N-central patch already bypassed in the wild; wfx stealer hits thousands of GitHub repos
Friday, November 13, 2026 · 9 min
Attackers compromised at least 21 N-central servers, most running N-able's newest hotfix, hours after a fresh proof of concept, while a CI secret stealer pushed from hijacked GitHub accounts reached thousands of repositories. Plus the ScreenConnect RMM+ intrusions, Expedia's vendor breach, and TSMC's employee data leak.
Listen
Show notes
Attackers compromised at least 21 N-central servers, most running N-able's newest hotfix, hours after a fresh proof of concept, while a CI secret stealer pushed from hijacked GitHub accounts reached thousands of repositories. Plus the ScreenConnect RMM+ intrusions, Expedia's vendor breach, and TSMC's employee data leak.
In this episode
- New N-able "4EverAble2Shell" zero-day exploited hours after PoC released — BleepingComputer
“The researchers then checked the associated IP addresses and confirmed that all 21 hosted N-central installations, including 19 running version 2026.4.1.26, the latest Hotfix 2 release issued on November 10.”
- Hijacked GitHub Accounts Push “wfx” CI Secret Stealer to Thousands of Repositories | Endor Labs — Endor Labs
“Why it matters: at least 1,806 repositories have already had credentials stolen, and at least 50 of the hijacked accounts publish packages to npm, Go, Packagist, PyPI or crates. Stolen publishing tokens can be used for a follow-on wave of malicious package releases.”
- New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks — BleepingComputer
“However, the vulnerable versions allowed the access key to remain blank if an administrator had never configured one. When this occurred, an attacker could supply an empty access key and pass the extension's authentication check, allowing them to issue remote commands through…”
- Expedia Confirms Cyberattack Through Third-Party Vendor — Skift
“Expedia Group confirmed Thursday that attackers reached its systems through a compromised third-party data platform provider, in a supply chain cyberattack that also affected multiple companies.”
- TSMC confirms employee data leak; hackers demand 3 Bitcoin for 46,000 records - CNBC TV18 — CNBCTV18.com
““TSMC has found that some of our current and former employee data was made available on an external website without authorisation. Currently, we have found no evidence that TSMC’s systems have been compromised,” read TSMC's November 12 filing with the US Securities and Exchange…”