]

Known limitations

Whether the exposed credentials alone would have allowed account access depended on the account’s security settings. [6]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   This week, we welcome you to a London hotel where you could check out its admin credentials for a booking website just by walking past the front desk.

2. [2]

   As he was passing through the lobby, Tepavicharov noticed that the door behind the front desk was open and, inside that back room, there was a whiteboard.

3. [3]

   On the whiteboard, written in plain English, were the hotel’s Booking.com administrative username and password.

4. [4]

   Anyone near the desk could clearly see the login information, and if they didn’t have time to write it down, they could have snapped a picture for later use.

5. [5]

   “With that login, someone could change or cancel reservations, see guests’ names and contact details, or message guests pretending to be the hotel,” he said.

6. [6]

   Whether the exposed credentials alone would have been enough to access the account would depend on its security settings.

7. [7]

   Tepavicharov decided to play the role of good samaritan and warn the hotel’s manager that the business was endangering itself by showing everyone its password.

8. [8]

   “Nobody on staff had thought of it as a risk.

9. [9]

   It was just the easiest way for the whole team to share one login.” After Tepavicharov talked to the manager, not only did the hotel change its ways, but it also moved its website to his hosting service, Flashcloud.

Read the original article →

What happened

AWS released AWS Emulator, a free tool that simulates AWS services on a developer laptop, development server, or CI pipeline. [1]

AWS says autonomous AI agents wrote the tool entirely, without code written or reviewed by its engineers. [2]

The source describes AWS Emulator as an open-source tool for testing AWS applications locally. [3]

The tool has no additional service fee; users pay for AWS resources when deploying applications on AWS. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Amazon Web Services has released AWS Emulator, a free tool that simulates AWS services on a developer’s laptop, a development server or in a continuous integration (CI) pipeline.

2. [2]

   The company says autonomous AI agents wrote the tool entirely, with no code written or reviewed by its engineers.

3. [3]

   How three teams of AI agents build AWS Emulator Three teams … More → The post AWS Emulator: Open-source tool for testing AWS apps locally, built by autonomous AI agents appeared first on Help Net Security .

4. [4]

   There is no additional service fee, users pay for AWS resources when they deploy applications on AWS.

Read the original article →

What happened

Darktrace researchers reported turning Claude Code into a remote-controlled implant in a laboratory test, using Claude’s memory-stores feature to extract a 1 GB file through the Claude Files API. [1]

After setup, the agent sent jobs and results through api.anthropic.com, the endpoint it already used for inference, making the attacker’s traffic resemble normal coding-agent activity. [2]

Known limitations

The supplied evidence truncates the technique’s requirements, so its prerequisites and applicability cannot be determined from these spans. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Darktrace researchers turned Claude Code into a remote-controlled implant in a lab test, steering the coding agent through the memory stores feature of Anthropic’s Claude platform and pulling a 1 GB file out through the Claude Files API.

2. [2]

   Once the agent was set up, every job and every result traveled through api.anthropic.com, the endpoint the agent already calls for inference, so the attacker’s traffic looked like a coding agent doing its job.

3. [3]

   The technique needs … More → The post Stolen Claude API keys can turn Claude Code into a remote-controlled implant appeared first on Help Net Security .

Read the original article →

What happened

Microsoft Entra’s Hard Deletion Protection is in preview and gives administrators seven days to recover selected identities before permanent deletion. [1]

Coverage includes cloud-only users, cloud-only groups, applications, and service principals that are not synchronized from on-premises systems. [3]

Entra Agent ID objects are covered through their underlying identity types. [4]

Why it matters

The feature is intended to help organizations respond to accidental or malicious deletion of critical directory objects. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Microsoft Entra’s Hard Deletion Protection, now in preview, gives administrators a seven-day window to recover selected identities before they can be permanently erased.

2. [2]

   The feature is designed to help organizations respond to accidental or malicious deletion of critical directory objects.

3. [3]

   It supports users that are not synchronized from on-premises systems, cloud-only groups, applications, and service principals.

4. [4]

   Entra Agent ID objects are covered through their underlying identity types.

Read the original article →

What happened

European tech buyers are increasingly choosing EU-headquartered cybersecurity vendors to reduce reliance on American technology, according to the source. [1]

Context data reported a 35% increase in EMEA distributor sales of EU-headquartered cybersecurity products over the two years to calendar Q3 2026, compared with 10% total cybersecurity-sales growth and 8% growth for US-run companies. [2] [3]

EU-headquartered vendors accounted for 92% of tracked security-awareness-training sales, 82% of vulnerability-management sales, and 52% of SIEM and log-management sales. [12]

US-headquartered companies held 74% of identity-and-access-management sales and 54% of cloud-security sales in the reported figures. [13]

Why it matters

EU vendors reached 15% of tracked cybersecurity sales by value after gaining nearly three percentage points, while US-headquartered vendors still accounted for 62%. [4] [5]

The source attributes the purchasing shift in part to organizations reviewing third-party technology reliance under the NIS2 Directive and the Digital Operational Resilience Act. [6] [7] [8] [9]

Context research executive Joe Turner said buyers and resellers are asking who holds encryption keys, who can access sensitive logs, and where data is stored. [10] [11]

Omdia reported that almost one-third of AI providers disclose no proof of sovereignty, while 80% of contracts state that network resilience is outside providers' control or responsibility. [15]

Known limitations

UK-specific figures were not yet provided; the source says Context had been asked to determine whether British customers were also choosing European alternatives. [14]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   European tech buyers are increasingly choosing cybersecurity vendors from their own continent in a bid to reduce their reliance on American technology.

2. [2]

   According to sales figures compiled by Context, distributor sales in EMEA of cybersecurity products from EU-headquartered vendors jumped 35 percent in the two years to calendar Q3 2026.

3. [3]

   Total cybersecurity sales grew up 10 percent over the same period, and sales by US-run companies went up just 8 percent.

4. [4]

   That growth is from a relatively small base, though EU vendors gained nearly three percentage points to reach 15 percent of tracked sales by value.

5. [5]

   There is still a long way to go as US-headquartered vendors accounted for 62 percent.

6. [6]

   The trend coincides with a loss of trust in the Trump administration among customers outside of America, after it cosied up to autocratic rulers while criticizing and punishing allies with tariffs and more.

7. [7]

   It said organizations are reviewing their reliance on third-party tech in light of EU compliance regimes: the NIS2 Directive and Digital Operational Resilience Act (DORA).

8. [8]

   NIS2, transposed into national law in October 2024, requires organizations in the bloc to raise their common level of security in the face of digital threats and risks to critical infrastructure.

9. [9]

   DORA, introduced in January last year, is designed to strengthen cyber security in the financial sector.

10. [10]

    "Digital sovereignty is becoming a buying decision.

11. [11]

    As customers and resellers get clearer about what it means in practice, they're asking who holds the encryption keys, who can access sensitive logs and where that data is stored," said Context veep of research Joe Turner.

12. [12]

    That's the kind of decision that gives European vendors an opening." The stats indicate that EU-HQd vendors comprised 92 percent of tracked sales in security awareness training, 82 percent in vulnerability management, and 52 percent for SIEM and log management.

13. [13]

    US-headquartered companies held into 74 percent of identity and access management sales and 54 percent of cloud security sales.

14. [14]

    The Reg has asked Context for UK-specific figures to see whether British customers are also voting with their wallets for European alternatives.

15. [15]

    Analyst Omdia said last month that despite the marketing adjective meaning "local assets," almost a third AI providers disclose no proof of sovereignty, and some "expect enterprise to pay for audits to verify their claims." Omdia also found that 80 percent of contracts say network resilience is "out of providers control or responsibility," and "US-headquartered AI providers offer better service transparency and contract terms than a majority of local sovereign AI providers, with providers in India a notable exception." Sovereign services in Omdia's classification include data residency, operational autonomy, jurisdictional sovereignty, and technological autonomy.

Read the original article →

What happened

PTC released patches for a critical vulnerability affecting Windchill and FlexPLM that could enable remote code execution if successfully exploited. [1]

The vulnerability is tracked as CVE-2026-126325 and has a CVSS v4 score of 9.2 out of 10.0. [2]

The flaw is described as improper input validation and deserialization of untrusted data; the supplied evidence truncates before stating the complete consequence. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   PTC has released patches for a new critical vulnerability impacting Windchill and FlexPLM software that, if successfully exploited, could result in remote code execution.

2. [2]

   The security flaw, tracked as CVE-2026-126325, carries a CVSS v4 score of 9.2 out of a maximum of 10.0.

3. [3]

   It has been described as a case of improper input validation and deserialization of untrusted data that could result in

Read the original article →

What happened

Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users. [1]

Material Security’s Threat Research team spotted the campaign and reported taking down hundreds of attacker domains in an effort called Operation CloudFire. [3]

Why it matters

The operation was designed so that every check defenders normally use to assess a link returned a clean result. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users.

2. [2]

   Every check defenders normally lean on to judge a link came back clean, and the operator designed it that way on purpose.

3. [3]

   The Threat Research team at Material Security spotted the campaign and has since taken down hundreds of attacker domains in an effort the team calls Operation CloudFire.

Read the original article →

What happened

N-able said it was investigating a public disclosure alleging additional vulnerabilities in on-premises N-central version 2026.4.1 HF2. [1]

N-able said its initial review found the described server issue depends on the non-default Legacy API configuration being enabled and exposed to the public internet. [2]

Known limitations

The supplied evidence does not establish the full vulnerability behavior, exploit impact, remediation status, or whether the investigation was completed. [1] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   N-able on Thursday said it's investigating a new public disclosure containing claims of additional vulnerabilities in on-premise versions of N-central running version 2026.4.1 HF2.

2. [2]

   "Based on our initial review, the server issue described depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet," N-able said in a new advisory.

3. [3]

   "Legacy API is

Read the original article →

What happened

CVE-2026-102895 is described as a trivial authentication-bypass vulnerability affecting GPUStack, open-source software for managing GPU clusters used for AI workloads. [1] [2] [3]

The affected versions are GPUStack releases prior to version 2.2.0, which was released at the end of June. [4]

Known limitations

The vulnerability became public at the end of July, and the CVE was assigned on November 4. [5]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   CVE-2026-102895 is a trivial authentication-bypass vulnerability.

2. [2]

   GPUStack is also an attractive target.

3. [3]

   It is open-source software that manages clusters of GPUs, which are typically used to run AI workloads.

4. [4]

   All versions of GPUStack prior to 2.2.0, which was released at the end of June.

5. [5]

   This vulnerability was not made public until the end of July, and the CVE was assigned on November 4th.

Read the original article →

What happened

Penlink’s Webloc is an application sold to police that uses location information collected through commonly used weather, gaming, email, and religious apps. [1] [2] [3]

Webloc can build a detailed picture of a smartphone’s locations over the previous 12 months and update the data hourly, showing movements on a near-real-time basis. [4]

According to company documents reviewed by Bloomberg, law-enforcement officers can identify phones present at a specified place and time and analyze billions of location data points. [5]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Penlink’s Webloc is an application that locates people using information from the weather, gaming, email, and religious apps on their phone.

2. [2]

   It’s sold to the police.

3. [3]

   The tool collects vast quantities of location data from smartphones via commonly used weather, gaming, email and religious apps.

4. [4]

   It can build a detailed picture of where a smartphone has been over the past 12 months, and update the data hourly, showing the movements of people on a near real-time basis.

5. [5]

   Law enforcement officers can use Webloc to zero in on a map and look at all phones that were present at a specific place and time, analyzing “billions of location data points,” according to company documents reviewed by Bloomberg.

Read the original article →

What happened

Google Cloud said VMs running on AMD Turin chips need a guest OS patch and a stop-and-start to protect against three CPU side-channel flaws. [1]

The flaws may allow an attacker with code running on the same processor core inside a VM to infer data from other processes or the kernel. [2]

Why it matters

Google Cloud said it had already applied mitigations for attacks between VMs and between VMs and the host. [3]

Known limitations

The supplied evidence truncates the affected-product details, so the complete scope of affected AMD Turin VM configurations is unknown. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Google Cloud VMs on AMD Turin chips need a guest OS patch and a stop-and-start to protect against three CPU side-channel flaws, Google said this week.

2. [2]

   Inside a VM, the flaws may let an attacker with code on the same processor core infer data from other processes or the kernel.

3. [3]

   The company has already applied mitigations against attacks between VMs, and between VMs and the host.

4. [4]

   The affected

Read the original article →

What happened

Huntress reported an active campaign using a third-party ScreenConnect extension to push malware to at least 288 machines across 48 organizations; six MSPs and more than 286 endpoints were initially tracked. [1] [2] [3]

Huntress observed attackers using ScreenConnect’s remote command feature to install rogue clients, with all 288 endpoints hit within 90 minutes and about one-third compromised in the first 10 minutes. [4] [5]

Huntress linked the activity to a possible authentication weakness in RMM+, where versions 1.0.31 and 1.0.32 accept a blank access key when none is configured; the extension operates outside ScreenConnect’s normal accounts and authentication controls. [6] [7] [8]

The SCKit malware installs a separate ScreenConnect client for continued remote access and contains code intended to spread to technicians and potentially other customers under their control. [9] [10]

The activity affected ScreenConnect versions 26.6.6.9747 and 26.7.6.9783, and ConnectWise said it had not confirmed how attackers initially gained access or found a ScreenConnect vulnerability. [17] [18] [19]

Why it matters

Huntress said SCKit may attempt to transfer malware to a technician’s workstation, steal authentication cookies, and use that access to reach other machines, but it has not observed that spreading method succeed; console-takeover attempts failed in every recovered host log checked. [11] [12] [13] [14] [15] [16]

Known limitations

ConnectWise identified approximately 400 installations containing at least one RMM+ family extension but stressed that this identified presence of the extensions, not necessarily compromise; Huntress also suspected additional MSP compromises. [20] [21] [22]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Hackers have used a dodgy third-party ScreenConnect extension to push malware onto at least 288 machines across 48 organizations, prompting ConnectWise to disable a handful of plugins in hundreds of customer environments.

2. [2]

   Security outfit Huntress first raised the alarm in a Reddit post on Wednesday, warning of an active campaign targeting cloud-hosted ScreenConnect instances.

3. [3]

   At the time, its security operations center was tracking six compromised managed service providers (MSPs) and more than 286 affected endpoints, with the numbers still climbing.

4. [4]

   Huntress spotted the attacks at around 1747 UTC, when someone began using ScreenConnect's remote command feature to install rogue clients on machines managed by multiple IT service providers.

5. [5]

   All 288 endpoints were hit within 90 minutes, with roughly a third compromised in the first ten minutes.

6. [6]

   Huntress has since traced the activity to a possible authentication weakness in RMM+, a third-party extension that lets other management tools issue commands through ScreenConnect without technicians using its console.

7. [7]

   Versions 1.0.31 and 1.0.32 of the extension contain a flaw that means installations without a configured access key will accept a blank one.

8. [8]

   Because RMM+ operates independently of ScreenConnect's normal user accounts and authentication controls, an attacker could potentially execute commands without defeating MFA.

9. [9]

   The attackers deployed a 16-file malware toolkit dubbed SCKit, which installs a separate ScreenConnect client to maintain remote access even if the legitimate connection is shut down.

10. [10]

    It also contains code designed to spread the infection to IT technicians and potentially other customers under their control.

11. [11]

    According to Huntress, the malware is designed to turn an infected computer into a trap for the technician sent to investigate it.

12. [12]

    If the technician connects through ScreenConnect, the toolkit attempts to transfer malware back to their workstation, steal authentication cookies, and use their access to infect other machines.

13. [13]

    That could give attackers a route from one compromised customer into others managed by the same IT provider.

14. [14]

    However, Huntress says it has yet to see that part of the attack succeed.

15. [15]

    "We have not observed that method to spread work successfully.

16. [16]

    The console-takeover attempt failed in every recovered host log we have checked so far," the researchers wrote.

17. [17]

    The researchers also confirmed that the attacks affected ScreenConnect versions 26.6.6.9747 and 26.7.6.9783, meaning administrators running the latest releases weren't necessarily safe.

18. [18]

    ConnectWise has acknowledged that third-party extensions may have been involved but has stopped short of confirming how the attackers initially gained access.

19. [19]

    The company said: "At this time, we have found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself." There's another nasty trick buried in SCKit.

20. [20]

    Huntress suspects more MSPs may have been compromised, as the attackers appeared to be numbering their victims sequentially, with the numbers suggesting earlier attacks that it hadn't detected.

21. [21]

    In a security advisory, the company said it was investigating unauthorized access to certain partner environments and had identified approximately 400 installations containing at least one extension from the RMM+ family.

22. [22]

    ConnectWise stressed that the 400 environments were identified because they had the extensions installed, not because they were necessarily compromised.

Read the original article →

What happened

Police in nine countries, working with Europol, took down servers behind the Gootloader, CastleRAT, and StealC malware operations and recovered more than 6 million credentials stolen from infected computers. [1]

Europol described the action as the latest round of Operation Endgame, an international campaign targeting services that provide ransomware groups access to networks. [2]

Why it matters

The recovered logins were described as credentials used to reach ordinary users and companies; the suspects sold credentials harvested from victims. [3] [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Police in nine countries, working with Europol, took down servers behind the Gootloader, CastleRAT and StealC malware operations this week and recovered more than 6 million credentials stolen from infected computers.

2. [2]

   Europol announced the action as the latest round of Operation Endgame, the international campaign against the services that give ransomware gangs their way into a network.

3. [3]

   Those logins are what reach ordinary users and companies.

4. [4]

   The suspects sold credentials they had harvested from victims’ … More → The post Operation Endgame malware takedown turns up over 6 million stolen logins appeared first on Help Net Security .

Read the original article →

What happened

Cybersecurity researchers reported that lookalike domains masquerading as AI tools are being used to deliver ClickFix-style lures, browser-hijacking malware, and search-hijacking extensions. [1]

Island named this delivery pattern “TypoPrompting.” [2]

Why it matters

The reported pattern turns attempts to reach familiar AI tools into prompts to verify, according to the source’s truncated description. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Cybersecurity researchers have found that lookalike domains masquerading as artificial intelligence (AI) tools are being used to serve ClickFix-style lures, browser-hijacking malware, and a set of extensions that hijack user searches.

2. [2]

   This delivery pattern has been codenamed TypoPrompting by Island.

3. [3]

   "AI-app lookalikes that turn an attempt to reach a familiar tool into a prompt to verify,

Read the original article →

What happened

Citrix released patches for multiple critical flaws affecting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console; the flaws could lead to denial of service or authentication bypass. [1]

The supplied text identifies CVE-2026-120868 as affecting NetScaler ADC and NetScaler Gateway and assigns it a CVSS score of 9.3. [2]

Known limitations

The supplied evidence truncates the description of CVE-2026-120868 and does not establish its full impact, prerequisites, exposure conditions, or remediation details. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authentication bypass.

2. [2]

   The critical vulnerabilities that impact NetScaler ADC and NetScaler Gateway are listed below - CVE-2026-120868 (CVSS score: 9.3) - A memory overflow vulnerability in Packet

Read the original article →

What happened

A critical Red Hat Quay flaw allows an attacker with access to a Quay registry to read and overwrite private container images in every repository. [1]

With anonymous access enabled—the default setting—the attacker does not need an account; with anonymous access disabled, a valid account is still sufficient to exploit the flaw, according to Red Hat. [2] [3]

Red Hat has released fixed builds for eight Quay [the supplied evidence ends before identifying the builds]. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A critical flaw in Red Hat Quay allows an attacker who can access a Quay registry to read and overwrite private container images in every repository.

2. [2]

   Quay enables anonymous access by default, and while it is enabled, the attacker needs no account.

3. [3]

   When it is off, anyone with a valid account can still exploit the flaw, Red Hat said yesterday.

4. [4]

   The company has released fixed builds for eight Quay

Read the original article →

What happened

eMudhra, a publicly trusted certificate authority, had eight intermediate CA private keys described as extremely weak and easily guessable; the company attributed the issue to a key-generation script that its hardware could not handle. [1] [2] [3]

The exposed eMudhra keys could enable forged certificates for website spoofing and malicious activity, and could let researchers inspect communications from devices that still trusted those certificates. [4] [5]

A 2022 Samsung smart TV that still trusted the compromised certificates was routed through mitmproxy, allowing its HTTPS traffic to be inspected and selected requests redirected to a chosen server. [6] [7]

Using a forged certificate for Samsung advertising domains and router redirection, Daniel Vrátil replaced home-screen ads with family photos served from a NAS and discarded related tracking requests. [8] [9] [10]

Why it matters

The method requires a device that still trusts eMudhra certificates, analysis of its advertising traffic, router configuration, and code changes; the project is not a one-click setup. [11] [12]

Known limitations

The technique may stop working if Samsung updates the TV to revoke the certificate; unsupported smart TVs may never receive such an update and could remain exposed. [13] [14] [15]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The company, based in India, operated a publicly trusted HTTPS certificate authority and says it has issued more than 60 million digital certificates.

2. [2]

   As we learned last month, eMudhra wasn't doing its best to keep its cryptographic keys safe: Eight intermediate CA private keys were found to be absurdly weak, with one being the number four and the others consisting of two- or three-digit numbers that could be guessed with little effort.

3. [3]

   The company has blamed a bad software script put in place to generate keys that its hardware couldn’t handle as the root of the issue.

4. [4]

   What all that means, in a practical sense, is that anyone could forge an eMudhra certificate to spoof a website and do something malicious.

5. [5]

   It also means that security researchers who were able to get their hands on devices that still trust eMudhra certificates could have a field day learning how their communications work, which is exactly what Vrátil took advantage of.

6. [6]

   eMudhra private keys were added to the open source mitmproxy service - a fully interactive HTTPS proxy that can be used for good or bad - shortly after they were exposed.

7. [7]

   Pair that with a 2022 Samsung smart TV that still trusts the compromised eMudhra certificates, and you have a way to inspect its HTTPS traffic and redirect selected requests to a server of your choosing.

8. [8]

   “This allowed me to route all traffic from the TV through mitmproxy and get a list of all the domains and endpoints that my TV talks to, but also see the structure of the requests and response payloads.” The advertising traffic flow was pretty basic, it turns out: Activity on the TV is relayed to an ad server, which serves up ads on the home screen based on a JSON response.

9. [9]

   By generating a certificate for Samsung's advertising domains using a compromised eMudhra signing key, and configuring his router to direct requests for those domains to a server on his home network, Vrátil was able to replace ads with family photos served from his NAS.

10. [10]

    He also added code that tosses other requests to those advertising domains, including tracking data, into a black hole rather than forwarding them to Samsung's servers.

11. [11]

    As mentioned above, it’s on GitHub for those who want to trick their TV, if it still supports eMudhra certificates, but you’ll have to do the legwork to dissect how your device is getting ads and tweak the code to work.

12. [12]

    “It's not exactly a one-click setup,” Vrátil told The Register in an email.

13. [13]

    “Luckily for me, Samsung did not yet release an update for my TV that would revoke the certificate,” Vrátil explained in his writeup.

14. [14]

    It’s also worth noting that this is only going to work as long as vulnerable devices keep trusting eMudhra certificates, which hopefully means you need to act fast.

15. [15]

    That said, smart TVs that are out of support may never receive such an update, leaving them exposed to the certificate weakness even if their owners block the ads.

Read the original article →