CyberNews: 07/09/2026 Edition

Today’s roundup

N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw

Researcher Publishes CrowdStrike Privilege Escalation Zero Day

Rhysida Publishes Berlin Government Data After €2m Extortion Demand Refused

Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released

North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters

Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts

JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies

Multiple Class Action Lawsuits Filed Against IDScan

Summary

N-able released Hotfix 4 for its N-central remote monitoring and management platform, its fourth hotfix in five weeks, to fix an unauthenticated remote code execution flaw. Every on-premises build below 2026.3.1.14, including servers updated to Hotfix 3 a day earlier, needs it. N-able's incident notice says the flaw has been exploited in the wild, while its release notes call that unconfirmed.

A security researcher published a zero-day exploit for CrowdStrike that could allow attackers to escalate privileges.

The Rhysida ransomware group published data stolen from the Berlin state government after a €2 million extortion demand was refused. The dataset reportedly includes Berlin state employee data and highly sensitive emergency plans.

TantoSec published a working proof-of-concept that turns an AES-CBC padding oracle in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution. It only works against applications in a specific non-default configuration, Progress patched the chain in July, and no exploitation in the wild has been confirmed.

Sekoia and Kudelski Security observed that North Korea's Lazarus umbrella is split into six distinct clusters focused on espionage, financial theft and sanctions evasion.

Huntress described worm-like activity abusing ConnectWise ScreenConnect to push a four-stage VBScript payload to newly connected hosts. Three unrelated incidents used different initial access methods, including a Quick Assist tech-support scam and a phishing-delivered MSI installer.

Check Point Research analyzed JSCeal, a compiled V8 JavaScript malware with credential harvesting, surveillance and traffic-interception capabilities that can bypass Google authentication with stolen session cookies. Its payloads are protected with RC4-encrypted strings, control-flow flattening and other obfuscation layers.

Several victims of a recent breach of driver's license information have filed class action lawsuits against IDScan, the company they believe responsible.

Want to dig deeper?

Malware Families

Rhysida
WEEVILPROXY	JSCEAL