Monday, September 7, 2026
Daily digest
Today's news is dominated by active exploitation of widely-deployed remote-management and networking gear — N-able N-central, MikroTik RouterOS, and ConnectWise ScreenConnect all have live attacks or unpatched flaws in play, making this a patch-and-verify day for anyone running RMM tooling or edge routers.
N-able Ships Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE
N-able released a fourth hotfix for its N-central RMM platform, superseding Hotfix 3 which was issued just a day earlier. Every on-premises build below 2026.3.1.14 is affected; N-able's incident notice says the flaw is being exploited in the wild, though its release notes call that unconfirmed.
Why it matters: If N-central or any downstream MSP tooling touches your environment, verify you're on 2026.3.1.14+ immediately — repeated emergency hotfixes on the same flaw suggest incomplete initial patches and warrant a fresh compromise check, not just a version bump.
Hackers Exploit MikroTik RouterOS SSH Auth Bypass Chain
Attackers are chaining two recently disclosed MikroTik RouterOS vulnerabilities to gain full administrative control of internet-exposed devices without authentication. CERT Polska's September 5 warning traces active exploitation back to at least September 2, with attackers adding new accounts to maintain access after patching.
Why it matters: Patching alone won't remove attacker-added accounts — any MikroTik gear in the network perimeter needs both the patch and a manual audit of local user accounts to fully evict persistence, a detail relevant to NIST 800-171 access control review.
ConnectWise Warns of Unpatched ScreenConnect Flaw
ConnectWise disclosed a new vulnerability in its ScreenConnect Remote Access product and published temporary mitigation steps, with a full patch expected later this week. No CVE exploitation details were confirmed at time of writing.
Why it matters: If ScreenConnect is used for remote support in your environment, apply the interim mitigations now rather than waiting for the patch — RMM tools are high-value targets and a gap here directly implicates access control requirements under CMMC L2.
JSCeal Malware Bypasses Google Authentication via Stolen Session Cookies
Check Point Research detailed JSCeal, a compiled V8 JavaScript malware with credential harvesting, surveillance, and traffic-interception capabilities. The payloads use heavy obfuscation (RC4-protected strings, control-flow flattening) and can hijack authenticated sessions by stealing cookies rather than credentials.
Why it matters: Session-cookie theft bypasses MFA entirely — this is a strong reminder to enforce Conditional Access token binding/sign-in risk policies in GCC High and shorten session lifetimes for privileged accounts.
New Malware Modules Disable Windows Update and Defender to Run Crypto Miners
Elastic Security Labs identified four previously unreported programs (ProManager, WinUpdate, SoftManager, and a fourth module) linked to the REVSTEALER infostealer that persist after the stealer deletes itself. One module disables Windows Update and Microsoft Defender before deploying a cryptocurrency miner.
Why it matters: Confirm Intune Tamper Protection and Defender policy enforcement can't be locally disabled on managed Windows 11 endpoints — this technique specifically targets the update/AV controls you rely on for patch compliance.
Phishing Campaigns Use Invisible Unicode Characters to Evade Filters
Threat actors have adopted ASCII smuggling, embedding invisible Unicode characters in phishing lures to slip past email security filters. The technique hides malicious text or links from automated scanners while rendering normally to victims.
Why it matters: Check whether Exchange Online Protection/Defender for Office 365 rules in your GCC High tenant normalize or strip zero-width Unicode before filtering — many legacy transport rules don't and may need updating.
Trezor Breach via Shipping Vendor Now Affects 81,000 Customers
Trezor disclosed that an August data breach at third-party shipping and logistics provider ShipMonk now affects an additional 67,000 U.S. customers, bringing the total impact to roughly 81,000. The breach exposed customer shipping and contact data tied to hardware wallet orders.
Why it matters: A textbook case of third-party/supply-chain exposure growing after initial disclosure — a useful example to cite when justifying vendor risk assessments required under NIST 800-171 3.C for any external logistics or fulfillment partners.
Berlin Investigates Second Data Leak as Germany Warns on Rhysida Ransomware
Hackers published a new trove of stolen login credentials tied to Berlin government agencies, prompting a fresh investigation following an earlier breach. Separately, Germany's federal information security agency (BSI) issued a warning about the Rhysida ransomware group targeting public sector networks.
Pentagon Bill Would Allow Cyber Contractors to Hack Back; BEC Campaign Steals €35M from French Notaries
A pending Pentagon bill would authorize certain cyber contractors to conduct active hack-back operations, according to Risky Business News. The same roundup reports a business email compromise campaign that stole €35 million from French notary offices, plus a Five Eyes advisory urging breached companies to stop spinning incident disclosures for PR purposes.
Why it matters: If your organization holds or pursues DoD contracts, watch how the hack-back authorization bill defines 'cyber contractor' — it could create new liability or compliance boundaries relevant to CMMC scope and incident-response obligations.
Nvidia's Hugging Face Acquisition Could Fragment the AI Ecosystem
The Register's analysis examines Nvidia's acquisition of Hugging Face, arguing it may push AI model development toward a more fragmented, vendor-siloed landscape rather than the open ecosystem Hugging Face has represented.
Why it matters: If your self-hosted AI stack pulls models or tooling from Hugging Face, watch for licensing or hosting changes post-acquisition that could affect model availability or require re-evaluating your model supply chain.