Weekly Situation Report — 8/10/26

• N-able has warned that an authentication bypass vulnerability in N-central is being actively exploited to gain unauthorized access to affected systems.

• A critical Ruby on Rails vulnerability (CVE-2026-66066), dubbed “KindaRails2Shell,” enables arbitrary file reads and may allow remote code execution.

• A new Shai-Hulud supply chain wave dubbed “Chain-DROP” has compromised thousands of npm packages through the compromised keyv ecosystem.

• A privilege escalation vulnerability in Open vSwitch allows local attackers to obtain root-level access on affected Linux systems.

1. N-able warns of N-central auth bypass flaw exploited in attacks

Summary

N-able warns customers about active exploitation of an authentication bypass vulnerability in its N-central RMM platform. The vendor strongly recommends immediate installation of hotfix 2026.3.1.7 on both hosted and on-premises servers to prevent administrative account takeover. CISA recently added the flaw to its Known Exploited Vulnerabilities (KEV) catalog.

Category: Known Exploited Vulnerabilities

Industry: Technology

Sources

• https://www.bleepingcomputer.com/news/security/n-able-warns-of-n-central-auth-bypass-flaw-exploited-in-attacks/

• https://uptime.n-able.com/event/201454/

• https://www.n-able.com/blog/n-central-security-update-august-2-2026

• https://www.n-able.com/blog/n-central-security-update-august-6-2026

• https://www.huntress.com/blog/n-able-vulnerability-exploitation

• https://www.wiz.io/blog/tracking-teampcp-investigating-post-compromise-attacks-seen-in-the-wild

• https://www.team-cymru.com/post/scattered-spider-attacks-infrastructure-profile

Analyst comments

N-able has identified active exploitation of CVE-2026-18577, an authentication bypass vulnerability in N-central. The flaw stems from an incomplete patch for CVE-2026-18576 and impacts all N-central versions prior to 2026.3. The vendor rapidly deployed hotfix 2026.3.1.7, which requires manual installation for on-premises servers while hosted instances are updated automatically. Administrators are instructed to scan for specific compromise indicators: known malicious indicators, a rogue Cloudflared service, and misplaced svchost.exe files within user directories.

Exploitation is likely attributable to a single threat actor or a small handful of actors. No public PoC of the vulnerability is available, nor are there specific technical details about it. Analysis of dark web sources found no advertising of the vulnerability, indicating sharing amongst private groups only. The vendor states that agents are not affected, which indicates the flaw is likely affecting the management or server node of N-central deployments. The threat actor is using both NordVPN and Mullvad VPN IP addresses for some of the detected infrastructure. No attribution is made yet, however groups like Scattered Spider and recent group TeamPCP have made heavy use of the VPN vendors in previous attacks. The vendor has released detection scripts that check for the presence of known IoCs, such as svchost.exe in user locations.

IoCs:

173.249.252[.]176 United States AS11878 tzulo, inc. KGY, LLC static-173-249-252-176.cust.tzulo.com
173.249.252[.]200 United States AS11878 tzulo, inc. KGY, LLC static-173-249-252-200.cust.tzulo.com
185.156.46[.]150 United States AS212238 Datacamp Limited Cdnext ASH unn-185-156-46-150.datapacket.com
23.234.94[.]43 United States AS11878 tzulo, inc. tzulo, inc. static-23-234-94-43.cust.tzulo.com
37.153.90[.]88 Spain AS60494 AIRE NETWORKS DEL MEDITERRANEO SL UNIPERSONAL Unelink Telecom, S.A. ded-une3053.unelink.net
37.19.210[.]32 United States AS212238 Datacamp Limited Cdnext DEN unn-37-19-210-32.datapacket.com
68.235.46[.]214 United States AS11878 tzulo, inc. tzulo, inc. static-68-235-46-214.cust.tzulo.com
68.235.46[.]235 United States AS11878 tzulo, inc. tzulo, inc. static-68-235-46-235.cust.tzulo.com
87.249.138[.]34 United States AS212238 Datacamp Limited DataCamp Limitedunn-87-249-138-34.datapacket.com
92.118.112[.]181 United States AS215540 GLOBAL CONNECTIVITY SOLUTIONS LLP Global Internet Solutions LLC 170781.ip-ptr.tech

# Domains in use
mousears.synology.me - resolves to 87.249.138.34
wagoosh.direct.quickconnect.to - resolves to 87.249.138.34

Actionable guidance

Two hotfixes are available from the vendor that remediate this issue, however if no patches have been applied yet, Hotfix 2 is recommended. Hotfix 2 needs to be applied to fully mitigate this vulnerability (this should be applied even if Hotfix 1 was applied previously). Additionally, if N-central servers do not need to be exposed to the public internet, then deployment should be restricted to internal LAN environments only to minimize the attack surface. Monitoring should be in place to audit logins and locations to N-central assets deployed on-premises that link back to known VPN or VPS addressing. If compromise is suspected, look for the following: a rogue svchost.exe process run from user-related folders (such as C:\Users\someusername), unfamiliar IP address connections, or rogue Cloudflared services.

2. KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails

Summary

A critical vulnerability in Ruby on Rails’ Active Storage image processing with libvips enables unauthenticated attackers to read sensitive files and potentially achieve remote code execution. Affected versions should be patched immediately, libvips updated, and potentially exposed secrets rotated.

Category: Critical Vulnerabilities

Industry: Technology

Sources

• https://www.rapid7.com/blog/post/etr-kindarails2shell-cve-2026-66066-critical-arbitrary-file-read-and-possible-remote-code-execution-in-ruby-on-rails/

• https://ethiack.com/info-hub/research/kindarails2shell-how-a-matlab-file-reads-your-secrets-and-pops-a-shell-on-ruby-on-rails

• https://www.helpnetsecurity.com/2026/08/03/kindarails2shell-cve-2026-66066-vulnerability/

Analyst comments

CVE-2026-66066, nicknamed “KindaRails2Shell,” is a critical vulnerability in Ruby on Rails. It allows unauthenticated attackers to exploit image-upload features and read sensitive server files or execute remote code. The flaw arises from the default Active Storage image processor, libvips. That processor handles standard images safely, but becomes dangerous when processing crafted files disguised as images, because of unsafe background file-handling operations. Applications running Rails 7.0 through 8.1 (prior to their latest patch releases) that rely on the default “vips” processor are at risk, while those configured with ImageMagick remain unaffected.

This vulnerability is not known to be exploited in the wild at this time. Public research is available, however, that would allow exploitation of this vulnerability. The vulnerability itself requires several preconditions in order to be abused effectively. These include: VIPS_BLOCK_UNTRUSTED not set; Rails 7 or later; libvips built with libmatio; and a variation_key that can be retrieved from any Rails install currently online or even through archived Rails applications. A crafted .mat (MATLAB) file with HDF5 data is then supplied, pointing to a location on disk that is accessed and retrieved. The crafted file begins with a MATLAB 5.0 header, followed by a 0x0200 at offset 124, which libmatio reads for version information. The HDF5 content follows, containing the data pointing to the desired file to leak.

An indicator of compromise may include a user-uploaded image file with the hex contents below, which are a high signal of attempts to abuse this vulnerability:

# Hex extract of sample MATLAB crafted file with .bmp extension. Note the presence of "MATLAB 5.0" and 0002 before the IM terminator.
00000000: 4d41 544c 4142 2035 2e30 2065 7874 6572  MATLAB 5.0 exter
00000010: 6e61 6c2d 7374 6f72 6167 6520 7361 6665  nal-storage safe
00000020: 206c 6162 2020 2020 2020 2020 2020 2020   lab
00000030: 2020 2020 2020 2020 2020 2020 2020 2020
00000040: 2020 2020 2020 2020 2020 2020 2020 2020
00000050: 2020 2020 2020 2020 2020 2020 2020 2020
00000060: 2020 2020 2020 2020 2020 2020 2020 2020
00000070: 2020 2020 2020 2020 2020 2020 0002 494d  ..IM

The vulnerability is unlikely to be used for operations and campaigns where stealth is a goal, as the multiple requests to a single server may prohibit other stages of the attack chain if detected early. Given this, it is less likely to be used by groups for espionage purposes, and more likely be used by hacktivists, lone-wolf actors, or eCrime actors.

Actionable guidance

Remediation requires immediately upgrading to patched Rails versions, updating libvips to version 8.13 or newer, and rotating potentially exposed credentials. Deployments configured with ImageMagick remain unaffected. Detection opportunities will be most beneficial looking for user-uploaded image files with MATLAB 5.0 headers and 0x200 preceding the IM terminator.

3. New Shai-Hulud Wave Dubbed “Chain-DROP” Stemming from keyv Has Compromised Thousands of npm Packages

Summary

A new Shai-Hulud supply-chain campaign dubbed “CHAIN-DROP” has compromised thousands of npm packages. Since the start of this wave, the attacks have shifted some focus to golang-related repositories.

Category: Supply-chain

Industry: Technology

Sources

• https://rss.x.com/SocketSecurity/status/2084614244188774621#m

• https://x.com/MsftSecIntel/status/2084642457048752134#m

• https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/

• Internal OSec Research

Analyst comments

A Shai-Hulud wave, dubbed CHAIN-DROP by Microsoft, has compromised popular npm packages, stemming from compromise of @keyv and @cachable repositories. The activity was observed on Tuesday morning, August 4th, 2026, and has grown in size and impact since it was first seen. So far, the supply-chain attack has compromised over 2,200 packages and is still ongoing. The threat actor is suspected of using large file sizes to evade static scanning, along with base64 (and potentially base91) obfuscation. The attack is theorized to be due to GitHub PAT or credential compromise, with GitHub OIDC used to publish trojanized versions of the affected packages. There is some indication, based on social media discussion, that the original access token compromised in regard to keyv has been revoked.

The campaign has recently expanded to golang packages in addition to npm; the new golang packages are listed below. It is suspected that the compromise originally stemmed from the @keyv repository through GitHub PAT (Personal Access Token) and credential theft, giving the actor access to publish a malicious trojanized version (6.0.0) of @keyv via GitHub OIDC. This has gone on to infect several other popular packages, with an expanding victim pool. Compromised accounts at last count numbered around an estimated 1,300, based on searches for the malicious string “Shai-Hulud: Here We Go Again” on GitHub. The malware will drop two files and make edits to package.json.

The math*.js files are large in size (around 700 KB or more) to evade static detection, and contain the primary infostealer code and C2 communications. Additionally, after compromising package repositories, the threat actor is deleting commits and repositories themselves to reduce the evidence of compromise. We are continuing to run analysis against the malware samples in our possession. We have also compiled IoCs from external sources for immediate defensive action. Additionally, there is some indication to suggest that EtherHiding techniques are being used to update C2 domains.

# Dropped files
math_init.js
Math_Symbols.js
setup.mjs

# From keyv setup.mjs sample / note the + additions
package.json
{
"name": "keyv",
- "version": "6.0.0-rc.1",
+ "version": "6.0.0",
"description": "Simple key-value storage with support for multiple backends",
@@ -77,6 +77,9 @@ "type": "module",
"dist",
- "LICENSE"
+ "LICENSE",
+ "setup.mjs",
+ "Math_Symbol.js"
],
"scripts": {
"build": "tsdown",
+ "preinstall": "node setup.mjs",
"lint": "biome check --write --error-on-warnings",
@@ -83,0 +86,0 @@ "lint:ci": "biome check --error-on-warnings",

Compiled known IoCs:

# Hashes
setup.mjs fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668 math_init.js Math_Symbol.js 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc

# Network locations
Domains
npm-cache[.]com - Exfil domain (104.21.35[.]216, Cloudflare)
eth-mainnet.nodereal[.]io - ETH RPC (35.175.164[.]77, Amazon)
go.getblock[.]io - ETH RPC (185.44.207.215)
eth.llamarpc[.]com - ETH RPC (172.67.167.200, Cloudflare)
pypi-get[.]com
js-mirror[.]com

Actionable guidance

The network domains are likely dynamic and will update based on smart contract activity to ETH RPC addresses. Therefore, if not necessary, these network addresses should be blocked. Defenders should look for the following preinstall hook ("preinstall": "node setup.mjs"), in addition to newly added math_.js files noted above. The code will be heavily obfuscated, with the primary stealer code (math_.js) estimated around 700 KB or more in size. Identifying the string “Shai-Hulud: Here We Go Again” within repositories is also an indicator of compromise. The golang repositories show no changes in filenames dropped by the attack. Therefore, presence of setup.mjs and math_*.js with obfuscated code and similar sizing noted above will help detect potential compromise. Any project using a compromised version of these packages should stop their use and audit its codebase for potential infection by this malware.

4. Linux PrivEsc in Open vSwitch Gives Root Access

Summary

OVSwrap is a Linux kernel vulnerability in Open vSwitch that became exploitable after the removal of a memory cap. It allows unprivileged local users to escalate privileges to root on nearly all default-configured distributions.

Category: Critical Vulnerabilities

Industry: Technology (or organizations with heavy cloud Linux presence)

Sources

• https://securityaffairs.com/196657/hacking/ovswrap-13-year-old-linux-kernel-flaw-lets-local-users-become-root.html

• https://heyitsas.im/posts/ovswrap/

• https://github.com/torvalds/linux/commit/3f1f755366687d051174739fb99f7d560202f60b

Analyst comments

OVSwrap (CVE-2026-64531) is a Linux kernel privilege escalation flaw in the Open vSwitch datapath. It is triggered when nested Netlink attributes exceed 64 KiB. This causes a 16-bit length field overflow that forces deterministic parsing resumption within attacker-controlled conntrack data, without requiring heap grooming. The vulnerability became exploitable after a March 2025 stability patch removed a previously protective 32 KiB total stream cap. The resulting exploit chain combines kernel pointer leaks through fake OUTPUT actions, arbitrary reads via forged tunnel SET actions, and targeted decrements to corrupt live credentials. Exploitation is highly accessible across nearly all major Linux distributions, because it only requires creating an unprivileged user namespace with CAP_NET_ADMIN. This allows standard local users to instantiate private Open vSwitch datapaths without host-level permissions.

We have tested the released PoC in our lab environment against an Ubuntu 22.04 instance. The PoC executed without any additional requirements, nor was it blocked by AppArmor or related Linux security mitigations for default installations. The vulnerability is also known to be destructive, as it corrupts a live kernel credential and modifies sudoers with a corrupted OVS state. This results in a user calling sudo (such as sudo su to obtain root) and gaining root without a password.

Most mainline kernels should have updates available that remediate this vulnerability. The PoC allows easy root access, similar to recent Linux privilege escalation attacks such as Dirty Frag and Dirty Clone. Given this ease of use, the flaw is likely to be weaponized against Linux distros running older kernel versions.

Actionable guidance

Apply the latest kernel patches and fixes available. Alternatively, blacklisting the openvswitch kernel module will prevent exploitation of this vulnerability if a kernel patch cannot be applied, or is unavailable for the Linux distribution in use. If compromise is suspected, look for recent changes against the sudoers file and sudoers.d directory, such as new entries that remove password requirements for privileged sudo use.