# Archive
Browse past daily curated stories
Friday, November 13, 2026
-
1The Hacker News generalHackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2
N-able confirmed active exploitation of newly disclosed zero-days tracked as 4EverAble2Shell and Agent2Shell, with at least 21 N-central servers compromised — 19 of which were running the latest Hotfix 2 security update. N-able is restricting N-central features and integrations while remediation is completed, making this critical for MSPs and IT admins managing large device fleets via N-central.
-
2BleepingComputer generalNew N-able "4EverAble2Shell" zero-day exploited hours after PoC released
The 4EverAble2Shell zero-day in N-able N-central was weaponized within hours of public PoC release, with at least 21 servers confirmed compromised and attackers deploying cryptocurrency miners. The flaw is part of a broader 33-vulnerability disclosure targeting the RMM platform, and exploitation of patched systems underscores the supply-chain risk to MSPs and their downstream clients.
-
3CyberScoop generalUS seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance
The US government seized $1.2 billion in cryptocurrency stolen from Binance and dismantled infrastructure belonging to North Korean APT38, which included video footage used to deceive victims in social engineering attacks. The FBI separately attributed a $400 million crypto theft to a North Korean social engineering scheme, reinforcing DPRK's continued focus on crypto-sector targeting.
-
4The Hacker News generalCritical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
CVE-2026-119618, a critical race condition in Apache HTTP Server's mod_http2 module, allows unauthenticated remote code execution on servers running versions 2.4.55 through 2.4.70 with HTTP/2 enabled; the fix is in version 2.4.71. Notably discovered by researchers from Anthropic and Google, the flaw affects widely deployed Apache installations including those shipped with Red Hat Enterprise Linux.
-
5CyberScoop generalInternational operation dismantles malware networks, exposes 6.4 million stolen credentials
Operation Endgame's second phase dismantled the Gootloader, CastleRAT, and StealC malware infrastructure — loaders and infostealers that serve as initial-access tools for ransomware operations — exposing 6.4 million stolen credentials. Europol coordinated the action with nine countries, with German authorities tracing rebuilt StealC servers to the Virtualine bulletproof hosting provider previously seized by the FBI in October.
-
6The Hacker News generalScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients
ConnectWise's ScreenConnect platform was at the center of a campaign hitting at least 288 endpoints across 48 organizations, with attackers deploying rogue clients via a compromised third-party extension rather than a new ScreenConnect vulnerability. Blackpoint Cyber's APG linked the SCKit worm-like toolkit to CVE-2026-84869 (CVSS 9.9), a patched critical flaw, and ConnectWise disabled five third-party extensions across approximately 400 partner environments.
-
7The Hacker News generalCitrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass
Citrix patched 12 vulnerabilities across NetScaler ADC, NetScaler Gateway, and NetScaler Console, including CVE-2026-120868 (CVSS 9.3), a memory overflow enabling denial-of-service or authentication bypass. Given historical targeting of Citrix ADC by ransomware groups and nation-state actors, security teams should prioritize these patches immediately.
-
8BleepingComputer generalNew Windows SignDrop zero-day gives hackers SYSTEM privileges
Researcher Abdelhamid Naceri (Nightmare Eclipse) released a public zero-day exploit called SignDrop targeting the Windows Common Log File System (CLFS) driver, enabling local privilege escalation to SYSTEM by abusing path redirection during companion file creation by privileged processes. The exploit targets a log-authentication feature added to clfs.sys in a previous update, and no patch has been released.
-
9The Hacker News generalAttacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories
In the 'wfx-loot' campaign, an attacker leveraged credentials from 4,837 hijacked GitHub accounts to plant a CI secrets stealer across at least 1,806 repositories, targeting cloud credentials and CI/CD pipeline secrets. The campaign probed 61,764 repositories by opening pull requests and pushing malicious code, posing a significant supply-chain risk to organizations using GitHub Actions.
-
10The Hacker News generalAntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets
The AntiFox agentic AI penetration testing platform, hosted on Alibaba Cloud infrastructure, has been observed in confirmed attacks that accessed AWS production secrets and enabled lateral movement into compromised environments. The use of AI-driven autonomous attack tooling against cloud infrastructure marks a significant escalation in threat actor tradecraft that defenders must account for in cloud security monitoring.