N-central Needs Another Emergency Patch, Plus 3 Stories
If you run N-able N-central on your own server, Monday morning has one unpleasant item at the top of the list: install Hotfix 4 now, even if you installed Hotfix 3 over the weekend.
N-central needs another emergency hotfix
N-able released N-central 2026.3 Hotfix 4, build 2026.3.1.14, for CVE-2026-86218, a critical pre-authentication remote-code-execution vulnerability. “Pre-authentication” is the important part: an attacker doesn’t need a valid N-central account before reaching the vulnerable code.
N-central is remote monitoring and management software, or RMM. Managed-service providers and IT departments use it to monitor systems, deploy software and patches, run scripts, and remotely connect to the computers they manage. That’s wonderfully convenient when the person controlling it is your technician. If an attacker gets administrative control of the same console, the convenience works for them too.
This is also the fourth N-central hotfix in about five weeks. Hotfixes 1 and 2 addressed exploited vulnerabilities disclosed in August. Hotfix 3 arrived September 5 for two newly disclosed authentication problems. Hotfix 4 arrived immediately behind it and supersedes Hotfix 3, so being “fully patched” Saturday is not the same thing as being fully patched Monday.
There is one irritating wrinkle in N-able’s own reporting. The Hotfix 4 release notes say the company has “no confirmations” that CVE-2026-86218 has been exploited in production. But a separate N-able incident notice and a company representative quoted by Huntress say the new vulnerability has been observed exploited in the wild. Those statements don’t fit neatly together, and I’m not going to pretend they do.
Huntress began investigating on September 4 after a customer’s fully patched N-central production system was compromised. Its researchers reproduced a separate new exploit chain, but the appliance’s older logs had already rotated, so Huntress cannot prove which of the newly disclosed vulnerabilities the attacker actually used. That distinction matters. We have strong evidence that somebody compromised a current N-central environment; we do not yet have a clean forensic line proving CVE-2026-86218 was the exact door.
The reader action does not depend on resolving that argument. If you self-host N-central, update to 2026.3.1.14, audit recent administrative accounts and permission changes, look for unexpected remote-control or API activity, and restrict the management console behind tight IP allowlists or a VPN instead of leaving it broadly exposed to the internet. Huntress specifically recommends watching for odd account names, including addresses with unexpected .invalid suffixes. If you’re using N-able’s hosted N-central service, N-able says it has already applied the patch and you don’t need to update the server yourself.
Technical discovery & auditing
The public page doesn’t tell you much about the machinery behind it. Raymond Tec audits inherited and long-running projects to uncover the plugins, integrations, data, dependencies, and old decisions that determine what the next change will really involve.
OpenAI says it has built an “automated research intern”
OpenAI says it has reached a milestone that sounds more dramatic than it is — and is still pretty dramatic once you strip the headline down to what the company actually measured.
In a research report published Sunday, OpenAI says its internal agents can now carry out well-defined research tasks under human direction that would take a skilled researcher several days. It calls that an “automated research intern” and says its next target is an automated AI researcher by March 2028.
The company’s research organization is already running a lot of agent labor. By mid-August, OpenAI measured about 3.1 agent-workdays of runtime for every human workday. The median researcher was using more than $600 per day of coding-agent inference at API prices, while its heaviest users exceeded $7,000 per day.
Before we turn 3.1 into “AI is doing three times as much research as humans,” it isn’t that measurement. Runtime is easy to count; equivalent useful research output is much harder. OpenAI says high-level planning remains a minimal fraction of agent activity, people still choose research priorities and decide what results matter, and more than half of successful tasks estimated at four to eight hours still required at least one human intervention.
What has changed is the amount and horizon of work people can hand off. Agents are writing research code, troubleshooting infrastructure, monitoring experiments and handling increasingly long tasks while researchers run several of them at once. That matters outside OpenAI because the technology is now helping build the next generation of the technology. Faster AI-assisted research can shorten the loop between an idea, an experiment and the next model.
OpenAI is unusually explicit about the uncomfortable side of that. The company says it does not know how to safely reach fully aligned recursive self-improvement — the point where AI meaningfully accelerates the process of improving AI — and says it paused some reinforcement-learning work after agents compromised its research infrastructure in July. So I wouldn’t read “research intern” as a product announcement or a claim that human scientists are obsolete. I would read it as evidence that AI development itself is becoming one of the first jobs materially accelerated by capable agents. That’s a much bigger story.
Turning on AI is the easy part
Deciding what an AI tool should be allowed to see, who should use it, what work it should perform, and what happens when it gets something wrong is the more interesting problem. Raymond Tec helps businesses connect and automate the tools they actually use without treating every new feature like a button that obviously needs to be switched on.
A $320 million Liquid Network incident did not hack Bitcoin
Around 4,000 bitcoin — roughly $320 million at the time — were withdrawn Sunday from the federation wallet backing the Liquid Network. Liquid halted new transactions, exchanges suspended deposits and withdrawals for its LBTC token, and the network says its wallets will be affected while federation members work through the incident.
The first thing to clear up is the headline problem: Bitcoin itself was not hacked. Liquid is a sidechain built around Bitcoin. Users lock BTC on the Bitcoin network and receive corresponding LBTC on Liquid, where a federation of operators manages the bridge between the two systems. That makes Liquid useful for faster and more private settlement, but it also introduces a separate layer of software, authorization and operational trust around Bitcoin’s base chain.
According to Liquid, the withdrawal went through SideSwap using a permitted Peg-out Authorization Key, or PAK, and that key was not compromised. The Block reports the withdrawal represented about 95% of Liquid’s reported bitcoin reserves. The root vulnerability has not been publicly explained.
The actors left an on-chain message claiming they are white-hat hackers, and Liquid is calling them “purported white hats.” That’s a description of what they claim to be, not independent verification of who they are or whether the funds are coming back. Until the network publishes a root cause and resolution, that’s where the certainty should stop.
If you actually use LBTC or infrastructure that settles through Liquid, follow Liquid and your exchange’s status notices before trying to move funds. If you simply hold ordinary bitcoin on the Bitcoin base network, this incident does not create a special action for you. The useful lesson is the same one we’ve learned from exchanges, wallets and bridges for years: the strongest underlying protocol can still be surrounded by software and operational layers with very different security assumptions.
Technology is rarely just about the technology
Some of the most important technology stories aren’t product launches at all. They’re about health, privacy, education, law, accessibility, work, and what happens when technology reaches ordinary people. Browse more Raymond Tec News for the stories worth understanding without the hype.
AI is helping pilots avoid the contrails that warm the atmosphere
I’ll finish with AI doing something refreshingly concrete.
Google and Cathay Pacific are expanding a trial that predicts where persistent aircraft contrails are likely to form so pilots can make small altitude adjustments to avoid those regions. Contrails form when hot aircraft exhaust meets very cold, humid air. Some disappear quickly; persistent ones can spread into thin cloud layers that trap outgoing heat.
The first Cathay phase covered more than 80 flights and produced an estimated 40% reduction in contrail warming impact, according to the companies. The next phase will expand across Cathay’s Asian and trans-Pacific network, including ultra-long-haul routes. Google previously tested similar forecasting at larger scale with American Airlines.
This isn’t AI magically making jet fuel clean, and the 40% figure is an estimate from the companies running the trial, not a universal reduction in an airline’s total emissions. But it is a useful example of machine learning finding a narrow problem where better forecasting can change a real operational decision with today’s airplanes and today’s fuel. No chatbot required.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources / Further Reading
- N-able: N-central 2026.3 Hotfix 4 — CVE-2026-86218
- Huntress: Critical N-able N-central vulnerability and exploitation investigation
- OpenAI: Research acceleration — the view inside OpenAI
- Reuters: Liquid Network says $320 million withdrawn in hack
- The Block: Liquid Network pauses after roughly 4,000 BTC leave federation wallet
- Google Research: Cathay Pacific contrail-avoidance trial
- Reuters: Cathay Pacific and Google expand AI contrail trials
