N-able N-central Pre-Auth RCE Flaw Exploited in the Wild

thehackernews.com Sep 9, 2026

N-able N-central Pre-Auth RCE Flaw Exploited in the Wild

Curated by Shubham · TechCapsules · Sep 9, 2026

AI-summarised brief · reviewed before publication

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a maximum‑severity, CVSS 10.0 flaw in N‑able N‑central (CVE‑2026‑86218) to its Known Exploited Vulnerabilities catalog, mandating Federal Civilian Executive Branch agencies to install the September 5, 2026 hotfix by September 11, 2026. The vulnerability is a static‑code injection that enables pre‑authentication remote code execution. Huntress reported a compromise of a fully patched N‑central environment on September 4, 2026, but could not confirm whether the breach used CVE‑2026‑86218 or two other same‑day patches (CVE‑2026‑86206, CVE‑2026‑86207) that allow unauthenticated attackers to create admin accounts. N‑able confirmed the exploit is active in the wild and urged immediate remediation.

💡 Why It Matters

· Exploitation of a flawless, pre‑auth RCE gives attackers unrestricted control over managed IT infrastructure, forcing rapid patch adoption across critical government networks.

Capsules Cybersecurity

Read full article on thehackernews.com

Office 2021 loses support in October. This tool keeps it safe anyway

Microsoft will officially end support for Office 2021 on October 13, 2026, ceasing all security and feature updates for the software suite. This discontinuation leaves users vulnerable to emerging cyber threats unless they upgrade to Microsoft 365 or Office 2024. Alternatively, third-party provider 0patch offers unofficial micropatches to maintain security for up to three years post-support. These micropatches fix vulnerabilities by integrating external code fragments without altering the original software, allowing for easy removal if errors occur. While 0patch provided similar services for Windows 10, it charges €24.95 annually for private users and €34.95 per PC for businesses. The service does not replace traditional technical support, which remains Microsoft’s responsibility, though official assistance will likely be limited after the cutoff date. Users must decide between migrating to newer Microsoft products or paying for this external security layer to continue using Office 2021 safely beyond its designated lifecycle.

💡 This creates a critical security gap for organizations hesitant to migrate to subscription models. Paying for third-party micropatches offers a cost-effective bridge, but it shifts the burden of vulnerability management away from the original vendor.

azernews.az · Sep 9

Google: AI enabled mass cloud hacks in 6 hours

Google Threat Intelligence reported a surge in artificial intelligence misuse during the second quarter of 2026, significantly accelerating cyberattack automation. The report highlights that malicious actors now compromise cloud resources and execute mass credential harvesting campaigns in under six hours, drastically reducing the time available for defensive responses. These attacks increasingly target proprietary AI models and source code, identifying enterprise AI assets as high-value objectives for espionage, extortion, and resource theft. Google stated it will continue securing its models against misuse, disrupting hacker accounts, and utilizing its AI Threat Defense architecture to protect enterprise environments. The findings underscore the evolving speed and sophistication of AI-driven threats, emphasizing the critical need for enhanced security measures to counter rapid, automated attacks on cloud infrastructure and intellectual property.

💡 The six-hour execution window for mass credential harvesting renders traditional incident response protocols obsolete, forcing organizations to abandon reactive security models in favor of autonomous, real-time defense mechanisms.

appleinsider.com · Sep 8

iOS 26.6.2, iPadOS 26.6.2 land as iOS 27 gets closer to release

Apple released iOS 26.6.2 and iPadOS 26.6.2 on September 8, just before its iPhone 18 Pro event, as the company finalizes the upcoming iOS 27 and iPadOS 27. Both updates, build 23G90, replace version 26.6.1 (build 23G83) and focus on performance improvements and security patches, following a similar pattern to the August 17 release. AppleInsider recommends installing the updates promptly due to rising AI‑based threat discoveries. The releases are incremental and add no new features.

💡 The timely patches address emerging security risks, ensuring users remain protected as Apple transitions to the next major OS generation.

thehackernews.com · Sep 8

Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution

CrowdStrike has identified a financially motivated threat group, dubbed Slim Spider, conducting sophisticated attacks on Brazilian financial institutions since March 2026. The actors leveraged deep knowledge of Brazil’s instant‑payment system Pix, digital‑asset platforms, and cloud environments to infiltrate a major bank’s cloud infrastructure. Using custom Bash scripts, they harvested temporary cloud credentials, enumerated secrets in the cloud credential manager, and exfiltrated cryptocurrency custody keys. The group then employed the Foundry Ethereum toolkit’s “cast” utility and OpenSSL to derive wallet addresses and sign transactions without third‑party libraries. Further steps included deploying backdoors disguised as legitimate binaries, compromising Azure DevOps pipelines, and spreading implants across a Kubernetes cluster, including a “spi” implant mimicking the Pix infrastructure. An exposed C2 panel revealed compromised hosts across multiple banks, and the Go‑based backdoor MikeDor was also used to harvest data.

💡 By stealing custody credentials, Slim Spider can directly authorize crypto withdrawals, turning cloud misconfigurations into immediate monetary loss for banks and their customers.

microsoft.com · Sep 8

Codename MDASH brings agentic AI cybersecurity to the US government

Microsoft has deployed Codename MDASH, a multi-model agentic scanning system, to Microsoft Azure Government. This tool provides US government customers and authorized partners with advanced AI capabilities to proactively identify software vulnerabilities. Unlike traditional scanners that rely on known patterns, MDASH uses over 100 specialized AI agents to reason about source code like expert security researchers. The system validates exploitable flaws by analyzing information flow and arguing cases for and against suspected weaknesses. This approach reduces false positives and prioritizes genuine threats. MDASH achieved a 96.55 score on the CyberGym benchmark, demonstrating its effectiveness against real-world vulnerabilities. Its multi-model harness design allows for robust analysis and easy integration of newer AI models without disrupting existing workflows. By focusing on subtle, complex flaws across the software supply chain, Microsoft aims to shift the advantage to defenders against sophisticated cyberattacks targeting critical national missions.

💡 By replacing static pattern-matching with dynamic, agentic reasoning, this system addresses the critical failure of traditional tools to detect subtle, complex supply chain vulnerabilities. Its modular harness design ensures agencies can continuously integrate superior AI models without rebuilding their security infrastructure, maintaining long-term defensive resilience.

techcrunch.com · Sep 8

Hackers are stealing Claude tokens from subscribers

Independent AI consultant Grant De Swardt discovered unauthorized token consumption on his Claude Max 20x account, prompting an investigation by Anthropic. The company identified that compromised session keys allowed hackers to mint unauthorized OAuth tokens, siphoning usage without the user’s knowledge. Anthropic suspended De Swardt’s account, invalidated sessions, and issued a partial refund, though he suffered business disruption. Similar reports emerged on Reddit and GitHub, with users citing sudden, unexplained usage spikes. Anthropic confirmed that infostealer malware was harvesting login credentials from infected computers, not from Claude itself. The company warned affected users and invalidated authorizations. However, the lack of itemized usage tracking made detection difficult. De Swardt, finding no malware on his own system, canceled his subscription. He switched to Cursor, citing better support and access to affordable open-source models. He stated he would not return to Anthropic until they resolve these security and transparency issues, highlighting a growing concern over account security in AI services.

💡 The incident exposes a critical vulnerability where infostealer malware can silently drain paid AI subscriptions, turning user accounts into resources for unauthorized third parties. This lack of granular usage transparency forces professionals to abandon trusted platforms for competitors offering better security controls and cost efficiency.