N-central Attacks Continue, Plus 4 Tech Stories
N-central servers are being compromised through a newly disclosed path even after Hotfix 2, Apache has fixed a critical HTTP/2 flaw, and a GitHub Actions campaign is stealing the credentials businesses use to deploy software. Today’s useful theme is not “patching doesn’t work.” It is that a patch fixes the problems it was built to fix, not every problem disclosed two days later.
N-central attacks continue after Hotfix 2
The N-central situation changed again Thursday, and this change is material. Security researchers say attackers used a newly disclosed exploit chain called 4EverAble2Shell to compromise at least 21 production N-central servers and install cryptocurrency miners. Nineteen of those servers were already running N-central 2026.4 Hotfix 2, the emergency update released earlier this week.
That does not mean Hotfix 2 was useless. It addressed the earlier Able2Shell vulnerabilities that forced hosted systems offline, and customers still need it. The new chain combines a flaw in Apache Axis, CVE-2026-90436, with a separate N-central privilege-escalation weakness. According to the published research, the attack requires N-central’s Legacy API to be enabled. That setting is off by default, but some older integrations may have required administrators to turn it back on.
N-able has disabled the Intune integration and applied additional protections to hosted environments. On-premises operators must confirm that Legacy API access is disabled. N-able also says it has identified additional indicators of compromise and is working with specific customers, while independent researchers reported the successful mining infections.
Disabling Legacy API closes the path described in 4EverAble2Shell. It does not remove an attacker who already obtained root access, and it does not finish the wider investigation into the newly published Agent2Shell claims. Operators should review requests to /dms/services/ServerUI, unexpected xvd.service services, mining processes, and files under /tmp/.xvd or /var/tmp/.xvd. Preserve evidence before cleaning anything. If those indicators are present, treat the appliance as fully compromised and rebuild or restore from a trusted state rather than merely deleting the miner.
Hosted and on-premises customers should still complete the HF2 Agent-first, Probe-second rollout described yesterday. This week has produced several overlapping instructions, which is exactly how somebody ends up following Tuesday’s correct advice on Friday and believing the job is done. Check the current incident notice, not the last email you happened to open.
The boring machines need attention too
Browsers, workstations, remote-access tools, Wi-Fi, and ordinary office hardware rarely get much attention until one of them becomes the problem. Raymond Tec provides onsite IT and field services around Reading, Pennsylvania, along with practical help keeping the technology people use every day working and reasonably secure.
Apache fixes a critical HTTP/2 server flaw
Apache HTTP Server 2.4.55 through 2.4.70 contains a critical race condition in mod_http2. Two requests can cause the server to use shared memory unsafely, corrupting the heap and potentially allowing an unauthenticated attacker to run commands on the server. The flaw is CVE-2026-119618, and Apache fixed it in version 2.4.71.
The affected component matters. A server is exposed only when mod_http2 is loaded and HTTP/2 is enabled through the Protocols configuration. If a patched package is not yet available, temporarily removing h2 and h2c so the server uses HTTP/1.1 blocks this attack path. That costs some performance, but it is a reasonable short-term trade while waiting for a vendor package.
Linux distributions often backport security fixes without changing the visible Apache version to 2.4.71, so don’t decide a managed server is vulnerable from apache2 -v alone. Check the operating-system or hosting vendor advisory and installed package revision. The goal is the fix, not a prettier version number.
WordPress security & maintenance
Keeping WordPress current is only part of keeping it healthy. Raymond Tec handles updates, backups, security monitoring, compatibility problems, access cleanup, and maintenance — plus the assorted weirdness that accumulates on a site over time.
GitHub Actions turned stolen access into stolen cloud keys
A campaign called wfx-loot used 4,837 compromised GitHub accounts to probe more than 61,000 repositories beginning November 10. The attacker opened pull requests titled docs: dependency audit notes, then used repositories where the stolen account had write access to inject a malicious GitHub Actions workflow or install hook. Aikido found evidence that the payload ran in at least 1,800 repositories.
GitHub Actions is the automation layer that builds, tests, and deploys code. That makes its runner a particularly valuable place to steal from. The malware collected repository secrets, cloud credentials, SSH keys, deployment tokens, payment-provider keys, and credentials for AI services. It then reverted its changes and deleted the workflow run, so a gap in the run-number sequence may be one of the few remaining clues.
Credential rotation is necessary if the workflow ran, but it may not be sufficient. The malware could rewrite AWS trust policies or add Azure federated identities, creating a new route back in after the obvious tokens change. Search for the named pull request, wfx-docs and short-lived chore/ branches, the listed commit messages, and missing Action runs. Then review cloud identity changes and trust relationships before declaring the environment clean.
A Windows update problem is supposed to fix itself
Some Windows 11 computers that installed October’s optional preview update, KB5127936, cannot complete November’s KB5132061 security update. They may stall or repeatedly show errors 0x80070306, 0x800f0989, or 0x800f0993.
Microsoft says the repair is being delivered automatically and affected computers should retry the security update after receiving it. Most people should wait through Friday and check Windows Update again, not start deleting update caches because a forum post made it look therapeutic. If the same failure continues after the 48-hour repair window, then contact Microsoft support or the organization’s IT provider.
Business IT goes well beyond the website
Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.
A court says metadata cannot become the whole investigation
The Fourth Circuit Court of Appeals has ordered a lower court to narrow government demands for LinkedIn records belonging to journalists. The leak investigation covered an 18-month period in which the journalists published nearly 1,000 stories. The original order could have exposed every source they contacted through LinkedIn during that time, including sources with no apparent connection to the classified-information investigation.
The court did not erase the government’s authority to obtain relevant records, and it did not quash the order entirely. It said the demand and the accompanying secrecy order were too broad and must be reconsidered. That is a narrower result than “journalists win,” but an important one.
The opinion is also a useful reminder that metadata is not harmless just because it is not the text of a message. Who contacted whom, when, and how often can identify a confidential source or map an organization’s relationships. I think the court got the balance right: national-security investigations may justify substantial access, but technical convenience does not make every record relevant.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources / Further Reading
- N-able: November 12 N-central security incident updates
- BleepingComputer: exploitation of 4EverAble2Shell after HF2
- SecurityWeek: N-able identifies additional indicators of compromise
- Apache HTTP Server Project: vulnerabilities fixed in 2.4.71
- Red Hat: CVE-2026-119618 exposure and mitigation
- Aikido Security: wfx-loot technical report and indicators
- Microsoft: KB5132061 for Windows 11
- BleepingComputer: Microsoft’s automatic repair guidance
- Fourth Circuit: In re Application opinion
- Associated Press: LinkedIn records ruling
Photo by Christina Morillo on Pexels.
