Here are today’s top cybersecurity stories for Thursday, November 12, 2026.
New N-able “4EverAble2Shell” Zero-Day Exploited Hours After PoC Release
Attackers began exploiting a newly disclosed N-central flaw, CVE-2026-90436 in Apache Axis, within hours of researcher Sean Bales publishing exploit code. Huntback reports at least 21 compromised production servers in the United States, Canada, South Africa, the United Kingdom, Germany, France, and Sweden, with 19 running the latest 2026.4.1.26 HF2 release. Attackers installed XMRig Monero miners, and N-able has restricted features and disabled its Intune integration while it builds fixes. BleepingComputer
Operation Endgame Dismantles Gootloader, StealC, and CastleRAT Infrastructure
Law enforcement in nine countries, including Canada, seized 257 domains and 235 servers tied to the Gootloader loader, the StealC infostealer, and the CastleRAT remote access trojan. Europol and Eurojust coordinated the action. Authorities identified about 6.4 million victim datasets and are sharing them through HaveIBeenPwned, Shadowserver, and other partners. BleepingComputer
Apache Patches Critical HTTP/2 Remote Code Execution Flaw
Apache HTTP Server 2.4.71 fixes CVE-2026-119618, a race condition in mod_http2 rated CVSS 9.8 by Red Hat. Versions 2.4.55 through 2.4.70 with HTTP/2 enabled are affected. Anthropic’s OSS Scanner and Google Cloud Vulnerability Research reported the bug independently, and Wiz says no in-the-wild exploitation was known as of November 11. SecurityWeek
Attacker Uses 4,837 Hijacked GitHub Accounts to Run CI Secret Stealer
Aikido Security found a secret-stealing workflow running in at least 1,806 repositories, and SafeDep counted 8,093 repositories with malicious commits. The stealer targets GitHub Actions secrets, OIDC tokens, and AWS, Azure, GCP, npm, and PyPI credentials, then creates long-lived cloud access keys. Each attack began with a pull request titled “docs: dependency audit notes” from a branch named wfx-docs. The Hacker News
Rogue ScreenConnect Clients Hit 288 Endpoints Across 48 Organizations
Huntress and Sophos report attackers used the Run Command feature in cloud-hosted ScreenConnect panels to install rogue clients and a toolkit named SCKit. The malware steals technician session cookies to pivot to other panels. ConnectWise says it found no compromise of its infrastructure and disabled five third-party extensions across about 400 partner environments. The Hacker News
SignDrop Zero-Day Turns Windows CLFS Protection Into SYSTEM Access
A researcher using the name MSNightmare released proof-of-concept code abusing CLFS log-file authentication, a feature Microsoft added in October 2025. The exploit lets a standard user obtain a writable SYSTEM-owned file on Windows 11 26H2 and Windows Server 2025 test builds. No CVE or patch exists, and no in-the-wild attacks have been reported. The Hacker News
Critical Red Hat Quay Flaws Expose Private Container Images
Red Hat disclosed CVE-2026-123710 (CVSS 9.8), which lets an attacker register a signing key and read or overwrite any private image, and CVE-2026-110697 (CVSS 9.9), which leaks other tenants’ robot account tokens. Both affect all Quay 3 and Quay 5 versions. Fixed builds are available for eight Quay 3 branches. The Hacker News
Node.js Fixes 16 Flaws, Including HTTP/2 Crash and Memory Leak Bugs
Node.js released versions 22.23.5, 24.22.3, and 26.13.1 to address 16 vulnerabilities, seven rated high. Flaws include HTTP/2 server crashes and memory disclosure bugs exposing data from other connections. End-of-life lines 20.x and 25.x receive no fix. The Hacker News
MongoDB Patches Pre-Auth Flaw CVE-2026-118383
MongoDB fixed a use-after-free rated CVSS 9.5 in replica set members, including shard and config servers. An unauthenticated client sends two specially formed ping commands, and the server crashes if a lagging member later wins an election. Atlas clusters receive fixes during maintenance, and self-managed users need to upgrade every member. The Hacker News
Hackers Plant GSocket on Linux Servers for Persistent Access
Microsoft reports multiple threat actors abuse the open-source GSocket tool to keep access to Linux servers after the original flaw is patched. GSocket detections rose 356.2% between March and August, mostly against PHP web apps and cPanel hosting. Microsoft recommends egress filtering and audits of cron jobs and systemd services. BleepingComputer
Notion Customer Data Exposed in Fireworks AI Breach
Notion is notifying a small set of customers after attackers accessed Notion AI chat transcripts held by inference provider Fireworks AI. Fewer than 1% of workspaces were affected, according to Notion. Fireworks suffered two intrusions in October, one through a third-party cloud provider hosting its R&D machines. SecurityWeek
Stay tuned for today’s in-depth analysis posts.
