N-able pulls N-central cloud offline after 30+ zero-days go public

N-able takes N-central cloud offline after researcher drops 33 zero-days with PoC exploits

N-able has taken Hosted N-central environments offline and urged on-premises customers to shut down servers until further notice after researcher Sean Bales publicly disclosed more than 30 vulnerabilities, tracked as Able2Shell, with proof-of-concept exploits tested against N-central Appliance 2026.4.0.31. The flaws include credential disclosure, arbitrary file writes, directory traversal, XSS, XXE injection and remote code execution, with chains enabling rogue admin access and root command execution. N-able says it has seen no successful exploitation and is readying a hot fix; it released N-central 2026.4 HF2 addressing several CVEs. Censys counts 1,728 internet-exposed instances, and watchTowr and Defused Cyber report probing against honeypots.

N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits →

Topics: Zero-day vulnerabilitiesPatch Tuesday & security updates

Chainalysis says hackers stole credentials and tokens for all customers

Chainalysis has told customers that hackers obtained names, usernames, password hashes and live tokens for all of its users after breaching its network security. Its customer base includes the FBI, US Immigration and Customs Enforcement, the US Air Force, Microsoft, Coinbase and Barclays. The company said an external actor used AI agent-assisted offensive techniques to gain access to its systems and internal tools in October, in an incident similar to hacks of other platforms that month. In a Wednesday update, Chainalysis said part of the multifront attack involved an on-path, or adversary-in-the-middle, attack that exposed a subset of customer passwords; the vector was identified and fixed. It has not said where the infrastructure compromise occurred or whether the data was TLS encrypted.

Chainalysis says hackers stole credentials and tokens for all of its customers - Ars Technica →

ScreenConnect malware campaign breaches MSPs and hits 286 endpoints

ConnectWise is investigating an active malware campaign that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices. Huntress discovered the campaign on Wednesday and has identified six compromised MSPs and 286 affected endpoints across 47 organizations, with the victim count still rising. Attackers abuse ScreenConnect’s Run Command feature to push ScreenConnect clients onto managed endpoints, giving remote access outside the legitimate MSP environment. Huntress also warned of a reverse-pivot technique that can compromise a technician’s workstation when they open a session with an infected customer device. ConnectWise confirmed it is investigating malicious activity affecting a limited number of partners and urged avoiding interactive sessions to suspected compromised devices, revoking sessions, resetting credentials and verifying MFA.

Active ScreenConnect attacks breach MSPs, impact dozens of organizations →

Topics: Malware & infostealers

eBPF rootkit code and tutorials surface on underground forums

Flare research found eBPF rootkit code and step-by-step tutorials circulating on underground forums, including a Russian-language post on Duty Free describing an implant with process hiding and packet-triggered activation. The guide cites BPFDoor and Symbiote as influences, includes source code, and describes activating the implant with a TCP SYN packet carrying a specific window size, hiding processes by hooking getdents64, encrypting command-and-control traffic with AES-256-GCM, and using XDP to drop packets matching 43 IP addresses the author associates with antivirus vendors. Flare also found 10 related Pastebin posts with XDP code and microsecond timing thresholds. Because eBPF programs load through the kernel’s bpf() interface without a kernel module, a routine lsmod check can miss them; detection relies on monitoring bpf() syscalls and auditing loaded programs with bpftool.

eBPF Rootkits: Why Underground Actors Are Taking Notice →

Topics: Malware & infostealers

Bitcoin Core patches three flaws, including one that could stall mining

Bitcoin Core disclosed three now-patched security vulnerabilities in the software running most of the Bitcoin network’s nodes, covering denial-of-service and privacy issues rather than anything enabling coin theft or forgery. None reached the project’s critical tier, and no exploitation was reported. The most serious, CVE-2025-62861, concerns block template creation: a chain reorganization could trigger an erroneous eviction of certain transactions, corrupting a node’s mempool so it could no longer build block templates until restarted, halting a miner’s ability to earn block rewards. CVE-2025-62859 could let a peer stall block processing by announcing a compact block with a manipulated witness, while CVE-2025-62860 wrongly granted whitelist permissions to inbound Tor connections. Fixes shipped earlier; operators are urged to run the latest software.

A High-Severity Bug Could Have Stalled Bitcoin Mining—Bitcoin Core Has a Fix →

Topics: Patch Tuesday & security updates