ScreenConnect Attack Spreads, Plus 3 Tech Stories
A ScreenConnect attack is spreading trusted remote access into customer computers, N-central finally has the hotfix yesterday’s shutdown was waiting for, and a breach at an AI provider exposed some Notion conversations. The common thread is uncomfortable but useful: the tool you trust to reach everything is also the tool an attacker wants to reach first.
ScreenConnect attackers used remote support to reach customer devices
ConnectWise and Huntress are investigating an active campaign in which attackers used ScreenConnect environments to install a second, attacker-controlled ScreenConnect client on managed computers. Huntress says it has seen at least 288 affected endpoints across 48 organizations. That number covers Huntress customers, not the full campaign.
The attack appears to involve RMM+, an independently developed ScreenConnect extension that lets other software issue remote-management commands through an API. Huntress found that versions 1.0.31 and 1.0.32 could accept a blank access key if an administrator had never configured one. The attackers could then use ScreenConnect’s legitimate Run Command function without a normal ScreenConnect login showing up in the logs.
That’s an important distinction. ConnectWise says it has found no evidence that its own infrastructure was compromised or that ScreenConnect itself has a new vulnerability. The current assessment points toward abuse of third-party extensions, but the initial access method and full scope are still under investigation. About 400 partner environments had one of five related extensions installed. Their presence alone does not mean those environments were breached.
Once inside, the attacker installed a toolkit Huntress calls SCKit. It created persistent remote access and attempted to trap session cookies when technicians connected to infected machines. That second-stage spreading technique sounds terrible, because it is. There is also a useful qualification: Huntress says the takeover attempt failed in every recovered host log it reviewed. The rogue clients and initial access were real; successful worm-like spreading through technician sessions has not been established.
ConnectWise disabled Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link in hosted environments. On-premises operators must disable them themselves and should not reinstall them yet. Investigate suspected devices using separate security tools, not an interactive ScreenConnect session. Preserve authentication, extension, Run Command, Toolbox, and administrative records. Then revoke sessions, reset credentials from a trusted device, and confirm multifactor authentication.
If your business receives remote support rather than operating ScreenConnect, don’t start deleting agents at random. Ask the provider whether it uses ScreenConnect, whether any named extension was present, and whether it reviewed command history and unexpected remote-access installations. The point is to verify the trust path, not break legitimate support while guessing.
The boring machines need attention too
Browsers, workstations, remote-access tools, Wi-Fi, and ordinary office hardware rarely get much attention until one of them becomes the problem. Raymond Tec provides onsite IT and field services around Reading, Pennsylvania, along with practical help keeping the technology people use every day working and reasonably secure.
N-central HF2 is ready, but the upgrade order matters
Tuesday’s brief said N-central servers needed to remain offline while N-able finished a fix for the publicly disclosed Able2Shell vulnerabilities. That guidance has changed because the fix now exists.
N-able has released N-central 2026.4 Hotfix 2, build 2026.4.1.26. Hosted servers have been upgraded and are back online. On-premises servers should remain inaccessible from the internet until the update finishes successfully. Seven CVEs are now attached to the release, including flaws involving XML external entities, injection, privilege escalation, server-side requests, cross-site scripting, and file-upload path traversal.
The server isn’t the whole job. Hosted and on-premises customers must update Agents and Probes, preferably Agents first and Probes second. An upgraded Probe can’t communicate through the new method with an old Agent or Patch Management Engine, which can disable features such as the offline patch cache until versions match. Built-in remote control is temporarily disabled, although Take Control remains available. In other words, the emergency patch has a rollout plan. Read it before clicking buttons in alphabetical order.
Business IT goes well beyond the website
Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.
Notion AI transcripts show why “unattributable” isn’t harmless
Notion says a security incident at AI infrastructure provider Fireworks affected fewer than 1% of Notion workspaces. The exposed data included chat transcripts used by Notion’s Insights feature. For most affected workspaces, the transcripts weren’t labeled with a user, workspace, or company, and they didn’t include tool-call results.
That sounds reassuring until we ask the obvious question: what did people type into the conversation itself? On November 11, Notion said it revoked exposed Notion API keys found inside affected users’ messages. A transcript doesn’t need a neat account label if its contents include a credential, customer name, contract detail, or enough context to identify the business.
Notion disconnected Fireworks on November 3, contacted affected customers, and says no other Notion features were affected. If Notion hasn’t contacted your workspace, it says no action is needed right now. If it has, retrieve the exposed data, review what was actually in it, and rotate every pasted password, API key, or other credential.
For businesses adopting AI, “don’t paste secrets into chat” is good advice and an incomplete control. Decide which data employees may submit, restrict access to approved tools, and ask vendors which outside inference, analytics, and storage providers touch the prompts. A zero-data-retention option can reduce exposure for some workloads. It doesn’t retroactively protect a feature designed to retain and analyze conversation data.
Turning on AI is the easy part
Deciding what an AI tool should be allowed to see, who should use it, what work it should perform, and what happens when it gets something wrong is the more interesting problem. Raymond Tec helps businesses connect and automate the tools they actually use without treating every new feature like a button that obviously needs to be switched on.
Europe proposes a cleaner way out of digital subscriptions
The European Commission has proposed a Digital Fairness Act aimed at the online practices people regularly recognize as manipulative even when the legal language gets complicated. The list includes obstructive cancellations, automatic renewals, free trials that quietly become paid plans, dark patterns, addictive design, pressure to overspend, unfair personalization, influencer advertising, obscure dynamic pricing, and customer-service systems that make reaching a person nearly impossible.
This is not law yet. The November 11 proposal still has to move through the European Parliament and EU member governments, so there is no new compliance deadline today. The direction is still worth noticing, especially for subscription and ecommerce businesses that sell to Europeans.
I think the useful test is simpler than waiting for every article number to settle: can a customer understand the price, refuse the personalization, stop the renewal, and leave without navigating a maze built specifically to wear them down? Friction that prevents an accidental cancellation may be defensible. Friction whose business purpose is to turn resignation into revenue is exactly what regulators are targeting. No immediate rebuild is required, but businesses should know which category their own workflow falls into.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources / Further Reading
- ConnectWise Trust Center: ScreenConnect investigation and partner guidance
- Huntress: SCKit technical report and response guidance
- BleepingComputer: active ScreenConnect campaign reporting
- N-able: N-central HF2 response update
- N-able: N-central 2026.4 HF2 release notes
- Notion: Fireworks AI incident advisory
- Fireworks AI: October incident update
- European Commission: Digital Fairness Act proposal and documents
Photo by Christina Morillo on Pexels.
