U51

Episodes

Episode 29

All episodes
Episode 2911:37

Episode 29: Hijacked GitHub accounts plant a CI secret stealer, ScreenConnect panels push rogue clients and new N-central exploits beat the hotfix, 13 November 2026

SpotifyApple PodcastsPocket Casts

An attacker used 4,837 hijacked GitHub accounts to plant a CI secret stealer that ran in at least 1,835 repositories, and attackers with access to cloud-hosted ScreenConnect panels pushed rogue clients to at least 288 endpoints across 48 organisations. New N-central exploit chains work against this week's hotfix where the Legacy API is exposed, and the Bookeasy booking breach now affects national parks customers in Queensland, Victoria and South Australia.

Global threats

  • Hijacked GitHub accounts plant CI secret stealer (from 10 November 2026). Aikido: 4,837 accounts, test pull requests in 61,764 repositories, stealer ran in at least 1,835 and credentials exfiltrated (an earlier Aikido figure was 1,806); SafeDep: 8,093 public repositories received malicious commits (7,309 workflow edits, 771 npm postinstall hooks). Steals Actions secrets, GITHUB_TOKEN, OIDC tokens, cloud and AI keys; exchanges OIDC for AWS/GCP/Azure sessions; persistence via AWS role trust policy rewrite and Entra federated credentials named wfx-ci-*. Overlaps with October GhostAction accounts; not attributed to the same actor. Indicators: PR title docs: dependency audit notes; branches wfx-docs, chore/[a-z0-9]{8}, ci-check-[0-9]{4}; commits ci: refresh build cache, chore: add ci helper, chore: add dependency audit workflow, ci: restore, ci: cleanup; stealer SHA-256 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf; exfil 194.150.166[.]244:8080, 18.143.168[.]96:8080, 153.75.82[.]159:8080, plus Telegram. Malicious packages: Packagist digitalelvis/neuronai-studio 3.14.3 (pin 3.14.2 or earlier); Go github.com/onuragtas/docker-env v1.0.278 and v1.0.280 (workflow file only); github.com/vkuznet/gocurl v0.0.0-20261111095532-8d5aad0cb0da. Aikido; SafeDep; The Hacker News
  • ScreenConnect panels used to push rogue clients and SCKit (first detected 11 November 2026, 17:47 UTC). Huntress: at least 288 endpoints across 48 organisations that use Huntress (a floor); Huntress update (11 November, 11:34pm ET) links access to the third-party RMM+ extension, versions 1.0.31 and 1.0.32, which accepted a blank access key when none was configured, bypassing ScreenConnect accounts, roles and MFA; payload designed to spread endpoint to technician to panel (onward spread not yet observed). ConnectWise disabled Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link extensions; no evidence of ConnectWise infrastructure compromise or a flaw in ScreenConnect; ConnectWise had not confirmed an initial access vector. Blackpoint: SCKit attempts a Guest-to-Host technique associated with the already patched CVE-2026-84869 (CVSS 9.9); in its lab test a current Host client did not request or run the payload. Indicators (ConnectWise): 185.99.255[.]28, 155.94.150[.]39, ns[.]mo7sen[.]dev, sc[.]payproofkit[.]com, cdn007-digitaldownloads[.]com, newnewnew[.]gotdns[.]org, Soxnewwork[.]homedns[.]org; artefacts sckit-run.bat, sckit-decoder.ps1, TrapWatch.ps1, Panel-Lateral.ps1, Run-Lateral-Full.bat, ToolboxRelayUploader.exe. ConnectWise advisories; Huntress; Blackpoint Cyber; Sophos; The Hacker News
  • N-central: 4EverAble2Shell and Agent2Shell exploits work against 2026.4 Hotfix 2 (12 November 2026). Researcher claims unauthenticated root RCE on the server (4EverAble2Shell, documented by Previdian against build 2026.4.1.26) and SYSTEM command execution on Windows agents (Agent2Shell, needs the appliance ID; not independently verified). Previdian notes the full affected range and a fixed build are unverified. Affected: on-premises N-central 2026.4.1 HF2 (build 2026.4.1.26) with Legacy API enabled and internet-exposed; hosted not affected. Disable Legacy API. Previdian recorded 2 exploitation attempts from 1 IP (157.20.241[.]16) on 12 November, chaining Apache Axis CVE-2026-90436; attempts only, no successful exploitation reported. N-able advisory wording via The Hacker News. N-able status; Previdian; The Hacker News
  • Red Hat Quay key-server flaw (CVE-2026-123710, CVSS 9.8) and robot token leak (CVE-2026-110697, CVSS 9.9). All Quay 3 and Quay 5 versions listed as affected; fixed builds for eight Quay 3 branches; Quay.io fixed. Block /keys at the proxy, audit service_key_rotate and service_key_delete events with null expiry, remove unknown keys, then update. Red Hat CVE-2026-123710; Red Hat CVE-2026-110697; Red Hat remediation
  • Apache HTTP Server mod_http2 RCE (CVE-2026-119618, CVSS 9.8). Affected: 2.4.55 to 2.4.70 with HTTP/2 enabled; standalone mod_h2 2.0.8 to 2.0.42 (no fixed release). Fixed: 2.4.71; RHEL 9 mod_http2-2.0.26-7.el9_9.1; RHEL 10 mod_http2-2.0.29-5.el10_3.1; RHEL 8 and earlier not affected. Red Hat rates RHEL 9 and 10 Important, not Critical (per-stream allocator makes exploitation harder). Reported by Anthropic's OSS Scanner (26 October) and independently by Google Cloud Vulnerability Research (3 November). Exploit status disputed (Red Hat cites a reliable public exploit; Wiz says none available, no in-the-wild exploitation). Workaround: Protocols http/1.1. Apache advisory; Red Hat; Wiz
  • Citrix patches 12 NetScaler and Secure Access Client flaws. Ten memory flaws in ADC and Gateway (CVSS 9.3 to 9.5, DoS); NetScaler Console authentication bypass CVE-2026-120869 (CVSS 9.4); Secure Access Client privilege escalation CVE-2026-118268 and CVE-2026-118269 (CVSS 8.5). No known exploits. Fixed: ADC and Gateway 14.1-73.57, 13.1-64.39; 14.1-FIPS 14.1-73.58; 13.1-FIPS and 13.1-NDcPP 13.1-37.293; Console 14.1-74.34; Secure Access Client for Windows 26.11.1.6, for Linux 26.10.4 (all "and later"). Citrix security updates; The Hacker News
  • SignDrop: unpatched Windows CLFS local privilege escalation PoC (published 10 November 2026). Abuses CLFS log authentication companion-file creation via Defender; tested on Windows 11 26H2 and Windows Server 2025 Experimental; no CVE, fix or reported exploitation; one independent test found it works but is unreliable. Check HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication Mode (0 or 1 in claimed scope); do not disable the mitigation. Researcher repository; Microsoft CLFS authentication; The Hacker News

Australian focus

  • Bookeasy breach reaches national parks bookings in Queensland, Victoria and South Australia (12 November 2026). Names, contact details and booking information may have been accessed; no evidence card details were accessed; the Shire of Carnarvon (WA, visitor centre operator) reports an incident involving the same provider; Parks Victoria new bookings suspended. ABC News; 7NEWS; Sydney Morning Herald
  • VCAA: VCE exams go ahead after website hack (12 November 2026). ABC News

AI security

  • TypoPrompting: 186 lookalike domains for 27 AI brands (Island). Routes to ClickFix PowerShell lures, the Microsoft Store-signed Net Guard app with hidden browser control, and 16 search-hijack Chrome extensions (about 972,000 declared users as of 3 November 2026). Island; The Hacker News
  • BluePhishing: consent phishing for Microsoft Entra Agent ID blueprints (Proofpoint, 9 November 2026). Victims approve a malicious agent blueprint, creating an attacker agent identity in their tenant. Microsoft Message Center MC1506733: default Entra users can create agent blueprints by default from November 2026. Proofpoint

Industry and patches

  • Node.js fixes 16 flaws, including HTTP/2 crash CVE-2026-123863 and memory leak CVE-2026-123866. Fixed: 22.23.5, 24.22.3, 26.13.1. The Hacker News
  • MongoDB pre-authentication crash on failover (CVE-2026-118383). Datadog Security Labs reproduced it. The Hacker News
  • PTC Windchill and FlexPLM deserialisation RCE (CVE-2026-126325, CVSS v4 9.2). CVE record lists specific affected releases from 11.0 M030 to 13.1.4.0 for Windchill, and similar for FlexPLM. The Hacker News
  • Google Cloud: AMD Turin TSA side channels (CVE-2024-36350, CVE-2024-36357, CVE-2026-0004). C4D, N4D, H4D, Z4D and G4 VMs need a guest OS patch and a stop and start. The Hacker News

Patch priorities

  • Critical: GitHub organisations (hunt for the stealer and cloud persistence); ScreenConnect partners (Run Command history, extensions, client patch); N-central on-premises (Legacy API off).
  • High: Red Hat Quay; Apache HTTP Server with HTTP/2; NetScaler and NetScaler Console.
  • Watch: Microsoft response to SignDrop; further N-able fix; Bookeasy scope.