Welcome to Threat Thursday, Galactic’s weekly threat intelligence roundup.
Every Thursday we cover the cybersecurity stories that matter most for protecting organizations from emerging threats, and we break each one down into what happened, what it could mean for your organization, and what to do about it.
This week, attackers went after the remote support tools and IT management platforms that providers use to run their customers’ computers, along with the web servers, databases, remote logins, and video app that sit underneath almost every business. Software holding the keys to everything else was the target across almost every story this week.
This Week’s Stories
01. Attackers Hijack ScreenConnect Remote Support Tool to Plant Hidden Access on 288 Computers
ScreenConnect is remote support software that lets IT teams take control of a computer to fix problems. On November 11, security firm Huntress watched someone who had gotten into several cloud-hosted ScreenConnect accounts use a built-in command feature to install a second, attacker-controlled copy of ScreenConnect on at least 288 computers across 48 organizations, all in about 90 minutes. That copy hides from security tools, pushes the legitimate connection aside, and tries to steal the login of any technician who connects so the attacker can reach more computers. ConnectWise, the vendor, says its own systems weren’t breached and ScreenConnect itself has no flaw. As a precaution, it switched off five add-ons made by another company in about 400 customer accounts. How the attacker got in is still under investigation.
Potential impact: Remote support tools are built to reach many computers at once, which is exactly what made this attack so efficient: a handful of compromised accounts turned into hundreds of compromised machines in short order. The planted copy also works on its own, so shutting off the original account doesn’t remove the attacker. Huntress hasn’t yet seen the toolkit successfully jump from an infected computer to a technician’s machine, but if it does, one break-in could spread to every customer a provider supports.
What to do: Organizations using ScreenConnect should confirm the five affected add-ons (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link) are switched off, and customers who host ScreenConnect themselves need to do this on their own. Review the history of remote commands since November 11 even if nothing has alerted, investigate suspect computers with a separate tool rather than ScreenConnect, and then reset passwords, sign everyone out, and require multi-factor sign-in.
Source: The Hacker News
02. New Attacks on N-central IT Management Software Work Even After the Latest Fix
N-central is software from N-able that IT providers use to monitor, update, and remotely manage their customers’ computers. On November 9, a researcher published 33 claimed security holes in it along with working attack code, without warning the company first. N-able took its hosted service offline and released a fix the next day. Late on November 11, the same researcher released two more attack tools that he says work even on servers with that fix: one takes over the N-central server without a password, and the other uses the server to run commands on the Windows computers it manages. N-able says the server attack only works when an older, off-by-default connection feature is switched on and exposed to the internet, and that its hosted service isn’t affected. Security firm Huntress advises treating every patched server as vulnerable for now.
Potential impact: A management platform like N-central holds administrator access to every computer it watches over, so taking over the server can mean taking over many organizations in one move. The attack code is public, researchers saw probing within hours, and no fix exists yet for the newest tools, which leaves settings changes and network limits as the only defenses for now. The episode also reopens the debate over publishing attack code before a fix exists, which N-able’s CEO said gives attackers a head start.
What to do: Organizations running their own N-central servers should confirm the Legacy API feature is turned off and treat any server where it was on as potentially exposed. Keep the server off the open internet, or limit it to known networks, until N-able ships its next fix, and review activity since November 9 for new administrator accounts, unexpected scripts, or remote sessions. Organizations that rely on an IT provider should ask whether it uses N-central and what it has changed this week.
Sources: The Hacker News, Infosecurity Magazine on Able2Shell
03. Critical Apache Web Server Flaw Could Let Attackers Take Over Websites Without a Password
Apache HTTP Server is free software that runs a large share of the world’s websites. The Apache project fixed CVE-2026-119618, a flaw that could let anyone on the internet take over an affected web server without logging in. It only matters on servers with HTTP/2 switched on, a newer and faster way for browsers to talk to websites, and it affects Apache versions 2.4.55 through 2.4.70. Red Hat rates it 9.8 out of 10 and says researchers have shown a reliable way to exploit it, while cloud security firm Wiz says no working attack is public and none have been reported. Some Linux vendors, including Red Hat, have shipped fixes, but others, such as Debian and Amazon Linux, are still working on theirs.
Potential impact: A hijacked web server can be used to change a website, steal customer data stored behind it, or reach other systems inside the network. Because many products bundle Apache inside them, the hardest part is often finding every copy. The uneven state of fixes means some organizations will need a stopgap for days or weeks, and a server updated in May for an earlier Apache flaw is still open to this one.
What to do: Organizations should list every Apache web server they run, including ones built into other products, and check whether HTTP/2 is turned on anywhere in the settings, since it can be enabled site by site. Update to Apache 2.4.71 or the fixed version from your Linux vendor. Where no fix is available yet, switch HTTP/2 off so the server falls back to the older HTTP/1.1, which closes the hole until the update arrives.
Source: The Hacker News
04. MongoDB Database Flaw Lets Attackers Crash Servers Without Logging In
MongoDB is a popular database that many business apps use to store their information. On November 10, MongoDB disclosed a flaw, tracked as CVE-2026-118383 and rated 9.5 out of 10, that lets someone who can reach the database over the network plant two harmless-looking requests without logging in. Those requests sit until the database later switches which copy is in charge, a routine handoff called a failover. If the server taking over had fallen behind, it crashes before it can save new data. Only databases set up as a group of copies (called a replica set) are affected, not single servers, and turning on passwords doesn’t block it. MongoDB found the flaw itself and isn’t aware of attacks, and its cloud service, Atlas, applies the fix during scheduled maintenance.
Potential impact: Replica sets exist to keep a database running when one server fails, and this flaw turns that safety net into the moment of failure. The result is an outage at the worst possible time for any app relying on the data. MongoDB also says a full takeover may be possible under certain conditions, though researchers at Datadog only managed a crash. Databases reachable from the internet carry the most risk, since a planted request can lie in wait until the next handoff.
What to do: Organizations running their own MongoDB should update every server in each replica set to the fixed release for its version (for example, 8.0.37 or 7.0.48), including copies that run in containers or were offline during maintenance. Atlas customers who postpone maintenance should apply it now. Until updates are done, limit database access to the applications that need it, and keep databases unreachable from the internet entirely.
Source: The Hacker News
05. Attackers Exploit 10-Year-Old OpenSSH Bug to Skip Password Checks on Some Linux Servers
SSH is the standard tool IT staff use to log in to servers and network devices remotely. A flaw nicknamed SSHole (CVE-2026-123158) dates back to a 2016 change in OpenSSH, the most widely used version of that tool, and lets attackers skip the password check under specific conditions. It only affects systems built on a lightweight component called musl, such as Alpine Linux and some network devices, and only when password logins are on and a particular login setting is off. Mainstream systems such as Ubuntu and Debian aren’t affected. A fix arrived on November 5, attack code appeared about four hours later, and attackers were using it the next day to install crypto-mining and botnet software. CISA, the U.S. cybersecurity agency, added it to its list of actively exploited flaws on November 9.
Potential impact: Lightweight Linux is popular in cloud servers, containers, and network gear precisely because it’s small and easy to forget about, which also makes these systems hard to find and slow to patch. Attackers who got in went looking for passwords, cloud credentials, and the keys that unlock the most powerful account on the system. One forgotten server can become a foothold into the rest of a cloud environment, and older Alpine images used in AWS and Azure are especially at risk.
What to do: Organizations should find any servers or devices running Alpine or similar lightweight Linux with SSH password logins enabled, update OpenSSH to version 10.6p2 or the vendor’s fixed package, and restart the SSH service so the update takes effect. Where updating isn’t possible right away, switch to key-based logins and turn password logins off. Check login records for successful password logins to accounts that shouldn’t have one.
Source: Hackread
06. Zoom Fixes Critical Flaw That Could Give Attackers More Control of Windows PCs
Zoom released fixes on November 10 for two flaws in Zoom Workplace, its desktop app for Windows. The more serious one, CVE-2026-108186, is rated 9.6 out of 10 and could let an attacker gain deeper control of a computer over the network without signing in, and it affects versions 7.1.0 up to 7.1.8. The second flaw, rated 8.1, comes from the app not properly checking where certain requests come from, and it affects versions before 7.1.5. Zoom’s own security team found the critical flaw, and the company says it isn’t aware of any attacks using either one. Zoom hasn’t published technical details about how the flaws work.
Potential impact: Zoom sits on nearly every work computer, so a single flaw in it reaches a huge number of machines. Desktop apps also tend to slip past patching programs that focus on Windows itself, especially when employees install them on their own. With no technical details public yet, organizations have a head start on attackers, and this is the latest in a run of Windows app fixes from Zoom since July, so it pays to make updates automatic.
What to do: Organizations should update Zoom Workplace for Windows to version 7.1.8 or later and confirm the update reached every computer, including copies employees installed themselves. Turn on automatic updates where company policy allows, and remove older copies of Zoom that no longer update. Individual users can check by opening Zoom and choosing Check for Updates from their profile menu.
Source: Security Affairs
The big picture
Convenience and reach tend to grow together. The tools that let one technician fix a hundred computers from a single desk, or let a website serve thousands of visitors, are the same ones an attacker most wants to control, because a single break-in pays off many times over.
That makes these tools worth a harder look than they usually get. Ask who can reach them from the internet and whether they need to be reachable at all, whether signing in takes more than a password, how quickly updates land, and which add-ons or older features are left running without anyone using them. If you work with an IT provider, these are fair questions to bring to them, and a good provider will already have the answers.
Make sure to check back here each week for another Threat Thursday update. See you then!
