> InfoSec News Nuggets – 11/12/2026

Hackers Target N-central Zero-Days as N-able Rushes Patches N-able has shipped N-central 2026.4 HF2 to fix the most serious of the more than 30 zero-days that researcher Sean Bales publicly dumped with proof-of-concept code over the weekend under the name Able2Shell, after briefly pulling its hosted environments offline on Monday. The company says every flaw exploitable without authentication is now resolved, including critical XXE and SSRF bugs rated 9.3, while the remaining authenticated issues will be addressed in later hotfixes. Scanning tied to the public exploit code began almost immediately, with researchers observing anonymous agent sessions, appliance config pulls and unauthenticated hits on the remote-control endpoint, so on-premises customers are urged to patch as soon as possible.   ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients Huntress says attackers abused access to cloud-hosted ScreenConnect panels to push Run commands that installed rogue clients on at least 288 managed endpoints across 48 organizations, with activity first detected on November 11. The rogue clients deliver a custom toolkit called SCKit that adds Microsoft Defender exclusions, plants a persistent backdoor and sets a relay trap designed to steal technician session cookies and spread worm-like to other panels. ConnectWise says there is no evidence of a ScreenConnect vulnerability or infrastructure compromise and has disabled five third-party RMM extensions in partner environments as a precaution while it investigates, and MSPs are urged to review their Run Command history and the published indicators of compromise even if they have not received alerts.   Attackers breached the Fireworks AI storage where Notion AI chats sat outside zero data retention Attackers who breached AI inference provider Fireworks AI reached stored customer data, including Notion AI chat transcripts used for Notion’s Insights feature, even though Fireworks advertises zero data retention by default. That default covers only real-time inference, while features such as batch jobs, datasets and training store content, and the stricter policy that blocks storage is off by default and limited to enterprise accounts. Notion says fewer than 1% of its workspaces may be affected and advises customers to treat the data as exposed, while the intrusion itself came through a third-party cloud provider hosting Fireworks R&D machines and has been linked to financially motivated LLMjacking. Security teams are advised to ask AI vendors exactly which features persist content and to rotate any exposed secrets at the issuer.   Maersk confirms cyberattack after hackers access old IT system Danish shipping giant Maersk has disclosed that attackers stole data from a legacy IT system it inherited through an earlier acquisition, saying the incident was contained quickly, shipments are not interrupted and there is no sign of impact on its wider network or on customer and partner integrations such as APIs and EDI. The company says findings so far suggest no sensitive data was disclosed, though the investigation is ongoing. The disclosure follows claims by the WhiteArmour ransomware gang that it stole more than 16,000 plaintext driver passwords and is demanding $5 million in bitcoin, and researchers have linked the breach to LF Logistics, a supply chain management provider Maersk acquired in 2022.   November 2026 Patch Tuesday: 63 Critical Microsoft fixes, plus an Outlook zero day that allows theft of hashed credentials Microsoft’s November Patch Tuesday fixes 1,094 vulnerabilities, 63 of them critical, including an actively exploited Outlook zero-day (CVE-2026-124194) that can leak a user’s NTLMv2 password hash when a malicious Office file is opened, letting attackers crack or relay it to sign in as the victim. Despite its moderate 6.5 CVSS score, experts urge immediate patching, and Microsoft credited the discovery to an Anthropic researcher using Claude. Four other bugs carry a 9.8 score, including unauthenticated remote code execution flaws in Windows LDAP and Exchange Server, so domain controllers and Exchange should be patched first. SAP also fixed ICM2Shell, a CVSS 10 WebSocket memory corruption flaw enabling unauthenticated remote code execution, alongside updates from Adobe, Mozilla and Google, whose latest Chrome release closes the browser’s eighth exploited zero-day of 2026. The post InfoSec News Nuggets – 11/12/2026 appeared first on AboutDFIR - The Definitive Compendium Project.