Apache HTTP/2 RCE, ScreenConnect worm malware, GitHub account compromise campaign

Executive Summary

• Apache HTTP Server critical remote code execution flaw in mod_http2 affects versions 2.4.55–2.4.70; public proof-of-concept available and 64% of cloud environments contain vulnerable instances.
• ScreenConnect attacks deploy SCKit worm malware targeting managed service providers; compromised 288 endpoints across 48 organizations through RMM+ authentication bypass.
• Large-scale GitHub account compromise campaign (wfx-loot) used 4,837 stolen credentials to probe 61,764 repositories and steal cloud secrets, including from Fortune 100 companies and US government agencies.
• N-able N-central zero-day actively exploited for cryptocurrency mining; root-level access confirmed on at least 21 systems including those running latest security updates.

Top Threats Today

1. Apache HTTP Server Critical RCE in HTTP/2 Module

Severity: High   Affected: Technology

A race condition in Apache HTTP Server's mod_http2 module allows unauthenticated remote attackers to corrupt heap memory and execute arbitrary code ^[1][2]. The vulnerability, CVE-2026-119618, affects versions 2.4.55 through 2.4.70 and was independently discovered by researchers at Anthropic and Google Cloud ^[1]. The flaw stems from improper synchronization when multiple threads access shared resources during HTTP/2 header processing, potentially leading to memory corruption ⚠ and code execution with the privileges of the web server process ^[2].
Sources:[1] SecurityWeek[2] BleepingComputer

Only servers with HTTP/2 enabled are vulnerable; those serving HTTP/1.1 only are not affected ^[1]. According to cloud security firm Wiz, 64% of cloud environments contain resources running affected Apache versions, with 51% having publicly exposed instances; however, these figures do not account for server configuration ^[1]. Apache released version 2.4.71 on November 11 to address this issue, along with two additional flaws: CVE-2026-106023 (null pointer dereference in mod_md) and CVE-2026-109163 (low-severity stack buffer overflow in mod_vhost_alias) ^[1][2]. A proof-of-concept demonstrating memory corruption and process crashes exists on GitHub, though it does not demonstrate remote code execution ⚠^[1].
Sources:[1] SecurityWeek[2] BleepingComputer

2. ScreenConnect Attacks Deploy Worm-Like Malware to MSP Networks

Severity: High   Affected: Technology

A worm-like malware toolkit named SCKit was deployed in recent ScreenConnect attacks targeting managed service providers, designed to spread from infected customer devices to MSP technicians' computers and compromise additional managed networks ^[1]. The attacks compromised at least 288 endpoints across 48 organizations, with approximately one-third affected within the first 10 minutes and all targeted systems compromised within 90 minutes ^[1]. The initial access vector was RMM+, a third-party ScreenConnect extension; versions 1.0.31 and 1.0.32 contained an authentication flaw allowing attackers to execute commands without credentials or multifactor authentication by supplying a blank access key ^[1].
Sources:[1] BleepingComputer[2] Sophos News

SCKit exploits a previously patched ScreenConnect vulnerability, CVE-2026-84869, to execute malicious code on technician workstations, though researchers at Huntress and Blackpoint Cyber confirmed the exploit failed in testing against a patched ScreenConnect client ^[1]. The malware toolkit uses worm-like propagation techniques and relies on ScreenConnect's Run Command feature to install rogue remote-access clients on customer endpoints ^[1]. Sophos researchers observed curl.exe downloading malicious ScreenConnect installers from external IP addresses and PowerShell scripts retrieving second-stage payloads from attacker-controlled domains ^[2].
Sources:[1] BleepingComputer[2] Sophos News

3. GitHub Campaign Compromises 4,837 Accounts to Steal Cloud Credentials

Severity: High   Affected: Technology Government Finance

A credential-theft campaign dubbed 'wfx-loot' compromised 4,837 GitHub accounts to probe 61,764 repositories for write access and inject malicious code ^[1]. Researchers confirmed the threat actor stole secrets from at least 1,835 target repositories, with some compromised accounts belonging to Fortune 100 organizations, the US General Services Administration, the French government, Nextcloud, and WebdriverIO ^[1]. Approximately 50 of the compromised accounts held publishing rights on open-source package ecosystems including npm, PyPI, Go, crates, and Packagist, potentially enabling supply-chain compromise ^[1].
Sources:[1] BleepingComputer

The campaign began around November 10 when attackers used stolen GitHub credentials to open pull requests disguised as dependency audit notes, with 92% remaining ⚠ undetected by repository owners ^[1]. The threat actor delivered a 1,500-line credential-stealing shell script by modifying existing GitHub Actions workflows, with payloads targeting GitHub Actions secrets, OIDC tokens, cloud credentials (AWS, Azure, Google Cloud), and developer tool credentials including OpenAI, Anthropic, and GitHub Copilot ^[1]. The script also supports cloud privilege escalation by exchanging GitHub OIDC tokens for temporary AWS, Azure, and GCP cloud sessions ^[1].
Sources:[1] BleepingComputer

4. N-able N-central Zero-Day Actively Exploited for Cryptocurrency Mining

Severity: High   Affected: Technology

A newly disclosed N-able N-central zero-day vulnerability dubbed '4EverAble2Shell' is being actively exploited to compromise servers and deploy cryptocurrency miners, with at least 21 affected systems confirmed, including 19 running the company's latest security update ^[1]. The vulnerability combines an Apache Axis flaw (CVE-2026-90436) with a separate N-central privilege escalation weakness to achieve root-level access on vulnerable appliances ^[1]. Exploitation requires the platform's Legacy API functionality to be enabled; researchers confirmed exploitation can occur through unauthenticated remote access ^[1].
Sources:[1] BleepingComputer

The vulnerability was disclosed on November 12 through public proof-of-concept exploits released by security researcher Sean Bales, just two days after N-able released emergency security updates addressing earlier disclosed zero-days ^[1]. The disclosures followed N-able's decision to take hosted N-central environments offline and urge on-premises customers to shut down their servers ^[1]. Bales has stated that N-able has not patched two additional remote code execution vulnerabilities in a different N-able product that he previously disclosed to the company in July ^[1].
Sources:[1] BleepingComputer