Thirty-three zero-days in an RMM platform exploited within hours of disclosure. A Cisco VoIP flaw added to CISA’s KEV catalog. A CVSS 9.8 Apache HTTP/2 RCE affecting every reverse proxy running mod_http2. And a ScreenConnect campaign that has already breached 48 MSP customer organizations. The common thread today: the tools and infrastructure that organizations trust implicitly - remote management platforms, web servers, VoIP systems - are the ones attackers are hitting hardest.

In the News

33 N-central Zero-Days Exploited Hours After Disclosure

Attackers began exploiting unauthenticated vulnerabilities in N-able’s N-central remote monitoring and management platform within hours of public disclosure. The disclosure included 33 zero-day flaws, several of which provided unauthenticated access to the management plane - the worst possible category for RMM tooling, because a compromised RMM agent holds privileged access to every endpoint it manages.

N-able responded by rushing patches and taking cloud-hosted N-central environments offline to contain the blast radius. The speed of exploitation underscores a persistent operational reality: when vulnerabilities in management-plane tools are disclosed publicly, the window between disclosure and exploitation is measured in hours, not days. Threat actors monitor the same disclosure feeds that defenders do, and RMM platforms are high-value targets precisely because they provide pre-authenticated access to entire customer fleets.

For any organization using third-party RMM tools, the question is not whether the specific tool is N-central - it is whether the RMM platform in use is segmented from production networks, whether its access is monitored by independent endpoint detection, and whether the patching SLA for the management plane itself is faster than the exploitation timeline. In most environments, the answer to all three is no.

Source: SecurityWeek

CISA Adds Cisco BroadWorks CVE-2026-20320 to KEV

CISA added CVE-2026-20320, a high-severity flaw (CVSS 7.5) in Cisco BroadWorks, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. BroadWorks is a VoIP and unified communications platform deployed widely in contact centers, enterprise voice environments, and service provider networks. The vulnerability is network-exploitable and requires no authentication.

VoIP infrastructure occupies a blind spot in many organizations’ vulnerability management programs. Voice platforms are often managed by telecom teams rather than security teams, scanned on different schedules (or not at all), and excluded from endpoint detection deployments. Active exploitation of a VoIP platform flaw is a direct reminder that network infrastructure carrying voice traffic is attack surface - and it needs the same patching discipline applied to firewalls and web servers.

Cisco has released patches. Organizations running BroadWorks deployments should apply them immediately and monitor VoIP network segments for anomalous traffic patterns that could indicate post-exploitation activity.

Source: BleepingComputer

Apache HTTP/2 RCE - CVE-2026-119618 at CVSS 9.8

CVE-2026-119618 is a critical unauthenticated remote code execution vulnerability in Apache HTTP Server’s mod_http2 module. Affected versions span 2.4.55 through 2.4.70. Apache 2.4.71, released this week, contains the fix.

The attack surface is significant: any Apache instance with HTTP/2 enabled is vulnerable. In practice, this means reverse proxies, load balancers, and edge-facing web servers - the exact configurations where Apache is most commonly deployed in enterprise environments. The flaw requires no authentication and is exploitable over the network, making it a prime candidate for automated scanning and mass exploitation.

Organizations running Apache at the network edge should upgrade to 2.4.71 immediately. As an interim mitigation, disabling HTTP/2 support (removing Protocols h2 from the configuration) eliminates the attack surface, though it degrades performance for HTTP/2 clients. Network-layer intrusion prevention systems with signatures for HTTP/2 exploitation attempts provide a detection layer while patching is in progress.

Source: The Hacker News

ScreenConnect Campaign Breaches 48 MSP Organizations

An active campaign targeting ConnectWise ScreenConnect has compromised at least 288 endpoints across 48 organizations through rogue third-party extensions. ConnectWise disabled five extensions and is investigating the full scope of the breach.

The attack follows the MSP supply-chain playbook: compromise the remote management tool, inherit access to every customer the MSP manages. ScreenConnect - like any remote access tool - operates with elevated privileges on managed endpoints. A rogue extension running inside ScreenConnect has the same access as a legitimate technician session.

MSP customers should audit ScreenConnect access logs for unauthorized sessions and unfamiliar extension activity. Organizations that outsource IT management should ask their providers which third-party extensions are installed on remote access platforms and whether those extensions have been validated against ConnectWise’s current advisory.

Source: BleepingComputer

Today’s Deep Dive - GSocket: Stealthy C2 That Bypasses IP and Domain Blocks

Microsoft published detection guidance this week for a growing threat: attackers weaponizing GSocket (Global Socket) for persistent command-and-control access on Linux hosts. GSocket is a legitimate open-source networking tool designed to create encrypted TCP tunnels between hosts behind NATs and firewalls. It relays traffic through a shared public relay network, which means C2 sessions do not connect to attacker-controlled IP addresses or domains.

This is the operational problem: traditional network-based detection - IP blocklists, domain reputation, DNS sinkholing - does not work against GSocket C2. The traffic terminates at a legitimate relay infrastructure, not at a known-bad destination. From a network monitor’s perspective, the connection looks like an outbound TLS session to a benign host.

MITRE ATT&CK mapping: T1572 (Protocol Tunneling), T1090.002 (External Proxy), T1059.004 (Unix Shell)

The technique is gaining traction in web application and hosting environments where Linux hosts are internet-facing and attackers establish initial access through web shells or vulnerable applications. Once on the host, the attacker drops a GSocket binary (often renamed to blend with legitimate processes), generates a shared secret, and establishes a persistent reverse shell through the relay network.

What defenders should watch for: GSocket leaves behavioral artifacts even when network IOCs are absent. Look for unexpected processes named gs-netcat or renamed binaries making outbound connections to relay infrastructure. File-system indicators include the GSocket binary in /tmp, /dev/shm, or user home directories. Process trees showing shell sessions spawned by unfamiliar parent processes are a high-fidelity signal.

Source: Microsoft Security Blog

Defender Action Items

  • N-central customers: Verify patches are applied for all 33 disclosed vulnerabilities. If running self-hosted N-central, confirm your instance is updated before reconnecting to production networks. Audit RMM agent activity logs for unauthorized commands executed during the exposure window.
  • Cisco BroadWorks operators: Apply the Cisco patch for CVE-2026-20320 immediately. Monitor VoIP network segments with network detection tools for anomalous SIP/RTP traffic patterns.
  • Apache HTTP Server administrators: Upgrade to 2.4.71. If immediate patching is not possible, disable HTTP/2 by removing Protocols h2 h2c directives from configuration files and restarting Apache.
  • MSP customers: Audit ConnectWise ScreenConnect deployments for unauthorized third-party extensions. Review access logs for sessions originating from unfamiliar source IPs or occurring outside expected maintenance windows.
  • Linux server operators: Hunt for GSocket binaries in /tmp, /dev/shm, and user home directories. Look for gs-netcat processes or renamed binaries establishing outbound TLS connections.
  • Microsoft Outlook users: Apply November 2026 Patch Tuesday updates to address CVE-2026-124194 (exploited in the wild, NTLMv2 hash exposure). Block outbound NTLM authentication to untrusted hosts via Group Policy.

Detection Queries

The following Splunk SPL query detects potential GSocket C2 activity on Linux hosts by identifying the gs-netcat process or GSocket binary execution from suspicious directories:

index=linux sourcetype=sysmon_linux
(process_name="gs-netcat" OR process_name="gs_netcat"
 OR process_path="/tmp/gs-netcat*" OR process_path="/dev/shm/gs*"
 OR process_path="*/gs-netcat")
| eval risk_score=case(
    process_path LIKE "/tmp/%", 90,
    process_path LIKE "/dev/shm/%", 95,
    1=1, 70)
| stats earliest(_time) AS first_seen, latest(_time) AS last_seen,
    values(process_path) AS paths, values(parent_process) AS parents,
    max(risk_score) AS max_risk BY host
| where max_risk >= 70
| sort -max_risk

This query targets Sysmon for Linux telemetry. Adjust sourcetype for your environment (e.g., osquery:results or auditd). False positives are low - legitimate GSocket usage in enterprise environments is uncommon. Any hit warrants immediate investigation of the parent process tree and network connections.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.