Featured Posts
ScreenConnect Attacks Deploy SCKit Malware Across MSP Environments, Targeting 288 Endpoints in 48 Organizations
CVE Research
ScreenConnect Attacks Deploy SCKit Malware Across MSP Environments, Targeting 288 Endpoints in 48 Organizations
A new worm-like malware toolkit called SCKit targets managed service providers (MSPs) by abusing ScreenConnect remote access sessions. The campaign attempts to move from infected customer endpoints to MSP technicians' workstations, potentially exposing additional customer networks. Researchers identified activity affecting at least 288 endpoints across 48 organizations.

CVE Research
Critical Apache HTTP/2 RCE Flaw Lets Unauthenticated Attackers Take Full Control of the Server
CVE-2026-119618 is a critical race-condition vulnerability in Apache HTTP Server’s mod_http2 that can lead to unauthenticated remote code execution when HTTP/2 is enabled. Versions 2.4.55 through 2.4.70 are affected and fixed in 2.4.71. Only hosts that negotiate h2 or h2c are exposed. This article covers how the flaw works, distribution fixes, temporary Protocols mitigation, and related issues in the same release.

CVE Research
Microsoft’s November 2026 Patch Tuesday: 1,093 Vulnerabilities, 63 Critical Fixes, and an Outlook Threat
Microsoft’s November 2026 Patch Tuesday addresses 1,093 security vulnerabilities, including 63 Critical flaws and an actively exploited Outlook zero-day. The updates tackle serious remote code execution, privilege escalation, and information disclosure vulnerabilities across Windows, Exchange Server, SharePoint, Azure, and other Microsoft products. Explore the most critical flaws, affected products, and essential remediation steps to secure your systems.

