Hijacked GitHub identities turn CI pipelines into cloud accessMicrosoft 365 outage puts Defender XDR continuity under reviewSCKit turns ScreenConnect support sessions into an MSP-wide incidentN-central exploit bypasses the latest hotfix and gains root
Hijacked GitHub identities turn CI pipelines into cloud access
The active wfx-loot campaign used compromised developer and bot identities to insert credential-stealing code into trusted build workflows, erase execution records and establish cloud access that can survive ordinary secret rotation.
Security.io Intelligence Desk · Friday, 13 November 2026
Executive consequence
Treat any wfx probe generated by an internal identity as confirmed credential compromise. Where the payload or a deleted workflow run is found, assume every secret, runtime token and cloud role available to that workflow was exposed.
Decision today
Suspend write access for identities linked to wfx probe pull requests.
Read the full decision briefPrimary reporting: GitHub · Aikido Security · StepSecurity · SafeDep · The Hacker News
Decision intelligence, not a headline feed.Every edition ranks what security leaders should read first, assign today and monitor next.
Daily executive briefing
Security.io Daily Headlines
Five equally weighted stories: what happened and the leadership decision each creates.
Microsoft reported a multi-service degradation involving Exchange Online, Teams, SharePoint Online, Microsoft 365 Copilot and Defender XDR. The company said affected servers became unavailable as a core process was overwhelmed, producing capacity loss rather than a traffic-driven spike.
Do today
Activate an out-of-band communications channel for security and crisis teams.
ConnectWise is investigating unauthorised access to partner ScreenConnect environments and disabled five independently developed extension variants in approximately 400 cloud environments as a precaution.
Do today
Disable Labtech Plus and every RMM+ family extension in ScreenConnect tenants.
The 4EverAble2Shell chain was publicly released and weaponised against N-able N-central within hours. Huntback identified 21 active mining rigs on production N-central servers, including 19 reporting Hotfix 2 build 2026.4.1.26.
Do today
Disable and firewall the Legacy API on every on-premises N-central server.
CVE-2026-119618 is a concurrency flaw in Apache HTTP Server's mod_http2 assign_headers() handling that can corrupt memory and enable unauthenticated remote code execution. Upstream Apache versions 2.4.55 through 2.4.70 and standalone mod_h2 versions 2.0.8 through 2.0.42 are affected.
Do today
Inventory Apache listeners with HTTP/2 or h2c enabled.
