Cyber news for businesses, Thursday 12 November 2026
N-able pulls N-central offline after 30-plus flaws go public
A researcher published details and proof-of-concept code for more than 30 flaws in N-central, a remote management tool used by IT providers. N-able took its hosted service offline and told on-premises customers to shut servers down. It has since released a hotfix and says it has seen scanning but no successful exploitation in customer environments. Security firms reported attempts against honeypots. If an IT provider manages your devices, ask whether they use N-central and whether it is patched.
Fireworks AI discloses a second incident
Fireworks AI says a third-party cloud provider hosting its research machines was compromised on 23 October. The Register reports billing records, datasets and some incomplete model weights were accessed. An earlier October incident touched customer API keys. Rotate any AI service keys you hold, and give each key the least access it needs.
7.2 million emails added to Have I Been Pwned
A 2013 breach of the YouHack forum has been added to Have I Been Pwned. Member passwords were mostly unsalted MD5 hashes. The data is old, but reused passwords do not age. Check your staff addresses and use a unique password for every account.
Apple patches ten flaws, none reported as exploited
Apple’s Monday updates fix ten vulnerabilities. Half involve Bluetooth and AirPlay pairing. SecurityWeek says the advisories mention no attacks in the wild. Update company iPhones, iPads and Macs this week.
UK: £105,000 ICO fine for bought-lead calls
The ICO fined Bluon Energy after 194,379 marketing calls to numbers on the Telephone Preference Service. The ICO says the firm bought leads without checking consent. If you call prospects in the UK, screen against the TPS and verify consent on any list you buy. The ICO published this on 4 November.
Wolfcore is a UK-based offensive security firm working with businesses worldwide. Want to know if your staff logins or keys are already exposed? Try Breachy