U51

Episodes

Episode 27

All episodes
Episode 2712:28

Episode 27: N-able pulls N-central offline, Xen Orchestra exploited and Australia plans an AI safety regulator, 11 November 2026

SpotifyApple PodcastsPocket Casts

N-able has taken its hosted N-central platform offline and told on-premises customers to shut down their servers after a researcher published 33 unpatched flaws with proof-of-concept exploits. Attackers are exploiting an authentication bypass in Xen Orchestra to take over XCP-ng hosts, and Microsoft and Google each fixed an exploited flaw, in Outlook and Chrome. The federal government plans a regulator to enforce mandatory safety obligations on frontier AI companies, and France has attributed October's supermarket refrigeration sabotage to Iran.

Global threats

  • N-able takes N-central offline after Able2Shell disclosure (9 November 2026, US time). Researcher Sean Bales published 33 vulnerabilities with PoC exploits on 8 November; Huntress says they chain into at least four exploits (three RCE, one root privilege escalation); the researcher says the flaws can also create unauthorised admin accounts. Affected: N-central Appliance 2026.4.0.31 and likely earlier versions (per Huntress). No CVEs yet. N-able reports scanning tied to the public PoC but no successful customer compromise; its hotfix was still in validation at its 10 November 17:42 UTC update (target had been midday 10 November US time), so check its status page; keep on-premises servers offline until N-able says otherwise, and review logins, new admin accounts and deployed scripts from 8 November. Huntress; BleepingComputer; SecurityWeek; Rapid7
  • Xen Orchestra authentication bypass exploited (VSA-2026-062, 10 November 2026). Cookie authenticationToken=j:{} authenticates as the first stored token's owner with admin rights; can lead to code execution on managed pools and XCP-ng host takeover as root. No CVE yet. Affected: xo-server before 5.211.2 (stable) and 5.213.1 (latest), in Xen Orchestra before 6.9.1 (stable) and 6.10.0 (latest), plus Xen Orchestra Appliance. Fixed: Xen Orchestra 6.9.1 (xo-server 5.211.2) and 6.10.0 (xo-server 5.213.1). Indicators per Vates: attacker IP 91.211.251[.]112:8001, a Tor onion C2, pivot2 VM, hvm_serial: file VMs, files /etc/cron.d/zz-ustar* (including /etc/cron.d/zz-ustar2), /.ustar5, /.ustar6, and entries in /etc/ld.so.preload. Vates says credential harvesting cannot be ruled out. Rotate all Vates VMS secrets if compromised. Vates advisory; BleepingComputer
  • Microsoft November Patch Tuesday: exploited Outlook spoofing flaw (CVE-2026-124194, CVSS 6.5). Opening a crafted message file can make Outlook connect to an attacker-controlled location without the external-content warning, disclosing the user's NTLMv2 hash; Preview Pane is not a vector. Microsoft marks it "Exploitation Detected". Fixed in the 10 November 2026 Office updates. MSRC; Office security release notes
  • Chrome zero-day CVE-2026-125350 (use-after-free in XML), exploited in the wild. Eighth exploited Chrome zero-day of 2026. Fixed: 157.0.8103.50/.51 (Windows, macOS) and 157.0.8103.50 (Linux). Chrome Releases; BleepingComputer
  • SAP Security Patch Day (10 November 2026): four CVSS 10.0 flaws, unauthenticated. Three in NetWeaver AS (ICM, SAML 2.0 service provider, Gateway) and one in Web Dispatcher (CVE-2026-89126, SAP Note 3778556). SAP; The Hacker News
  • France attributes refrigeration sabotage to Iran (10 November 2026). Night of 11 to 12 October; controls at more than 700 retail sites; fires and food losses worth tens of millions of euros; attributed to Shahid Kaveh, an IRGC-affiliated offensive cyber unit. Ambassador to be summoned; further EU sanctions proposed; C4 joint technical report published. France Diplomatie; CERT-FR report (French); The Record
  • Turla's Cereal toolset on government Exchange servers (ESET, 10 November 2026). Seen in Kazakhstan and Romania in late 2025; in-memory .NET components inside Exchange processes; uses the victim server for C2. ESET WeLiveSecurity
  • AhsayCBS zero-day chain used to deploy Python implant (Huntress via The Hacker News). CVE-2026-105133 and CVE-2026-105134 chained for auth bypass and command execution; patched mid-October 2026; web shells, two miners, tunnelling tools and a sandbox-evading Python implant on backup servers. Intrusions ran 8 to 11 October, before the hotfixes; implant family not identified. Fixed: hotfixes 10.3.4.45 (v10) and 9.15.2.70 (v7 to v9). Huntress; The Hacker News
  • Check Point links three China-nexus campaigns through the Sparrow ecosystem. SilentDelivery, OceanGate and DarkWire clusters; CopperDragon described as a possible developer and supplier (Check Point assessment); users include FamousSparrow, Earth Estries, Tropic Trooper and UAT-9244; activity in 21 countries. Check Point; The Hacker News
  • iOS sandbox escape "worse_query" published; no fix confirmed. Lets an app read other apps' files on iOS 26 and 27; PoC public on GitHub (8 November); SlowMist and Binance warn wallet seed phrases and keys could be exposed; no reported attacks. Patch status disputed: the developer says iOS 27.2.1 does not fix it, SlowMist and Rabby say it does; Apple has not commented. Requires an App Group container, which sideloading tools set up. The Hacker News; Cointelegraph; CyberInsider

Australian focus

  • Government proposes AI safety regulator (10 November 2026). Mandatory obligations for frontier AI companies via forthcoming Australian AI Standards legislation: security controls across development and deployment, serious-risk management, rapid incident notification, independent model evaluation, published safety and security frameworks, and responding to updated standards. Regulator to work with the Australian AI Safety Institute; significant penalties promised, but no figures or start date. Rapid Review into the OpenAI agent incident: 18 recommendations, all accepted. Home Affairs stocktake of government systems due by March 2027. iTnews; Press conference transcript; Computer Weekly

AI security

  • Fireworks AI breach widens (update 9 November 2026). Beyond secrets from evaluation jobs: account and billing information, and for a limited set of accounts secrets, datasets and incomplete model weights. Second wave on 24 October via a third-party cloud provider hosting R&D machines. Linked to a financially motivated LLMjacking group. Payment card numbers not stored; no impact detected to Inference, Training SDK or Nexus; self-serve dataset uploads and downloads disabled for batch and dataset-based training. Fireworks AI; The Register
  • DeepMind's AlphaProof Code formally verifies Signal protocol implementation (10 November 2026). Human-specified, human-reviewed security properties; Gemini-powered agents generated more than six million lines of Lean proofs, with about 1% flagged for human review; four weeks; first formal verification of a widely deployed protocol's implementation by any method, per DeepMind; reintroduced two previously fixed bugs and proved the buggy versions insecure; artefacts being open-sourced. A proof covers only the specified properties. Google DeepMind

Industry and research

  • Carmaker app exposed identity-server admin credentials. ForgeRock OpenIDM admin credentials in an Android app allowed account takeover and remote unlock and start of connected vehicles from a number plate; credentials were scoped to staging but worked in production; the Australian site was easier to exploit owing to a weaker WAF; the unnamed carmaker sells two brands in Australia; fixed within hours. iTnews

Outlook and patch priorities

  • Critical: N-central on-premises offline until cleared; Xen Orchestra 6.9.1 or 6.10.0 plus host checks and secret rotation.
  • High: Outlook November update (block outbound SMB, restrict NTLM); Chrome 157.0.8103.50/.51; SAP Web Dispatcher and NetWeaver notes; AhsayCBS hotfix 10.3.4.45 or 9.15.2.70 and shell hunt.
  • Watch: N-able hotfix and scanning against N-central; EU response to the France attribution.