Category: Cyber-Physical Security

Cybersecurity firm Huntress is warning of a worm-like attack campaign that uses modified ScreenConnect remote-support clients to automatically spread malicious payloads from one compromised endpoint to others.

Social Engineering as the Entry Point

The attacks, which Huntress says began in late August, start when a threat actor tricks a victim into installing a rogue ScreenConnect client, often by posing as tech support. In one observed case from Aug. 20, an attacker convinced a victim to open Windows’ built-in Quick Assist remote-support tool, using that access to gain control of the machine before executing a chain of VBScript files.

How the Worm-Like Propagation Works

Once installed, the backdoored ScreenConnect client spawns repeated Windows Script Host processes to deploy a set of VBScript files that perform system reconnaissance, stage additional payloads, and launch a PowerShell script. That script in turn runs a second PowerShell payload that erases evidence of the staging process, attempts to bypass User Account Control, and quietly installs a concealed ScreenConnect client of its own. That hidden client then continuously watches for new host connections, propagating the same multi-stage script chain to every other ScreenConnect endpoint it can reach, which is what gives the campaign its worm-like behavior. Huntress also observed the attackers establishing persistence through a Windows Run registry key and installing the legitimate remote-desktop tool UltraViewer for continued access.

Huntress says it has observed the identical files and attack sequence across multiple, separate organizations, including a second environment compromised the same day as the initial Aug. 20 incident, and again in a further attack on Aug. 24 that also began with social engineering.

Vendor Guidance

Huntress says it has been in contact with ScreenConnect maker ConnectWise about the activity and, based on its current understanding of the risk, is advising administrators to apply extra scrutiny to any on-premises ScreenConnect installations in their environment, including monitoring for unexpected outbound connections and unfamiliar scheduled tasks or registry run-key entries tied to the software.

IT management software vendor N-able has released an urgent hotfix for a critical, actively targeted vulnerability in its N-central endpoint management platform that could allow unauthenticated remote code execution.

A Zero-Day Uncovered While Patching Other Flaws

The vulnerability, tracked as CVE-2026-86218 and rated a maximum CVSS score of 10, was discovered after N-able patched two related issues in N-central, CVE-2026-86206 and CVE-2026-86207. N-able says the newly disclosed flaw “could allow pre-authenticated access to the N-central server if exploited,” and that the fix, delivered as the 2026.3 HF4 hotfix, supersedes the earlier patches.

Customers on N-able’s hosted N-central environments do not need to take action, since the vendor deployed the fix server-side. Organizations running on-premises N-central instances are urged to apply the hotfix immediately.

Signs of Active Scanning and Possible Exploitation

N-able says it has observed scanning activity targeting the vulnerability originating from the IP range 23.234.64.0/18 and is advising administrators to review logs for connections from that range, as well as to check for any newly created user accounts they do not recognize. The company says it currently has no confirmation the flaw has been exploited in production environments, but that unpatched systems remain at risk.

Cybersecurity firm Huntress, which had already flagged the two earlier N-central bugs as potentially chained together in the wild to bypass authentication, said it observed attacks targeting N-central’s underlying API and appliance logs beginning Sept. 4. Huntress noted that limited historical logging on the appliance makes it difficult to confirm with certainty which specific vulnerability an attacker used to achieve a given compromise, or to rule out the use of other flaws entirely.

Online mathematics platform Mathspace has disclosed a data breach affecting more than 1 million students, teachers, staff and parents or guardians, after hackers exploited a known vulnerability the company was slow to patch.

A Known Flaw, Patched Too Late

Mathspace says the breach traces back to its self-hosted Metabase analytics instance, which was compromised using CVE-2026-72898, a maximum-severity SQL injection vulnerability that Metabase had already patched on Aug. 6 after it was exploited in the wild as a zero-day. The extortion group ShinyHunters claimed responsibility for hacking Metabase shortly after that patch was released.

According to Mathspace’s incident notice, unauthorized access began on Aug. 10, and data was downloaded from its Australian reporting database on Aug. 27. The company did not escalate Metabase’s critical advisory internally and did not upgrade its instance until Aug. 29, more than two weeks after the patch became available, and it also failed to complete the compromise checks Metabase had recommended, which meant the intrusion went undetected when the update was finally applied.

What Was Exposed

The breach affects 1,079,819 students, teachers, staff and parents or guardians in Australia and New Zealand. Exposed data includes names, user IDs, usernames, email addresses, email verification status, time zone, country, date joined, and last login and account-active dates. Mathspace says no academic records, learning activity, assessment results, password hashes, authentication tokens or API credentials were exposed, and the leaked data does not link user accounts to specific schools.

Response and Warning to Users

Mathspace has taken the affected Metabase instance offline, revoked API keys, disabled the associated database accounts, reset passwords and exported logs for investigation. The company says it is reviewing why the original security advisory was not escalated and why recommended compromise checks were skipped, and is changing its internal processes as a result. Mathspace has reported the incident to Australian authorities and began notifying affected individuals over the weekend, warning that the stolen contact information could be used to craft convincing phishing messages referencing accurate details of the incident.

Hewlett Packard Enterprise has released patches addressing more than 150 vulnerabilities in ArubaOS-CX (AOS-CX), the operating system used across its Aruba Networking enterprise switch line, including a group of critical-severity remote-code-execution flaws.

A Critical Flaw Affecting Unauthenticated Attackers

According to HPE’s advisory, nearly two dozen individual issues are tracked collectively under CVE-2026-73749, which carries a CVSS score of 9.8. The flaws stem from improper processing of malformed input sent to an unnamed service within AOS-CX, HPE’s database-centric switch operating system. HPE says an unauthenticated attacker could exploit the defects by sending specially crafted packets to the vulnerable service, achieving remote code execution with elevated privileges.

The updates, released for AOS-CX versions 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190 and 10.10.1181, also resolve 22 high-severity vulnerabilities that could enable denial-of-service conditions, additional remote code execution, arbitrary command execution, cross-site scripting, authentication bypass, privilege escalation and information disclosure. Eleven remaining medium-severity issues cover access-control bypass, information disclosure, arbitrary file reads, denial-of-service and privilege escalation.

No Known Exploitation, but Broad Exposure

HPE says the majority of the vulnerabilities were found internally by its own security team and that it is not aware of any of them being exploited in the wild. As an interim mitigation, the company recommends restricting AOS-CX command-line and web-based management interfaces to a dedicated Layer 2 segment or VLAN, controlling access with firewall policies at Layer 3 and above, and maintaining accounting controls to track and log user activity and resource usage.

Because AOS-CX switches sit at the network layer beneath cameras, access-control panels and other connected security devices in many enterprise deployments, unpatched management-interface exposure on this class of device can translate into risk for physical security systems that depend on the same network fabric, underscoring why prompt patching of core switching infrastructure matters beyond the IT network itself.

Threat actors are actively exploiting a zero-day vulnerability in Adobe Commerce and Magento to plant backdoors on online stores, according to research from cybersecurity firm Sansec. The flaw, which Sansec has named StyleSmuggler, affects Magento versions 2.4.7, 2.4.8 and 2.4.9, including stores already running the July and August 2026 security patches.

How the Attack Works

StyleSmuggler lets attackers inject PHP code into Magento’s template system by abusing the platform’s “styles” properties, evading detection in the process. Sansec describes a two-stage attack: the malicious code is first injected by generating a payment failure report, and Magento then executes that code when it sends out its standard “Payment Transaction Failed Reminder” email. No user interaction is required for the exploit to succeed.

Once triggered, the exploit deploys a backdoor written in Rust that connects to a command-and-control server and waits for further instructions. Sansec says the malware disguises its C&C communication as NTP server replies and transmits host information, including an agent ID, hostname, username, memory and disk usage, operating system version, uptime, root-access status and the implant’s version, along with the store’s public IP address.

Timeline and Detection

Sansec says it first found the campaign on Sept. 4 at 22:40 UTC and reproduced the exploit chain on clean installations within hours. The initial backdoor disguised itself as a process named “kworker/u:8:0”; a second variant that emerged on Sept. 6 disguises itself as “fc-cache.”

Because the exploit abuses a legitimate Magento email notification, Sansec recommends store operators watch for unexpected bursts of payment-failure reminder emails as a detection signal, while cautioning that legitimate declined payments can trigger the same notification. Adobe was expected to ship its regular monthly Patch Tuesday updates on Sept. 8, but as of this writing it was unclear whether that release would address StyleSmuggler specifically.

A security researcher who goes by the handle Nightmare Eclipse, also known as Chaotic Eclipse, Infinite Nightmare and MSNightmare, published three new zero-day proof-of-concept exploits within a single week, targeting security and driver software from Avast, CrowdStrike and Nvidia.

Three Exploits, Three Vendors

The first, dubbed PrettyPrague, targets the sandbox used by Avast Antivirus to spawn a shell with full system privileges, and the researcher says it may also affect other GenDigital products, including AVG and Norton. A GenDigital spokesperson told SecurityWeek the company was made aware of the issue, initiated its security response procedures, and has fixed it.

The second, FalconFlank, exploits a bug in the Office malicious-macro remediation feature of CrowdStrike Falcon Sensor to escalate privileges. CrowdStrike said it is actively investigating the claims and has advised customers to disable a related Windows policy setting while pointing to guidance in its support portal.

The third, GreenSection, targets an out-of-bounds memory write affecting a shared global memory section used by multiple Nvidia user-mode display driver components on Windows. Nvidia said it is reviewing the reported behavior through its established security processes.

Part of a Broader Pattern

Nightmare Eclipse became known for a series of zero-day exploits targeting Microsoft products before expanding to other vendors. In late August, the researcher released a separate privilege-escalation zero-day affecting a Kaspersky endpoint security product, which Kaspersky patched on Aug. 31. Independent security researcher Kevin Beaumont said he had confirmed that the Avast, CrowdStrike and Kaspersky exploits work as described.

None of the three latest exploits are confirmed to grant SYSTEM-level access on their own; each requires local code execution as a starting point and functions as a privilege-escalation primitive rather than a full remote compromise chain. All three vendors said they are investigating or have already issued fixes.