Security Act now
From 3 to 10 November 2026, CISA added exploited vulnerabilities to its KEV catalog, including Outlook flaw CVE-2026-124194. Three reports put Microsoft’s 10 November patch total at 1,094, 1,093 and 1,259.
Security Act now
N-able said Thursday it is investigating alleged flaws in on-premise N-central 2026.4.1 HF2 after attacks on a bug dubbed 4EverAble2Shell hit at least 21 servers, 19 of them on Hotfix 2. The company is limiting some product features while it finishes remediation.
Security Act now
On 11 November 2026, attackers used cloud-hosted ScreenConnect consoles at managed service providers to deploy rogue clients and the SCKit worm, reaching at least 288 machines in 48 organizations. ConnectWise has disabled five third-party extensions; Huntress blames a blank key in RMM+, while The Hacker News reports exploitation of patched CVE-2026-84869.
Security Act now
Apache HTTP Server 2.4.71 already corrects CVE-2026-119618, a critical mod_http2 bug that can let a remote attacker execute code. It hits releases 2.4.55–2.4.70 only when HTTP/2 is enabled, Red Hat says.