N-able Patches N-central After Taking Hosted Servers Offline
N-able released N-central Hotfix 2. Follow the server, Agent and Probe rollout and check the Legacy API after further exploits were disclosed.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
A Malicious Web Page Can Reach FortiClient’s Local API
Crafted web content can reach the FortiClient local API. Identify the Windows or Mac endpoint package and verify the running fixed build.
Stolen Qubole Credentials Opened Customer AWS Accounts
Attackers used Qubole-linked AWS credentials to enter customer accounts, read secrets and download S3 data. Old integration roles still granted access.
Google Patches an Exploited Chrome XML Flaw
Google is rolling out fixes for an exploited Chrome XML flaw. Verify the running browser build on Stable or Extended Stable after relaunch.
Apple Patches Exploited Brotli Flaw in Out-of-Band Update
Apple’s 9 November updates fix an exploited Brotli flaw and close iMessage and device-pairing vulnerabilities. Check which version to install.
Synology Ships a Plex2Shell Fix for Its NAS Package
Synology released updated Plex Media Server packages for four DSM branches. Check the exact Plex build and review any server exposed before patching.
Mittwald Traces 56 Compromised Hosting Projects to Its MCP Server
Mittwald traced 56 compromised hosting projects to its MCP server. The company restored mStudio and SSH access while investigating the attack.
SonicWall Fixes an Exploited VPN Route Around SAML
SonicWall fixed an exploited SSL VPN flaw that bypasses SAML enforcement. Check alternate login paths and verify the fixed Gen7 or Gen8 build.
An OpenSSH Password Bypass Puts Some Alpine Hosts at Risk
Some Alpine configurations let an attacker bypass SSH password authentication. Check account conditions, update the package and restart SSH.
CISA Flags an Exploited WordPress Core Upgrade Flaw
CISA listed an exploited WordPress core flaw that can run code during a full upgrade. Check the fixed release and review the last upgrade window.