Daily Briefing

Chrome bug under active attack as Apache and N-able flaws add to a heavy patch day

By The IT Security Desk

Good morning. Start with the browser. CISA's Known Exploited Vulnerabilities catalog lists CVE-2026-125350 in Google Chrome as known to be exploited. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 8.8. Google's advisory lists Chrome up to the fix in 157.0.8103.50 as affected. The same stable-channel update cycle also addressed CVE-2026-125347 (CVSS 9.6, fixed in 157.0.8103.50) and, in a later build, CVE-2026-126859 (CVSS 9.6), CVE-2026-126881 and CVE-2026-126880 (both CVSS 8.8) and CVE-2026-126883 (CVSS 7.5), all listed as fixed in 157.0.8103.78. Update Chrome to the fixed release Google names and confirm the browser has restarted to apply it.

SecurityWeek reported that Apache patched a critical HTTP Server flaw, a mod_http2 race condition found by Anthropic and Google that could let an unauthenticated attacker execute code on servers with HTTP/2 enabled. BleepingComputer reported the same HTTP/2 remote code execution fix. If you run Apache HTTP Server with HTTP/2, apply the vendor's patch.

Active exploitation ran in parallel. BleepingComputer reported attackers exploiting a newly disclosed N-able N-central zero-day dubbed "4EverAble2Shell" within hours of a proof-of-concept release to deploy cryptocurrency miners, with researchers reporting at least 21 affected systems, 19 of them on the company's latest security update. BleepingComputer also reported a worm-like malware toolkit named SCKit deployed in recent ScreenConnect attacks on managed service providers, built to spread from infected customer devices to MSP technicians' machines and reach further managed networks. MSPs should treat both as urgent.

Read the full briefing →

Zoom out: Two separate remote-management and MSP tools — ScreenConnect and N-able N-central — were being abused in live attacks on the same day.

Vulnerability in focus

CVE-2026-125350 — Google. CVSS 8.8 CISA lists it as known to be exploited.

Affected: chrome.

What to do: Follow the vendor advisory for the fixed release and any interim mitigation.

Elsewhere

Help Net Security: Stolen webcam clips of 900+ victims feed North Korea’s $400 million fake Zoom scheme Read it
Help Net Security: Suspected North Korean IT workers reached onboarding at companies with open data Read it
The Hacker News: Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2 Read it
Help Net Security: Google smart glasses privacy features cover wearers and the people around them Read it
Help Net Security: PostgreSQL security update fixes 52 vulnerabilities, ends support for PostgreSQL 14 Read it
The Record: Feds announce seizure of $1.2 billion from Binance theft; also takedown of ‘FaceStealer’ tools Read it
The Register: OpenAI launches security products, tells orgs they’re doomed if they don’t use them Read it
BleepingComputer: New N-able "4EverAble2Shell" zero-day exploited hours after PoC released Read it
The Record: United to block customers from using AI agents, citing cyber threats Read it
BleepingComputer: Apache HTTP Server patches critical HTTP/2 remote code execution flaw Read it
The Hacker News: New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Read it
The Hacker News: ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories Read it

Sources

Google smart glasses privacy features cover wearers and the people around them Help Net Security
New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks BleepingComputer
Feds announce seizure of $1.2 billion from Binance theft; also takedown of ‘FaceStealer’ tools The Record
OpenAI launches security products, tells orgs they’re doomed if they don’t use them The Register
ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories The Hacker News
Apache Patches Critical HTTP Server RCE Found by Anthropic, Google SecurityWeek
Siemens Industrial Edge Management CISA
Who Runs the Ransomware Group Qilin? Krebs on Security
Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters Help Net Security
PostgreSQL security update fixes 52 vulnerabilities, ends support for PostgreSQL 14 Help Net Security
Hackers compromise 4,800 GitHub accounts to steal cloud credentials BleepingComputer
New N-able "4EverAble2Shell" zero-day exploited hours after PoC released BleepingComputer
United to block customers from using AI agents, citing cyber threats The Record
Apache HTTP Server patches critical HTTP/2 remote code execution flaw BleepingComputer

Share this issue

Facebook · X · Reddit · LinkedIn · WhatsApp · Email · Bluesky

Every briefing is on the site, with the advisory record behind it. All briefings