[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:4everable2shell-n-central-hotfix-2-servers-taken-to-root":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"4everable2shell-n-central-hotfix-2-servers-taken-to-root","rapid-alert","4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped","A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002F4everable2shell-n-central-hotfix-2-servers-taken-to-root-68758f4e-cover.png","N-central HF2 rapid alert: Patched N-central to Hotfix 2? Root on the box running your clients.","Marcus Lenngren","2026-11-13T08:52:08.367+00:00","![N-central HF2 rapid alert: Patched N-central to Hotfix 2? Root on the box running your clients.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002F4everable2shell-n-central-hotfix-2-servers-taken-to-root-68758f4e-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nOn 12 November, security researcher Sean Bales published proof-of-concept exploits for two new N-able N-central issues, named 4EverAble2Shell and Agent2Shell. They work against the latest emergency build, 2026.4 HF2 (build 2026.4.1.26), which N-able shipped on 10 November to fix an earlier set of flaws.\n\n4EverAble2Shell gives an unauthenticated attacker root-level command execution on an N-central server. It chains an Apache Axis vulnerability, CVE-2026-90436 (CVSS 9.8), with a separate N-central privilege escalation weakness. Exploitation requires the platform's Legacy API to be enabled, which is not the default.\n\nWithin hours of the PoC landing, attackers were running the full chain against production servers. Huntback and Lupovis confirmed 21 compromised N-central servers, 19 of them running Hotfix 2. The payload seen so far is an XMRig Monero miner, but N-central manages customer endpoints, so a hit means an attacker has root on the box that runs your clients.\n\n## Timeline\n\n- 10 Nov: N-able releases 2026.4 HF2.\n- 12 Nov: Bales publishes 4EverAble2Shell and Agent2Shell PoC code.\n- 12 Nov, about 08:30 UTC: probes hit Previdian and Huntback honeypots from the same attacker IP.\n- 12 Nov, 09:16 UTC: first full exploit chain run against decoys.\n- 12 Nov, 12:50 UTC: researchers count 21 active miners, all with recent mining shares.\n- 13 Nov: N-able reports additional indicators of compromise and restricts features.\n\n## Am I affected?\n\nYou are exposed if you run on-premises N-central and have the Legacy API enabled and reachable from the internet. Running Hotfix 2 does not protect you: 19 of the 21 compromised servers were on HF2.\n\nHosted N-central customers: N-able says it has applied the new protections to hosted environments and disabled the Intune integration. Follow N-able status updates.\n\nAgent2Shell targets communication between N-central servers and Windows Agents and Probes, and can reach SYSTEM on managed devices. IP allowlisting alone may not help because those interfaces also handle normal Agent and Probe traffic.\n\n## What to do now\n\n1. Confirm the Legacy API is disabled. It is off by default. If it is on, disable it.\n2. Take on-premises N-central servers offline or remove internet access, as Huntback and Huntress advise, even after installing HF2.\n3. Block inbound access to the exposed interfaces at the perimeter. Do not rely on IP allowlisting alone.\n4. Treat any confirmed hit as a full compromise, not a cleanup job. Rotate credentials and secrets held by the appliance and review managed customer environments.\n5. Continue upgrading Agents and Probes under the earlier Hotfix 2 guidance, but do not treat HF2 as a fix for these new flaws.\n6. Watch N-able advisories for the next hotfix. No patch for 4EverAble2Shell existed at publication time.\n\n## How to hunt\n\nOn the N-central server, review logs for unusual requests to \u002Fdms\u002Fservices\u002FServerUI and \u002Fdms2\u002Fservices2\u002FServerMMS2, especially messages using a session ID of -1.\n\nLook for the known attack infrastructure: payloads downloaded from and output sent to 157.20.241[.]16.\n\nCheck for unexpected script backup files and a suspicious symbolic link involving flag_default.json. The chain abuses the privileged setLDFileOwner helper and a symlink to make a root-owned script writable, then restores the files afterwards.\n\nLook for an XMRig miner, often using about half the available CPU cores and running with systemd or cron persistence. Miner identifiers begin with nc_ followed by the server IP.\n\nOn Windows devices, examine unexpected encoded PowerShell launched by N-able components, changes to Windows Software Probe files, and unexplained service restarts. Normal support work can look similar, so check context. Review activity from 11 November onward.\n\n## What does not help\n\nInstalling Hotfix 2 alone does not protect you: most compromised servers were on HF2. IP allowlisting alone may not be enough, because the affected interfaces also carry legitimate Agent and Probe connections.\n\n## Sources\n\n- [New N-able \"4EverAble2Shell\" zero-day exploited hours after PoC released](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released\u002F), BleepingComputer, 12 Nov\n- [Hackers Exploit New N-central Zero-Day Hours After PoC Publication](https:\u002F\u002Fwww.securityweek.com\u002Fhackers-exploit-new-n-central-zero-day-hours-after-poc-publication\u002F), SecurityWeek, 13 Nov\n- [New N-able N-central Zero-Day Exploits Target Patched Servers, Claiming Unauthenticated Root Access](https:\u002F\u002Fcybersecuritynews.com\u002Fn-able-n-central-zero-day-exploits\u002F), Cyber Security News, 12 Nov\n- [New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access](https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fnew-n-central-exploits-work-against.html), The Hacker News, 12 Nov\n- [Hackers Target N-central Zero-Days as N-able Rushes Patches](https:\u002F\u002Fwww.securityweek.com\u002Fhackers-target-n-central-zero-days-as-n-able-rushes-patches\u002F), SecurityWeek, 12 Nov\n- [Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2](https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fhackers-exploit-n-central-flaws-to.html), The Hacker News, 13 Nov\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,36,43],{"slug":30,"kind":6,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":11,"published_at":35,"reading_minutes":18},"check-point-gaia-under-attack-php2shell-chained-to-root-for","Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now","Attackers are chaining PHP2Shell (CVE-2026-109618\u002F9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcheck-point-gaia-under-attack-php2shell-chained-to-root-for-05b9bf1d-cover.png","Check Point Gaia rapid alert: Mobile Access portal exposed? One chain and your ESXi is wiped.","2026-11-13T11:18:49.874+00:00",{"slug":37,"kind":6,"title":38,"excerpt":39,"cover_image_url":40,"cover_image_alt":41,"author_name":11,"published_at":42,"reading_minutes":18},"citrus-ransomware-abuses-group-policy-to-push-sn00py-and","Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains","Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcitrus-ransomware-abuses-group-policy-to-push-sn00py-and-fb0efdd6-cover.png","Citrus Ransomware rapid alert: Your DC pushes GPOs to everyone? One policy kills Defender domain-wide.","2026-11-12T08:02:16.435+00:00",{"slug":44,"kind":6,"title":45,"excerpt":46,"cover_image_url":47,"cover_image_alt":48,"author_name":11,"published_at":49,"reading_minutes":18},"sparrow-framework-china-linked-clusters-use-fake-chrome-cert","Sparrow framework: China-linked clusters use fake Chrome cert warnings and Linux footholds","Check Point links three China-nexus espionage clusters through the Sparrow framework, run by a supplier it calls CopperDragon. Watering holes push fake Chrome certificate fixes that install the SquadC backdoor, while Linux servers are used as entry points.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fsparrow-framework-china-linked-clusters-use-fake-chrome-cert-54104957-cover.png","Sparrow \u002F SquadC rapid alert: Got a 'Certificate Fix' prompt? That installer is a backdoor.","2026-11-11T14:07:03.811+00:00"]