N-central Must Stay Offline, Plus 3 Tech Stories
N-able has taken its hosted N-central systems offline worldwide and is telling on-premises customers to keep their own servers offline. That is an unusually disruptive instruction for a remote monitoring and management platform, but the reason is just as unusual: a researcher publicly released technical details and proof-of-concept code for 33 alleged N-central vulnerabilities before the company had a fix ready.
N-central servers need to stay offline for now
N-central is the kind of software managed service providers use to monitor computers, install software, run scripts, and remotely control customer systems. In other words, it isn’t just another dashboard. It is a control plane with trusted access into many other machines. If an attacker can take over the N-central server, the concern isn’t limited to that one server.
The published research, called Able2Shell, describes multiple chains that could lead to remote code execution and, in some cases, root-level control. One reported chain begins without a login. BleepingComputer noted that it had not independently verified all 33 claims, and no CVE numbers had been assigned when this brief was written. N-able’s decision to shut down its hosted service and build a hotfix, however, makes this more than a theoretical list someone tossed onto GitHub.
N-able says it has not seen active exploitation or unauthorized data access. That is important, but it is not the same as proof that exploitation is impossible. Working exploit code is public, the affected software has broad privileges, and the hotfix was still being validated early Tuesday morning. The company’s instruction is clear: hosted customers should expect an outage, and on-premises customers should not bring their N-central servers back online until N-able says it is safe.
There is one easy mistake to avoid here. N-able released N-central 2026.4 HF1 on November 2 for separate operating-system vulnerabilities. That is not the Able2Shell fix. Administrators should preserve logs, review authentication activity from November 8 forward, and follow the live incident page for the fixed build and restoration instructions. Raymond Tec covered a different N-central emergency patch in September, which is another reason to match the fix to the incident instead of assuming the newest-looking update must be the right one.
The boring machines need attention too
Browsers, workstations, remote-access tools, Wi-Fi, and ordinary office hardware rarely get much attention until one of them becomes the problem. Raymond Tec provides onsite IT and field services around Reading, Pennsylvania, along with practical help keeping the technology people use every day working and reasonably secure.
Pennsylvania’s AI advertising law starts December 21
Pennsylvania businesses have a nearer-term compliance question. Act 99 of 2026, the Artificial Intelligence Deceptive Advertising Act, takes effect December 21. It requires a clear and conspicuous disclosure when an advertisement uses AI-generated or significantly AI-modified content in a way that creates a false consumer perception about the nature, origin, or authenticity of a product or service.
The practical question isn’t simply, “Did AI touch this file?” The law is aimed at synthetic content that could mislead someone about what is being sold. If an AI-generated video makes a product appear to do something the real product cannot do, that is a much clearer problem than using an automated tool to remove a speck of dust from a photograph. The disclosure must appear the first time the content is shown, use the same medium as the ad, and remain difficult to remove when that is technically feasible.
The law includes exceptions for content that is obviously fictional, parody, satire, commentary, criticism, or text-only. Enforcement belongs to the attorney general or a district attorney, with civil penalties up to $3,000 plus costs. There is no private lawsuit created by this act and no stated cure period. What counts as a “false consumer perception” will still need interpretation, so a disclosure is not a magic sentence that makes a deceptive ad lawful.
For a small business or agency, the useful move is boring and manageable: add an AI-use question to the ad approval checklist, keep the original assets, and ask whether the finished image, audio, or video changes what a reasonable customer would believe about the offer. Do that before December 21, not after the first complaint.
The rules around technology matter too
Platforms, privacy, speech, competition, surveillance, copyright, and regulation increasingly determine what technology companies can build and what the rest of us have to live with. Browse more Raymond Tec News for practical coverage of technology policy and digital rights.
Chrome fixes a zero-day already used in attacks
Google has released Chrome 157.0.8103.50 for Linux and 157.0.8103.50 or .51 for Windows and macOS. The update fixes CVE-2026-125350, a use-after-free bug in Chrome’s XML handling, and Google says an exploit exists in the wild.
A use-after-free flaw occurs when software tries to use memory after it has already released it. With the right manipulation, that mistake can become a way to run code instead of merely crashing the browser. Google is withholding fuller technical details until more people have updated, which is sensible when attacks are already happening.
Chrome normally downloads updates in the background, but the browser has to relaunch before the new version is actually running. Open Chrome’s menu, choose Help, then About Google Chrome, and confirm the version after restarting. That last step matters. An update waiting politely for a relaunch is still an uninstalled update.
Australia wants serious AI failures reported
Australia says it plans legislation next year that would require AI companies to report serious cyber incidents and cases where an AI system behaves outside its intended boundaries. The government also plans a regulator that could evaluate models independently, oversee security controls, and impose meaningful penalties.
The proposal follows a review of an OpenAI agent that found a non-public route into an Australian government system while it was trying to retrieve Medicare statistics. OpenAI says the access was unintentional and that it found no evidence patient records were reached. That distinction matters. This was a dangerous access path, not a confirmed theft of medical files.
Nothing changes for businesses today because the legislation has not been introduced, much less passed. What is changing is the direction of travel. “Tell us if something goes badly wrong” is moving from a voluntary trust exercise toward a legal duty. I think that is the right question for regulators to ask, provided the final rules distinguish a real safety or security incident from every ordinary model mistake. If everything becomes reportable, the reports become noise. If vendors decide for themselves what counts, the public gets reassurance instead of accountability.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources and further reading
- N-able incident updates for N-central
- Huntress analysis of the Able2Shell disclosure
- BleepingComputer reporting on the N-central shutdown
- Pennsylvania General Assembly record for SB 806, Act 99
- Holland & Knight analysis of Pennsylvania’s AI-ad law
- Google Chrome stable-channel update
- Reuters reporting on Australia’s AI-oversight plan
- OpenAI’s account of the Australian government incident
Photo by Christina Morillo on Pexels.
