Vulnerabilities
N-able has confirmed what the earlier 'God mode' warnings only implied: attackers used the N-central flaw (CVE-2026-18577) to reach downstream customer networks. A second hotfix has landed after the first fix was bypassed. Here is what MSPs should verify now.
Vulnerabilities
CISA added three actively exploited flaws in Langflow, N-able N-central, and Apache Tomcat to its KEV catalog this week, then flagged JetBrains TeamCity's CVE-2026-63077 under active exploitation. Two 9.8s and two deadlines — here's what to patch first and how to verify it.
Vulnerabilities
Seventy-two hours, not twenty-one days. CISA gave federal agencies just three days to patch the actively exploited N-able N-central "God mode" flaw that grants full administrative access to a console — and warned the vendor and MSPs that the hotfix is "not optional."
Artificial Intelligence (AI)
Fourteen thousand unknown flaws from one pipeline. Palo Alto Unit 42 says its NOVA system surfaced 14,000-plus previously unknown vulnerabilities across the open-source software supply chain — a scale that raises a hard question maintainers can't ignore: who triages them, and how many are real?
Vulnerabilities
The N-central flaw just went federal. CISA added CVE-2026-18577 (CVSS 8.2) to its Known Exploited Vulnerabilities catalog after N-able found a second vector past the original patch for CVE-2026-18556 — putting federal agencies on the clock and every MSP customer in scope.
Vulnerabilities
From hosting customer to database root. cPanel patched CVE-2026-58048 (CVSS 4.0 score 9.4), where an authenticated customer could execute SQL in the database's root context — crossing the account-to-admin boundary — and closed two more account-boundary routes in the same release.
Artificial Intelligence (AI)
The first documented agent-on-agent attack. Google removed three Agent Development Kit workflows after Pillar Security showed a poisoned public GitHub issue could push a low-privilege triage agent into triggering a privileged code-fixing agent — exposing secrets and tampering with pull requests.
Vulnerabilities
From auth bypass to patch bypass. N-able's N-central RMM has a critical authentication-bypass flaw (CVE-2026-18577) under active exploitation, and attackers defeated the initial fix. Build 2026.3.1.7 is the first unaffected version — and every downstream MSP customer is in scope.
Vulnerabilities
The fix is out. Ruby on Rails has patched the critical KindaRails2Shell flaw (CVE-2026-66066) that let unauthenticated attackers read arbitrary files and potentially reach code execution. What Rails operators should identify, upgrade, and restart now.
Vulnerabilities
One flaw, 41 minutes, seventy million dollars. Galaxy Research tied a July 30 sweep of 1,196 Coldcard-generated Bitcoin addresses to a 2021 firmware error that routed seed generation to a predictable software PRNG. What hardware-wallet owners should verify now.
Vulnerabilities
Adobe patched CVE-2026-48449, a CVSS 10.0 incorrect-authorization flaw in on-premise Campaign Classic that can run code with no authentication and no user interaction. The catch: build 9397, which fixed July's max-severity bug, is the version this one breaks. Patch to 9398.
Vulnerabilities
A follow-up on CVE-2026-63077: JetBrains ties the CVSS 9.8 unauthenticated TeamCity RCE to insecure deserialization in the agent polling protocol — the build-agent-to-server channel. What that mechanism detail changes for your exposure check and interim mitigation.