Security news.
Today's security landscape is dominated by active exploitation of remote access infrastructure, widespread CI/CD supply chain abuse, and critical web runtime patches. Threat actors are aggressively targeting enterprise perimeter devices including N-able N-central, ConnectWise ScreenConnect, and Check Point gateways. In addition, organizations face critical remote code execution updates across Apache HTTP Server and major browser ecosystems.
N-able Investigates Fresh N-central Exploits Enabling Root RCE
Public exploits targeting on-premise N-central servers with exposed Legacy APIs can yield unauthenticated remote code execution and SYSTEM-level access despite recent hotfixes.
Hijacked GitHub Accounts Deploy CI Secret Stealers Across 1,800+ Repositories
The "wfx-loot" campaign compromised thousands of developer accounts to inject automated malicious workflows designed to harvest secrets and cloud credentials from active CI pipelines.
Critical Pre-Auth RCE Flaw Patched in Apache HTTP Server HTTP/2 Module
The vulnerability, tracked as CVE-2026-119618, impacts Apache versions 2.4.55 through 2.4.70 running mod_http2 and allows remote unauthenticated attackers to execute arbitrary code.
Active Campaign Targets ConnectWise ScreenConnect via Vulnerable Extensions
Attackers are exploiting third-party extensions to bypass authentication and deploy malicious remote-access clients across dozens of customer environments.
Check Point Gateway Portals Targeted with "PHP2Shell" Exploits
Telemetry reveals threat actors are actively targeting Mobile Access portals on Check Point Security Gateways with recent PHP vulnerabilities to gain initial network access.
Node.js Issues Critical Security Release for HTTP/2 Flaws
Updates across the 22.x, 24.x, and 26.x release lines fix 16 vulnerabilities, including HTTP/2 defects that trigger server crashes or leak cross-connection memory.
Threat Actors Probe AI Clusters via GPUStack Authentication Bypass
SANS ISC reports active exploitation scans targeting CVE-2026-102895, a trivial auth bypass affecting open-source GPUStack installations used to manage AI workloads.
Chrome and Firefox Resolve Over 180 Flaws in Major Browser Releases
Google patched 83 vulnerabilities in Chrome 157, while Mozilla fixed 99 security bugs in Firefox 160, addressing numerous critical- and high-severity vulnerabilities.