Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team.

This week, N-able released fixes for seven CVEs in N-central, its remote monitoring and management tool, after a researcher published exploit code for 33 alleged flaws, dubbed Able2Shell. The brief also covers an SSH login bypass on Alpine Linux that CISA added to its Known Exploited Vulnerabilities (KEV) catalog and Binance's account of how attackers stole approximately $6.34 billion in crypto. The last story covers a tampered Claude Code extension on Cursor's marketplace.

N-able fixes seven N-central CVEs after 33 alleged flaws go public →

Brief: On November 10, N-able released fixes for seven CVEs in N-central, a remote monitoring and management tool, after a researcher published exploit code for 33 alleged flaws.

Intel: The write-up, "Able2Shell," lists four exploit chains. The researcher calls one chain credential-free: XML that makes the server fetch an attacker's file leads, in several steps, to commands running as the "nable" account. A newer write-up claims root on Hotfix 2 without credentials. N-able took hosted N-central offline November 9. As our FAQ notes, N-able hasn't said which of the 33 findings its seven CVEs, including CVE-2026-125883, fix, and another hotfix is planned. Previdian's decoys drew exploitation attempts. Beazley reports watchTowr's honeypots did too. As of November 10, no confirmed customer compromise had been reported.

Why it matters: A compromised N-central server "can give an attacker a path into every network it manages," Beazley says. It has happened before. In earlier N-central attacks, Huntress says, attackers were "spraying" unauthorized scripts and tools into downstream networks.

Overlong passwords unlock passwordless Alpine accounts over SSH →

Brief: Alpine Linux and OpenSSH shipped fixes on November 5 for CVE-2026-123158, which lets an attacker log in over SSH to a passwordless account by sending a very long password; Previdian says attackers tried it within hours.

Intel: The flaw hits systems built on musl, an alternative C library, when the SSH server skips PAM, a login plug-in layer, as Alpine's does by default. Password logins must be on, the default, and another account needs a real password. Official Alpine tiny-cloud images from 3.18.11 to 3.24.3 become exploitable once any account gets a password: their passwordless "alpine" user lets an attacker take full control. Previdian told The Hacker News an attacker got root access on an Alpine honeypot. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 9.

Why it matters: Each choice made sense alone. musl's 2012 failed-hash value, "*", was meant to match nothing. OpenSSH's 2016 username-hiding fix hashes attempts with no real hash to check. Alpine 3.16's "*" for root let keys work without PAM. Two match-nothing values matched. OpenSSH tests on glibc and OpenBSD; musl doesn't test sshd, Özgün Kültekin says.

Binance details how attackers reached its wallet signing service →

Brief: Binance's initial findings say attackers stole approximately $6.34 billion in crypto on October 29 by abusing its internal wallet signing service, which signs wallet transactions; the exchange cites the FBI in naming North Korea.

Intel: A fake job interview in September got a software engineer to run a malicious code "assignment" on his work computer. Binance says its endpoint tools missed the malware at the time. On October 20, the attacker took control of two wallet engineers through that machine and an internal AI tool. On October 29, working from one engineer's computer with credentials stolen from the other, it deployed a container and ran a malicious script to launch the attack. Transfers bypassed the normal withdrawal process. As of November 3, about $2.85 billion had been frozen or intercepted.

Why it matters: A DevOps engineer's computer held a token that let its holder deploy software containers, Binance says. The attacker found it after taking control of that engineer on October 20. Nine days later, using credentials Binance says were stolen from him, it deployed a container and launched the attack.

Tampered Claude Code extension on Cursor's marketplace plants SSH key →

Brief: On October 29, for about 11 hours, Cursor's extension marketplace, where its code editor gets add-ons, offered a tampered Claude Code extension under Anthropic's name: versions 2.1.312 and 2.1.313 for Windows and macOS.

Intel: Cursor first said "at most 5,000 users," without a method; OpenSourceMalware says Cursor later dropped it from its notice. Anthropic's Felix Rieseberg says the company "didn't build or publish" it, its systems weren't compromised and only Cursor users were affected. Neither company has named who did it, and Cursor hasn't said how. Once loaded, it reported host details and added an attacker's SSH key to approved logins. Its scripts retry the attacker's server after reboots. Cursor says missing admin rights and coding errors stop it from turning on SSH on most Mac and Windows machines.

Why it matters: Removing the extension leaves files written outside its folder, and the server takedown doesn't clear them, Microsoft says. The planted key stays too. On a Mac with SSH login on now or later, Phorion says "the backdoor is ready and waiting," though Cursor says the attacker's server is offline.

Stat of the week: 948

The number of unique Linux kernel privilege escalation flaws that OpenAI says its AI pipeline found and exploited in one mid-October run for about $1.2 million in API credits. For now, the company says, an unpatched low-privileged account "should be considered functionally equivalent to root access for a well-resourced threat actor."

Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.