ScreenConnect MSP attack, new N-central exploits, GitHub secret stealer | Cyber Security News Nov 12
Show notes
Rogue remote-access clients pushed through MSPs' ScreenConnect consoles, new N-central exploit code that its author says works against this week's hotfix, and a secret stealer planted in thousands of GitHub repositories. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: Which story needs a follow-up, ScreenConnect or the GitHub stealer? Reply in the comments or at [email protected].
1. Rogue clients pushed through MSP ScreenConnect - Do: Confirm the RMM+ extensions are off in ScreenConnect - https://www.huntress.com/blog/sckit-worm-rogue-screenconnect
2. Update: new N-central exploits target the hotfix - Do: Confirm N-central's Legacy API is off - https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains
3. wfx stealer planted in thousands of GitHub repos - Do: Search your GitHub org for wfx-docs branches - https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories
4. Apache fixes critical HTTP/2 code execution - CVE-2026-119618 - Fixed: 2.4.71 - Do: Upgrade Apache HTTP Server - https://access.redhat.com/security/cve/CVE-2026-119618
5. Update: Cisco BroadWorks flaw now exploited - CVE-2026-20320 - Fixed: RI.2026.07 - Do: Patch Cisco BroadWorks and rotate its keys - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt
6. Ivanti fixes critical EPM and CSA flaws - CVE-2026-121653, CVE-2026-121683 - Fixed: EPM 2024 SU8; CSA 5.0.8.1 - Do: Update Ivanti Endpoint Manager and CSA - https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-November-2026?language=en_US
7. GSocket keeps attackers on patched Linux servers - Do: Hunt patched Linux web servers for GSocket - https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/
8. Update: eMudhra blames script for one-byte CA keys - Do: Remove revoked eMudhra intermediates from appliances - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-emudhra-info-ScS22A1r
Also today:
- Zoom fixes a critical Workplace for Windows flaw - https://www.zoom.com/en/trust/security-bulletin/ZSB-26023/
- Chrome 157 security update, 83 fixes - http://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html
- Notion: AI provider breach exposed chat transcripts - https://www.bleepingcomputer.com/news/security/notion-says-fireworks-breach-exposed-customer-ai-chat-transcripts/