SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

N-able patches CVSS 10.0 RCE flaw in N-central amid reports of active exploitation

0
·3 views

N-able has released N-central 2026.3 Hotfix 4 (build 2026.3.1.14) to address CVE-2026-86218, a pre-authentication remote code execution vulnerability scoring 10.0 on the CVSS scale. The flaw affects self-hosted and N-able-hosted N-central deployments, and successful exploitation could grant attackers code execution on the RMM server without valid credentials. Security firm Huntress noted conflicting vendor communications — some suggesting active exploitation in the wild, while official release notes stopped short of confirming production incidents. Huntress also flagged that log rotation at an affected customer site prevented definitive attribution of a specific incident to this vulnerability. Two related but separate vulnerabilities, CVE-2026-86206 and CVE-2026-86207, were also disclosed; the earlier Hotfix 3 does not address CVE-2026-86218.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

AI-Generated Works Get No US Copyright Protection, Courts and Officials Confirm

Under current US law, works produced entirely by artificial intelligence cannot be copyrighted because copyright requires a human author, regardless of how detailed or iterative a user's prompt was. The US Copyright Office reaffirmed this position in its January 2025 report on AI and copyright, concluding that existing law already addresses the issue without need for new legislation. Courts have backed this stance, most notably in Thaler v. Perlmutter, where the DC Circuit ruled in 2025 that copyright demands human authorship, and the Supreme Court declined to revisit that ruling in 2026. However, distinctly human contributions woven into an AI-assisted work — such as original writing, editorial choices, or creative selection and arrangement — can still qualify for protection. The UK has historically taken a different approach by allowing limited protection for computer-generated works, though that policy is now under review.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Composite Indexes and Query Rewrites Can Cut SQL Latency by Over 1,000%

As databases scale to millions of records, poorly optimized SQL queries become a major performance bottleneck, straining CPU resources and degrading user experience. Common pitfalls include using SELECT * in production, which increases I/O overhead and prevents covering indexes from functioning efficiently. Tools like EXPLAIN in MySQL and PostgreSQL help developers inspect query execution plans and identify full table scans or missing indexes before making changes. Composite indexes can dramatically speed up multi-condition queries, but column order matters — high-selectivity columns should be placed first to maximize index usage. Wrapping indexed columns in functions within WHERE clauses also invalidates index lookups, and rewriting such queries as explicit range comparisons restores fast index scans.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Critical Adobe Commerce Zero-Day CVE-2026-75650 Exploited to Deploy Rust Backdoor

A critical unauthenticated remote code execution vulnerability, tracked as CVE-2026-75650 and dubbed StyleSmuggler, affects Adobe Commerce and Magento Open Source installations. Discovered and reported by Sansec, the flaw allows attackers to inject PHP into the template system, which then executes when the server renders a failed payment notification email — requiring no user interaction. Active exploitation has been observed deploying a Rust-based Linux backdoor, with some variants also dropping PHP web shells; the malware communicates via WebSocket over TLS or NTP-like UDP traffic on port 123. Adobe has released a hotfix under security bulletin APSB26-146, though applying it does not remove existing malware or invalidate credentials that may already have been compromised. Store operators are advised to apply the patch immediately, audit templates, check for unauthorized files under pub/media, and review processes and cron entries for signs of compromise.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Modified ScreenConnect Clients Spread Malware to Support Operators via Worm-Like Technique

Security researchers at Huntress have identified a campaign in which tampered ConnectWise ScreenConnect clients on compromised endpoints automatically push malicious scripts to operator machines that connect to them for remote support. The attack begins through social engineering, where victims are tricked into granting remote access or installing an unauthorized ScreenConnect client, sometimes preceded by abuse of Microsoft Quick Assist. Once a Guest endpoint is infected, the modified client exploits ScreenConnect's built-in file-transfer and script-execution features to deliver a series of VBScript files to any Host operator that connects. Depending on the target environment, payloads can include user-level remote access tools, persistence mechanisms, UAC bypass, network tunneling via wstunnel, and cryptocurrency mining using XMRig. Defenders are advised to watch for ScreenConnect spawning wscript.exe, execution of numbered VBS files, and suspicious RunFiles audit entries as key indicators of compromise.

0 comments Read more at DEV Community