ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients

thehackernews.com Nov 12, 2026

ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients

Curated by Shubham · TechCapsules · Nov 12, 2026

AI-summarised brief · reviewed before publication

ConnectWise disabled five third‑party extensions in partner environments after reports of unauthorized access. The company confirmed no evidence of a ScreenConnect software flaw and identified about 400 partner sites with the extensions installed. Cybersecurity firm Huntress traced attackers using compromised credentials or hijacked sessions to push rogue ScreenConnect clients to at least 288 endpoints across 48 organizations. The malware, named SCKit, establishes persistent remote access, installs a second attacker‑controlled client, and creates a relay trap to intercept session cookies. The attack spreads in a worm‑like two‑step process from infected endpoints to technicians and then to other endpoints.

💡 Why It Matters

· The incident exposes how vulnerable third‑party extensions can become a conduit for sophisticated lateral movement, underscoring the need for strict access controls and continuous monitoring in partner ecosystems.

Capsules Cybersecurity

Read full article on thehackernews.com

Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

A critical vulnerability (CVE‑2026‑119618) in Apache HTTP Server’s HTTP/2 module (mod_http2) allows unauthenticated remote attackers to execute code on affected servers. The flaw, rated 9.8/10 on CVSS, impacts versions 2.4.55 through 2.4.70 and standalone mod_h2 2.0.8–2.0.42. Red Hat released a patched package (2.4.71) and updated RHEL 9 and 10 yesterday, while other distributions are following suit. Administrators must disable HTTP/2 or upgrade to the fixed release to mitigate the risk.

💡 The flaw exposes servers to full control without authentication, threatening critical infrastructure that relies on Apache’s widespread deployment. Prompt patching is essential to prevent potential large‑scale compromises.

thehackernews.com · Nov 12

Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer…

An attacker leveraged credentials from 4,837 compromised GitHub accounts to deploy a secret‑stealing script across at least 1,806 repositories. The malicious code, inserted via pull requests titled “docs: dependency audit notes,” accessed CI workflow secrets, cloud credentials, and runtime tokens, then exfiltrated them to external servers or Telegram. SafeDep identified 8,093 repositories that received malicious commits, with 7,309 containing the stealer. Aikido Security warned that any account that opened a test pull request is compromised, urging owners to revoke tokens, enable 2FA, and rotate secrets.

💡 The breach exposes the breadth of GitHub’s supply‑chain risk, showing how compromised accounts can silently harvest cloud credentials across thousands of projects, potentially enabling attackers to pivot into deeper cloud infrastructures.

thequantuminsider.com · Nov 12

CyberRisk Collaborative Announces Virtual Event on Post-Quantum Readiness

CyberRisk Collaborative announced a virtual event, “Post‑Quantum Readiness: Preparing for Q‑Day,” scheduled for January 26, 2027. The program targets CISOs and senior security leaders, offering five 20‑minute sessions on quantum‑computing risks, cryptographic asset inventory, post‑quantum standards, migration planning, and enterprise governance. Speakers include representatives from the Foundation for Defense of Democracies, SAP, Georgia Tech, Citi, and NewYork‑Presbyterian Hospital. Sessions will be available on demand after the live event.

💡 The event equips leaders with actionable strategies to counter the looming threat of quantum‑enabled cryptographic breakage, ensuring long‑term data protection and regulatory compliance.

thehackernews.com · Nov 12

Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak…

Node.js released critical updates for its 22.x, 24.x, and 26.x lines, fixing 16 vulnerabilities, including two high‑severity HTTP/2 flaws that let unauthenticated clients crash servers or leak memory from other connections. CVE‑2026‑123863 causes crashes when a default HTTP/2 server replies before the request body arrives, while CVE‑2026‑123866 exposes memory across streams. A separate HTTPS flaw (CVE‑2026‑123864) permits reading of TLS keys and other users’ data. All affected versions now have patched releases; end‑of‑life lines remain vulnerable.

💡 The fixes prevent attackers from crashing Node.js‑based services or exfiltrating sensitive data, safeguarding critical web infrastructure that relies on HTTP/2 and HTTPS.

thehackernews.com · Nov 12

Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation

Zoom has issued patches for two Windows‑specific flaws in its Zoom Workplace client. The critical vulnerability, CVE‑2026‑108187, affects versions prior to 7.1.5 and allows an unauthenticated remote attacker to elevate privileges on the host system. A second issue, CVE‑2026‑108186, impacts versions from 7.1.0 up to but not including 7.1.8, also enabling privilege escalation without prior access. Both bugs can be exploited without special permissions, potentially giving attackers full control of affected machines. Earlier in July, Zoom released a fix for CVE‑2026‑53412, a high‑severity input‑validation error that could let unauthenticated users hijack accounts. Zoom has not reported active exploitation, and it urges users to install the latest updates immediately.

💡 Unpatched privilege‑escalation bugs give attackers direct control over corporate endpoints, turning a video‑call tool into a covert entry point for broader network compromise.

thehackernews.com · Nov 11

Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam…

Threat actors targeted Qlik Sense servers in October 2026, attempting to deliver PowerShell reverse shells to multiple EU customers within a three‑minute window. The activity mirrors a November 2023 CACTUS ransomware campaign that exploited the same Qlik vulnerabilities, now patched in August–September 2023. Cynet’s analysis revealed a one‑line reverse shell to 45.115.26.23:4455, followed by a Windows Go reverse shell to 45.115.26.23:4456 for reconnaissance and persistence. The malware also sought ActiveMQ processes, collected Linux credentials, and installed OpenSSH via scheduled tasks. An exposed directory on the same IP hosts a custom Go backdoor, ActiveMQ exploit, and a modified Veeam toolchain, suggesting preparation for broader attacks.

💡 The reuse of previously patched Qlik flaws shows attackers’ persistence and the risk of incomplete fixes. The discovery of a multi‑stage backdoor and exploitation of other enterprise tools signals a coordinated effort to expand lateral movement and persistence across diverse environments.