~# cat ep8/notes.md

55:52

#EP 8

SSL VPN The Gift That Keeps On Giving

N-able took Hosted N-central offline worldwide after a researcher published 33 N-central vulnerabilities with proof-of-concept code, and told on-premises customers to follow. Plus a six billion dollar crypto heist that began with a fake job interview, an exploited SonicWall MFA bypass, an sshd password bypass in musl libc, and a backdoor that shipped in the firmware.

Watch on YouTube

In EP7 the trust was in a distribution channel. This week it moved into the platform that manages the endpoints. An RMM vendor took its own hosted environment offline worldwide, and a firewall vendor shipped a fix for a bypass with no workaround.

N-able takes Hosted N-central offline as Able2Shell lands

Sourcing: N-able’s own incident post (incident 202580, Major Outage, last updated November 10 at 15:16 UTC), the researcher’s public repository and disclosure post, Huntress analysis, SecurityWeek, and Beazley Security’s advisory. Disclosure: Tom works at Huntress, which published analysis cited here.

  • N-able took its Hosted N-central environments offline across the Americas, APAC and Europe, and told on-premises customers to keep their N-central servers offline until it confirms they can safely be brought back. This is the first time N-able has taken its hosted environment fully offline and told on-premises customers to follow.
  • The disclosure is Able2Shell: 33 vulnerabilities published to GitHub by Sean Bales (Oracle-Security) on November 9, with proof-of-concept code for four exploit chains. Three of the chains reach remote code execution and one reaches root. They were tested against N-central Appliance 2026.4.0.31 and are said to affect earlier versions as well. Bug classes in the coverage include authentication bypass, credential disclosure, arbitrary file write, path traversal, cross-site scripting, XXE and RCE.
  • As of November 10 at 15:16 UTC, N-able said it was observing “scanning activity associated with the published proof-of-concept code” and had “no evidence that any customer environment has been successfully exploited”. Its hotfix work was “on track with no setbacks”, with an estimated release of mid-day on November 10 Eastern. Beazley Security’s November 10 update went further, saying researchers had reported exploitation attempts in the wild.
  • No CVE identifiers had been assigned at that point. N-able had named neither the researcher nor the flaws, and had published no technical detail.

Hype check: offline is not compromised

  • The shutdown, the scanning observation and the hotfix timeline are vendor-attested on N-able’s own status page.
  • The 33 vulnerabilities are one researcher’s claims, carrying working proof-of-concept code. Nobody else had reproduced them, and the vendor had not acknowledged them by name.
  • Scanning activity and exploitation attempts are not a confirmed compromise. N-able said it had found no evidence of successful exploitation or unauthorised data access.

What stayed up

  • Ecoverse services reached through N-able Login stayed online: Asset View, Patching, Vulnerability Management, scripting, policies and tagging, for both hosted and on-premises partners, with or without Entra ID integration.
  • N-able also made N-able.app, Take Control from Asset View, and a preview of on-demand Windows Patching available while N-central itself was offline.
  • Huntress guidance was to review login and audit logs from November 8 onward. One report said Kaseya disabled associated Autotask API users.

Why an RMM is the story, not the count

  • N-central 2026.4 HF1, released November 2, addressed CVE-2026-98432, CVE-2026-111497 and CVE-2026-114406. That is the Linux kernel IPv4 TCP flaw from EP7 and the Brotli decoder flaw behind Node2Shell from EP6, sitting inside the RMM appliance.
  • N-central had already taken five flaws this year: CVE-2026-18556 and CVE-2026-18577 in August, both added to CISA’s Known Exploited Vulnerabilities catalog, and CVE-2026-86206, CVE-2026-86207 and CVE-2026-86218 in September, the last a CVSS 10.0 pre-authentication RCE that also went to KEV.
  • Beazley notes that researchers linked China-nexus Volt Typhoon to zero-day exploitation of two earlier N-central flaws in October 2026.
  • An RMM server is one credential away from every endpoint it manages. That is why a 33-entry proof-of-concept repository pointed at one matters more than the volume of advisories around it.

A WAF is a compensating control, not a fix

Asked on the show whether these flaws could be protected with a WAF: terminating and inspecting TLS at the WAF can plausibly catch the payload-shaped chains, such as XXE, path traversal, OGNL, oversized SOAP fields, and uploads that write JSP. It cannot see the authentication and logic flaws at all: the MMS3 passcode derived from the appliance ID, registration-token disclosure to a Technician role, zero-role policy download, MDM UDID impersonation, session and object mismatch, and the audit-record overwrite. The agent-facing services (MMS, MMS2 and MMS3) also have to stay reachable from every managed endpoint, so they cannot be narrowed to an allowlist the way the admin console can.

CIS Controls: 7.4 (Continuous Vulnerability Management), 15.1 and 15.4 (Service Provider Management, since the RMM is the provider holding the keys), 16.5 and 16.11 (Application Software Security).

Binance, TraderTraitor, and a coding assignment

Sourcing: the victim’s own incident report, the FBI alert, and independent reporting including The Record and SecurityWeek.

  • USD 6.34 billion was taken on October 29, attributed by the FBI, the Secret Service and IRS-CI to North Korea’s TraderTraitor. Pyongyang denies it.
  • June: a Wallet DevOps engineer downloaded a tampered Homebrew installer for an AI coding tool from a search result, replacing pyenv. Binance caught it, swapped the device and rotated credentials, and the attacker still kept the role intelligence.
  • September: a second engineer was approached by a fake recruiter on a real job platform, sat two interviews with fake HR and a fake CEO of a nonexistent company, then ran a “coding assignment” repository that called home. Binance describes the malware as 0-day because endpoint protection did not detect it.
  • October 29, 20:05 to 20:09 UTC: five hot wallets sent 233.46M XRP, about 970,500 SOL, 44.2M OP, then 18,270 BTC. EIP-7702 delegation then gave an attacker contract execution rights over a hot wallet. Because the wallets were MPC, there was no single key to revoke, so the team improvised a revocation procedure while transfers continued.
  • Binance says 2.85 billion dollars were frozen or intercepted, it absorbed the loss, and it had replenished 98 percent as of October 31. Elliptic’s tracking covers roughly 12,000 wallets across 11 chains and about 40,000 transactions, at a new wallet every 25 seconds.

Hype check

  • The attribution is government, and Binance cites it rather than making its own. The laundering figures are a vendor’s blockchain analytics, not the victim’s numbers.
  • “AI tool compromise” is not the headline. The path was a search result, a recruiter and a homework assignment, and the second stage defeated endpoint protection.

CIS Controls: 5.4 and 6.5 (Account Management, and Access Control Management for administrative access), 6.8 (role-based access control), 8.11 (Audit Log Management), 14.2 (Security Awareness and Skills Training, for developer-targeting social engineering), 17.4 (Incident Response Management).

SonicWall SonicOS SSLVPN authentication enforcement bypass

Sourcing: the vendor PSIRT advisory SNWLID-2026-0014, the vendor support notice, CISA’s KEV addition on November 6, the NVD record, and press coverage from BleepingComputer, SecurityWeek and Help Net Security.

  • CVE-2026-19868 (CWE-308) is one of seven flaws in SNWLID-2026-0014. A user with valid credentials for an alternate authentication method can bypass the SAML controls on the SSLVPN service, and therefore the MFA that SAML was enforcing. It only applies where SAML is enabled for SSLVPN logins, so the first question is who can reach the service at all.
  • Affected: Gen7 SonicOS 7.3.3-7015 and older, and Gen8 8.2.2-8015 and older. Fixed in 7.3.4-7013 and 8.2.3-8015. No workaround. CISA added it to KEV the same day, with a November 20 remediation deadline for federal civilian agencies and ransomware use listed as unknown.
  • Nobody has published attack details, indicators or an analysis of the intrusions. Reported by Ryan Harris of The Electronic Office.
  • The history is the argument: CVE-2024-40766 at 9.3 is still being exploited in waves two years on, and CISA and the FBI tied Akira initial access to it in November 2025. In September 2025 SonicWall’s own MySonicWall cloud platform was breached with firewall configuration backups exposed.

Hype check

  • The exploitation assertion is CISA’s KEV listing. The vendor said its PSIRT investigated a report of potential exploitation, and has not detailed it. Treat the exploitation status as the government’s claim, not an independently reported one.
  • “MFA bypass” is accurate but conditional. It needs valid credentials for an alternate authentication method first.

CIS Controls: 4.1 and 4.8 (Secure Configuration of Enterprise Assets and Software), 5.4 (Account Management), 7.4 (Continuous Vulnerability Management).

*sshole / CVE-2026-123158: any password logs in on musl sshd

Sourcing: OpenSSH release notes for 10.6p2, the Alpine advisory, the CVE record, the researcher’s repository and site, and Help Net Security. The deep dive reproduced this on the show.

  • sshd on musl libc with no PAM accepts any password of 257 to 1024 bytes when the account’s shadow field is exactly *. That is root on Alpine, key-only users, LDAP users via musl-nscd, and the alpine user on the official tiny-cloud images, which has passwordless doas.
  • The chain: musl’s crypt() has returned * on failure instead of NULL since 2012, sshd started borrowing another account’s salt in 2016 to fix the CVE-2016-6210 timing leak, and the comparison then matches * against *.
  • Fixed in OpenSSH 10.6p2 on November 5, and Alpine patched every branch back to 3.16. Exploited in the wild less than nine hours after publication, against a honeypot, with recon commands only. CISA has not added it to KEV.
  • Found by Özgün Kültekin of Wakefield using agent swarms, across 17,600 odd logins on 17 sshd build combinations.

Hype check

  • The in-the-wild claim is one vendor’s honeypot observation, unconfirmed by anyone else.
  • Two precision notes: the CVE record says “between 256 and 1024 characters” while everyone else says 257, because 256 fails in the lab. And OpenSSH describing the root cause as “outside sshd” is a live ownership dispute with musl, not a settled fact.

CIS Controls: 4.1 and 4.8 (Secure Configuration of Enterprise Assets and Software, and disabling services and accounts you do not need), 5.4 (Account Management), 7.4 (Continuous Vulnerability Management).

XCPE: the backdoor that shipped in the firmware

Sourcing: Google Threat Intelligence Group’s assessment, Synthient’s teardown and indicator list, Krebs on Security, and a Plume whitepaper.

  • Google assesses with high confidence that Videostrong Technology, a Chinese Android OEM/ODM, built, deployed and operated the backdoor for profit, selling access to criminal affiliates who pushed their modules onto the devices. Three stages: x.cpe preloaded in firmware at android.uid.system and reinstalling from /oem/ on reboot if the user uninstalls it, a loader (com.abc.nexus), then monetization modules.
  • The MQTT command and control could silently install apps, disable Play Protect by setting package_verifier_user_consent to -1, run shell as system UID, capture the screen, inject keystrokes and run network recon. Newer droppers since August 2026 use libexploit.so to restart adbd as root and install into /system/priv-app.
  • The modules turned the boxes into residential proxy exits (Linkfog, AppSalt/Honeygain, NetNut, Gaganode, IPWeb, Jaguar, Traffmonetizer) plus ad fraud. Synthient conservatively estimates 1.3 million backdoored devices with about 500,000 online daily, and recommends disposal rather than cleanup.
  • The same code was found on telehealth devices, karaoke machines and digital signage.
  • Google took legal action against the Videostrong command and control and against a dozen-plus affiliate domains, banned Videostrong and its successors from certified Android devices, and tightened firmware integrity checks. There is no patch for a device you already own.

Hype check

  • The device count is a conservative estimate, and the larger figure circulating is an assessment rather than a count.
  • “Supply chain attack” is the right shape, but the supplier is the hardware OEM, not a software dependency. Nobody compromised Videostrong to do this.

CIS Controls: 1.1 and 2.1 (Inventory and Control of Enterprise Assets, and of Software Assets, including what is inside the firmware), 9.2 (Email and Web Browser Protections), 12.2 and 12.4 (Network Infrastructure Management), 15.1 and 15.4 (Service Provider Management, for the hardware vendor rather than a software one).

DigiCert: sixteen months on the wrong side of the network

Sourcing: the CA’s own compliance filing in Mozilla bug 2084460, root program policy text, The Record and The Register.

  • An internal business system was moved out of a VPN segment into an internet-reachable availability zone on 2025-02-04 and stayed there for 16 months. It carried a self-registration feature that was never meant to be on it, and accounts registered that way skipped the MFA DigiCert otherwise requires while still able to read archived data.
  • One such account read customer records between 2026-06-27 and 2026-07-02: names, business emails, phones, business addresses, and for a minority of accounts a customer-supplied identification document. DigiCert says read-only access, zero certificates affected, no validation actions taken, and customer credentials safe.
  • The detection timeline is the story. An internal team saw unknown accounts on 2026-06-18 and concluded they had no data access. A managed security program report the same week flagged account creation. The system was patched 2026-07-02. Data access was only suspected on 2026-10-12, confirmed 2026-10-19, and reported 2026-10-20.
  • The record count is still undisclosed. In the same fortnight, TWCA and D-Trust filed archive incidents of their own.

Hype check

  • The narrative is the CA’s own compliance filing, so it is vendor-attested. The incident is real; the scope is still unknown.
  • “CA breach” does not mean certificates were forged. This was a records archive, read-only, with no issuance or validation impact reported.

CIS Controls: 3.12 (Data Protection), 4.1 (Secure Configuration), 6.4 and 6.8 (Access Control Management), 8.11 (Audit Log Management, for how long it took to notice).

Residential proxy exits on the White House network

Sourcing: Layer3 Intel’s observatory, Synthient’s per-session detection, and The Register.

  • Layer3 Intel recorded 236 residential proxy exits from six addresses on the Executive Office of the President’s network (AS2650) across 26 of 30 days, from October 5 to November 3, via 28 separate proxy services.
  • Synthient’s per-session detection identified Windows 10 and 11 devices beaconing to Geonode, Infatica and Mellowtel, and named Rave.io, a watch-party streaming app that bundles 12 proxy SDKs, as the likely install. Activity reportedly stopped the night after the blog went live.

Hype check

  • “White House network hijacked” oversells it. This is public proxy access observed from devices on the network, not a breach, and there is no evidence any rented exit was used to attack anything.
  • The Infatica founder’s unrelated history from 2016 is background, not causation, and he denied knowing at the time.

CIS Controls: 2.1 and 2.5 (Inventory and Control of Software Assets, and allowlisting authorised software), 9.2 (Email and Web Browser Protections), 12.4 (Network Infrastructure Management). You cannot allowlist software you have not inventoried, and a free app that monetizes bandwidth is an egress problem before it is a malware problem.

Terminal2Shell: the parody advisory that makes the point

Sourcing: the parody site itself, plus a writeup and a community detection project. It is satire, the author is not named on the page, and there is no CVE, no vendor and no advisory.

  • terminal2shell.com is a parody advisory for a “design-level vulnerability in terminal emulators”: opening a terminal spawns a shell wired to your keyboard. It lists “CVSS 11.0 out of 10”, is “also tracked as TermGeddon”, has a “CVE ID pending”, and its affected list includes the DEC VT100 over a serial cable. Mitigations include removing the keyboard.
  • It works because the real ones beside it were real: PHP2Shell (CVE-2026-109618 and CVE-2026-109619, disclosed October 20 to 21), the Brotli bug that shipped as Node2Shell, then Python2Shell, then HTTP2Shell (CVE-2026-111497), and Able2Shell, which put 33 N-central proofs of concept out on the same day as this page.
  • Say plainly that it is a joke before the audience goes looking, then use it: the naming contest has outrun the reporting, and a logo is not an exploit.

CIS Controls: 15.4 and 16.5 (Service Provider Management, and Application Software Security). Read the advisory, not the logo, and check whether a scary name maps to a reachable exploit. NIS2: Article 21(2)(d) on supply chain security assertions.

Three things to do before Monday

  1. Get N-central offline or contained (CIS 7.4, 15.1; NIS2 6.6). If you run N-central on premises, it should be offline until N-able confirms it is safe to restore, and that includes test, staging and disaster recovery instances. If one cannot go offline, remove its internet exposure, restrict access to trusted administrative networks, and treat it as at risk. Review login and audit logs from November 8 onward.
  2. Patch the two authentication bypasses (CIS 4.1, 4.8, 5.4, 7.4). SonicWall to 7.3.4-7013 or 8.2.3-8015, with no workaround available. OpenSSH to 10.6p2, and confirm password authentication and root login are off for the accounts whose shadow field is *.
  3. Find what you have not inventoried (CIS 1.1, 2.1, 9.2, 12.4). Internet-reachable administrative interfaces, the TLS backends inside embedded gear, and the devices on your networks that monetize their own bandwidth. An RMM server belongs in the first list, and its agent-facing services cannot be allowlisted the way its console can.

Sources

N-able / Able2Shell

Binance

SonicWall

sshole

XCPE

DigiCert

White House proxy exits

Terminal2Shell