Today’s stories all trace back to tools your team trusts by default — the remote monitoring agent on every endpoint, the remote-support client IT already has installed, and the coding assistant a developer runs against a cloned repo. Here’s what’s new since yesterday’s digest.
Vulnerability watch: N-able ships fourth N-central hotfix in five weeks for a maximum-severity RCE flaw
N-able patched CVE-2026-86218, a CVSS 10.0 pre-authentication remote code execution flaw in N-central, its remote monitoring and management (RMM) platform used widely by managed service providers. The bug is a static code injection weakness that lets an unauthenticated attacker execute code directly on the N-central server. The fix shipped as N-central 2026.3 Hotfix 4 (build 2026.3.1.14) in the early hours of September 6 UTC — the third zero-day patched in this product in six weeks. Huntress researchers say they’ve confirmed active exploitation attempts against multiple customer environments, though N-able itself has not publicly confirmed exploitation in production. Help Net Security · The Hacker News
RMM platforms sit at the top of the trust chain — a compromised N-central server hands an attacker a management plane over every endpoint it administers. If you or a managed provider you work with runs N-central on-premises, confirm the build is 2026.3.1.14 or later today, and don’t wait for a formal breach notice to check your logs for unexpected admin actions or new agent installs originating from the N-central server itself.
Threat actor watch: Rogue ScreenConnect clients are spreading malware worm-style
Huntress disclosed three unrelated intrusions — a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake Geek Squad refund lure — that all led to the same outcome: a backdoored ConnectWise ScreenConnect client that repeatedly spawns wscript.exe to run a four-stage VBScript chain (1.vbs through 4.vbs) against every new host that connects to it. The payloads install additional backdoored clients, attempt a UAC bypass via ms-settings, try to bypass AMSI, add Windows Defender exclusions, and drop an XMRig miner disguised as SearchIndex.exe alongside a vulnerable driver used for further evasion. Because each newly infected client turns around and infects the next host that connects to it, the spread behaves like a worm rather than a one-off compromise. ConnectWise says a CVE and an official fix are coming within the week; until then, it recommends disabling file transfers for technicians. Help Net Security · The Hacker News
If ScreenConnect is part of your remote-support stack, this is a good day to audit which technicians have file-transfer permission and whether any of your deployed clients are talking to unexpected relay hosts. A remote-access tool is exactly the kind of process your detection rules should treat as high-privilege by default — alert on it spawning script interpreters, not just on new logins.
AI security watch: A Git config trick lets attacker code run inside coding agents
Manifold Security disclosed eight vulnerabilities across seven command-line AI coding agents, all rooted in the same trick: a cloned repository’s own .git/config can name a command the agent later executes on the developer’s machine, outside the agent’s sandbox and without an approval prompt. A booby-trapped repo’s README asks the victim to run one setup line — git config core.hooksPath .githooks — and ships a .githooks/pre-commit hook with attacker commands inside. The next time the agent commits as part of its normal workflow, Git reads .git/config, resolves the hook, and runs it. Fixes have shipped for Claude Code, Cursor, and goose; Hermes Agent, Qwen Code, Grok Build, and a second execution path in Claude Code were still vulnerable when Manifold retested on September 1. The Hacker News
This one matters even if your team doesn’t touch AI coding tools directly, because the exploit travels with the repository, not the tool — a .git directory copied via a shared drive, sync folder, or USB stick carries the trap with it. If developers on your team use AI coding agents against externally-sourced repos, patch to the latest agent version and treat any repo that asks for a manual git config step before first use as a red flag worth a second look.
Also noted
The Trezor shipping-vendor breach disclosed in August has widened to roughly 81,000 customers, after ShipMonk — the fulfillment vendor Trezor contracted with — failed to delete customer shipping data it was contractually required to remove following an earlier intrusion. Full names, email addresses, phone numbers, and home addresses for orders placed between November 2019 and August 2021 are exposed; Trezor says its own systems and devices were not compromised, but affected customers should watch for targeted phishing that references their real shipping details. Bloomberg · BleepingComputer
Final thought
Three different trust relationships got exploited today, and none of them required breaking cryptography or finding a novel bug class: an RMM agent that’s supposed to be your management plane became someone else’s, a remote-support client that’s supposed to help your team became a worm, and a coding agent that’s supposed to help a developer ship faster became a shell for whoever wrote the README. The pattern worth taking away is that “we trust this tool” is not itself a control — the control is what you monitor once you’ve extended that trust. If you want help making sure your detection logic actually flags anomalous behavior from the admin tools already living on your endpoints, see our how-to guides or book a discovery call.