Security.io Daily Headlines — Thursday, November 12, 2026
Five equally weighted developments: what happened and the leadership decision each creates.
Listen to today’s episode
Listen to the edition’s five developments and leadership decisions.
Episode transcript
5 developments · Executive decision contextThis is Max Vogal from Security.io with today’s Daily Headlines for Thursday, November 12, 2026. Here are the top five security developments shaping today’s decisions—what happened, why each matters now, and the leadership action to consider.
ScreenConnect campaign turns MSP support sessions into a customer propagation path
What happened
ConnectWise and Huntress disclosed an active campaign affecting ScreenConnect partner environments and downstream customer devices. A live campaign is using compromised ScreenConnect environments to install rogue remote-access clients and may turn technician sessions into a route for further downstream propagation.
The leadership decision
Security leaders should disable the five listed third-party extensions and prevent reinstall. The MSP security lead should freeze interactive ScreenConnect sessions to suspected hosts, isolate affected systems with separate tooling and preserve authentication, extension, administrative, Run Command and Toolbox records before cleanup.
New N-central exploit claim shifts HF2 closure to Legacy API isolation
What happened
N-able’s HF2 hotfix remains required, but a new public exploit chain called 4EverAble2Shell is reported to work against build 2026.4.1.26 when the non-default Legacy API is enabled and internet-exposed. HF2 addressed CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882 and CVE-2026-91000.
The leadership decision
Security leaders should keep on-premises N-central inaccessible from the internet. The N-central platform owner should keep every on-premises instance off the public internet, prove Legacy API is disabled and retain HF2 as the minimum supported baseline. Do not reconnect solely because the hotfix is installed; configuration and exposure evidence now form part of the remediation decision.
Barracuda root chain requires compromise review, not patch-only closure
What happened
CVE-2026-116606 can bypass authentication on Barracuda Email Security Gateway, while CVE-2026-111560 can execute commands as root across several Barracuda appliances. Barracuda confirmed exploitation of a two-flaw appliance chain that can reach root, while CISA requires both remediation and forensic triage.
The leadership decision
Security leaders should identify every Barracuda appliance and administrative-interface exposure. The email or network security owner should establish an appliance-level inventory covering product, version, patch ID and administrative-interface reachability. Prioritise devices exposed to untrusted networks, but do not treat internal-only reachability as proof that exploitation was impossible.
Railway report turns AI keys into a financial and machine-identity risk
What happened
Railway’s detailed report materially expanded the known scope of its October intrusion. The company said an attacker exploited its build infrastructure, moved through internal systems and decrypted variables for an upper bound of about 100,000 workspaces.
The leadership decision
Security leaders should review AI-provider usage and billing for unauthorised consumption. Cloud platform and IAM owners should treat every relevant secret stored before containment as requiring a documented disposition. Rotate AI-provider keys first because they can create immediate cost, then cloud, database, payment, repository and registry credentials according to reachable privilege.
Maersk confirmation exposes the governance gap around acquired legacy systems
What happened
Maersk confirmed that an unauthorised party accessed and extracted data from a local legacy system inherited through a previous acquisition. Maersk confirmed data extraction from an inherited local legacy system; WhiteArmor’s $5 million extortion and 100 GB claim remain unverified.
The leadership decision
Security leaders should inventory acquired logistics systems that remain outside standard controls. Enterprise risk owners should use the incident to test acquisition governance: identify inherited systems, their business owners, stored data, local administrators, integration credentials, security-control coverage and retirement dates.
That’s Security.io Daily Headlines for Thursday, November 12, 2026. Full reporting, sources, executive actions and today’s comic are available in the complete edition at Security.io. I’m Max Vogal. Thanks for listening.