Monday opens with a pattern that should concern anyone running third-party remote management tooling: N-able just shipped its fifth max-severity patch for N-central in five weeks. That cadence is not normal vulnerability management - it is a codebase under sustained attacker scrutiny. Alongside that, Adobe patched a Magento zero-day after four days of active exploitation, and a misconfigured database exposed nine years of international passenger data.

In the News

N-able Ships 5th Critical N-central RCE Patch in 5 Weeks

N-able released Hotfix 4 for its N-central remote monitoring and management platform on September 8, marking the fifth max-severity (CVSS 10) patch in just over a month. All five vulnerabilities are unauthenticated remote code execution flaws - the kind that require no credentials and no user interaction. All on-prem N-central builds below 2026.3.1.14 are affected, and attackers are actively exploiting the latest flaw.

The cadence matters as much as the individual CVEs. Five critical patches in five weeks for the same attack surface suggests either a sustained reverse-engineering campaign against N-central’s codebase or foundational code quality issues that make new variants easy to discover once the first one is found. For MSPs and IT service providers running N-central, the operational burden is significant: each hotfix requires testing and deployment across the customer base, and the window between disclosure and exploitation is shrinking.

The defensive priority extends beyond patching. Organizations should audit all administrative accounts on their N-central instances for unauthorized additions, segment the RMM server from production networks so a compromised management platform cannot directly reach endpoints, and deploy endpoint detection on the RMM host itself. A remote management tool with SYSTEM-level access to every managed device is the definition of a high-value target - Huntress documented exactly this pattern with backdoored ScreenConnect clients spreading laterally through RMM infrastructure.

What defenders should do: Apply Hotfix 4 immediately. Audit N-central admin accounts for unauthorized users. Segment the RMM server into a restricted management VLAN. Deploy EDR on the RMM host and monitor for anomalous process execution.

Adobe Commerce Zero-Day Drops Rust Backdoors on Online Stores

Adobe patched CVE-2026-75650 on September 8 after four days of confirmed zero-day exploitation. Researchers at Sansec discovered the vulnerability, dubbed “StyleSmuggler,” being used to compromise Adobe Commerce and Magento Open Source installations. The attack chain deploys a compiled Rust backdoor for persistent access and PHP web shells for payment data exfiltration.

The choice of a Rust backdoor is notable. Compiled Rust binaries are harder to reverse-engineer than typical PHP web shells, and many file integrity monitoring tools focused on web roots look for PHP, JSP, or ASP files - a compiled binary in an unexpected directory may not trigger the same alerts. The four-day exploitation window (September 4-8) means any unpatched Commerce instance should be treated as potentially compromised, not just vulnerable.

Defenders running Magento or Adobe Commerce need to patch and then investigate. Scan web roots and upload directories for unexpected binary files and recently modified PHP files. Review outbound network connections from the web server since September 4 for unfamiliar destinations. Check access logs for the specific URI patterns documented by Sansec in their initial disclosure.

What defenders should do: Patch CVE-2026-75650 immediately. Scan for unauthorized Rust binaries and PHP files in web-accessible directories. Review outbound connections from Commerce servers since September 4. MITRE ATT&CK: T1505.003 (Server Software Component: Web Shell), T1059 (Command and Scripting Interpreter).

220 Million Traveler Records Exposed via Default Credentials

An Advance Passenger Information System (APIS) database linked to Vietnamese aviation authorities was discovered accessible with default credentials, exposing 220 million records spanning 2017 through 2026. The dataset includes passport numbers, full legal names, dates of birth, nationalities, and complete flight itineraries for international passengers and crew.

This is not a sophisticated attack - it is a default-credential exposure on an internet-facing system. The scale amplifies the impact. Nine years of passenger data provides enough information for identity fraud, targeted phishing, and physical security threats against individuals whose travel patterns are now exposed. The database has been secured following researcher disclosure.

For organizations in travel, hospitality, and aviation, this is a case study in why continuous attack surface management and credential scanning are not optional. Automated tools that detect default credentials on externally exposed services would have caught this before a researcher - or a threat actor - did.

What defenders should do: Audit internet-facing databases and services for default credentials. Implement automated external attack surface scanning. For organizations handling APIS data, review access controls and authentication on all passenger information systems.

Today’s Deep Dive - ClearFake’s Browser-Native Evolution

Cisco Talos published two reports on September 8 documenting significant evolution in the ClearFake campaign. The operation now runs two parallel infection chains, both representing meaningful advances over the “paste this PowerShell” ClickFix technique that dominated earlier campaigns.

The first chain uses Cloudflare Workers to inject JavaScript into compromised websites. The injected script pulls additional commands from smart contracts on BNB Smart Chain - a legitimate blockchain - making the C2 infrastructure effectively uncensorable through traditional domain takedowns. Victims see a fake Google CAPTCHA prompt that triggers a WebDAV-hosted loader chain, ultimately delivering Amatera stealer and ZigCryptoStealer. Talos tracked deployments targeting Ukrainian government infrastructure and cryptocurrency operations.

The second chain is entirely browser-native. Victims are socially engineered into pasting JavaScript directly into Chrome’s address bar or installing it as a Tampermonkey userscript. The payload uses Google’s Visualization API to read obfuscated commands from public Google Sheets - turning a legitimate productivity tool into a C2 channel. Once active, the script operates as a web skimmer and performs real-time cryptocurrency address swapping, replacing legitimate wallet addresses with attacker-controlled ones during transactions.

The defensive implication is that ClickFix is no longer constrained to endpoint compromise. The Google Sheets C2 variant operates entirely within the browser context, making endpoint detection less effective. DNS-level blocking of known ClearFake infrastructure, browser isolation for users handling financial transactions, and monitoring for unusual Google Visualization API calls from endpoints are the relevant controls. MITRE ATT&CK: T1189 (Drive-by Compromise), T1059.007 (JavaScript), T1102 (Web Service for C2).

Defender Action Items

  • Apply N-able N-central Hotfix 4 (build 2026.3.1.14+) on all on-prem instances immediately and audit for unauthorized admin accounts created since August 1
  • Patch CVE-2026-75650 on all Adobe Commerce and Magento Open Source instances; scan web roots for Rust binaries and PHP web shells deployed since September 4
  • Update MikroTik RouterOS to the latest patched version and disable or restrict internet-facing SSH
  • Review ConnectWise ScreenConnect instances for temporary mitigations pending the expected patch this week
  • Scan external-facing assets for default credentials - the APIS exposure proves this basic control failure persists at scale

Detection Spotlight

The N-central exploitation chain typically results in unauthorized account creation or service installation on the RMM server. The following Splunk SPL query detects new local account creation on Windows hosts running N-central, which should never occur outside of planned maintenance windows:

index=wineventlog sourcetype=WinEventLog:Security EventCode=4720
| where match(ComputerName, "(?i)n-central|ncentral|nable")
| eval account_created=Account_Name
| table _time, ComputerName, account_created, SubjectUserName, SubjectDomainName
| sort -_time

This query targets Event ID 4720 (user account created) on hosts matching common N-central naming patterns. False positives are limited to legitimate account provisioning during planned maintenance - any hit outside a change window warrants immediate investigation. Extend coverage by adding Event IDs 4697 (service installed) and 4688 (process creation) with suspicious parent-child relationships on the same hosts.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.