Cyber news for businesses, Friday 13 November 2026
Remote-support tool abused to spread malware through IT providers
Huntress says attackers used compromised ScreenConnect panels to push rogue clients to at least 288 endpoints across 48 organisations. ConnectWise says it has no evidence of a ScreenConnect vulnerability. ConnectWise has not confirmed how the attackers first got in. If you use ScreenConnect or an IT provider that does, check Run Command history and remove unused extensions. The Hacker News
Critical Apache web server flaw needs a quick check
CVE-2026-119618 affects Apache HTTP Server 2.4.55 to 2.4.70 where HTTP/2 is on. It is fixed in 2.4.71. Wiz says no exploit was available and none was seen in the wild. Check your version and your Protocols setting. Our step by step check and the mod_http2 explainer show how. The Hacker News
Stolen AI keys cost Railway customers an estimated $740,000
Railway says an October breach exposed secrets stored as environment variables. AI provider keys were then used for unauthorised spend. Rotate any key stored on a hosting platform, and rotate it with the provider that issued it. See API key exposure. The Hacker News
SonicWall VPN flaw can bypass SAML multi-factor authentication
CISA lists CVE-2026-19868 as exploited, with a US federal deadline of 20 November. SonicWall says it investigated a report of possible exploitation. If you run SonicWall firewalls with SAML on SSL-VPN, update and read the advisory. See how SAML authentication bypass works. The Hacker News
Most of today’s stories are about weaknesses an attacker can reach from the internet. Wolfcore’s free web vulnerability scan is a quick first check, and a manual penetration test goes further.