The short version
- Chrome: Google fixed a flaw that attackers are already using. Restart Chrome on every computer and check it's on version 157.
- N-able N-central: N-able took its hosted N-central service offline after 33 flaws were published. If your IT provider uses it, ask what they've done.
- SonicWall VPNs: CISA says a SonicWall SSL-VPN flaw that can get around MFA is being exploited. Patch it.
- WordPress and old Apple devices: both are on CISA's exploited list this week. Update the site and the old iPads.
- Wilkes County: a spoofed "kidnapping" call came from a wife's real number. Caller ID can lie.
Around the CSRA
A fake kidnapping call that looked like it came from his wife
On November 5, WRDW reported that the Wilkes County Sheriff's Office is warning about a ransom call scam that hit a local man. The call showed up as his wife's actual number, and a stranger on the line said he had kidnapped her and wanted money right away. She was safe. Sheriff Darrell Powers said her phone appeared to have been compromised and the scammer used spoofing, which fakes the caller ID, and he was still on the line demanding money when deputies got to the house.
Here's the deal: the same trick works on a business. A "boss" calling from the boss's number with an urgent payment, a "vendor" calling from the vendor's real line. The panic is the product.
What to do: Make it a rule that no money moves because of an urgent call, until someone checks through a second channel: a number you already have, or a text to the real person. Share the sheriff's advice with staff: don't trust caller ID alone, and call 911 if it's a threat.
Patch watch
Chrome has a zero-day. Restart your browser.
On November 9 Google updated Chrome to 157.0.8103.50/.51 for Windows and Mac (157.0.8103.50 on Linux) with nine security fixes. Google says it is aware that an exploit for one of them, CVE-2026-125350, a use-after-free bug in how Chrome handles XML, exists in the wild. A browser flaw like this can be triggered by visiting the wrong web page, which is about as low a bar as it gets. The Extended Stable channel, 156.0.8078.96, got the same fix.
Chrome downloads updates on its own, but it doesn't finish installing them until it restarts, and plenty of browsers stay open for weeks.
What to do: On each computer, open Help > About Google Chrome, let it update, and click Relaunch. Check it shows 157.0.8103.50 or later.
N-able took N-central offline after 33 flaws went public
N-central is a remote monitoring and management (RMM) tool: the software a lot of IT providers use to manage their clients' computers from one console. On November 9, Huntress reported that N-able took its hosted N-central environment offline after a researcher published 33 critical flaws on GitHub, which chain into four exploits called "Able2Shell." N-able said it had not seen active exploitation as of that afternoon, is working on a hotfix, and told customers to keep their N-central servers offline, on-premises ones included, until it says they can come back.
Why this matters if you've never heard of N-central: an RMM console is a master key to every computer it manages. If your IT provider runs it, a break-in there is a break-in at your office.
What to do: Ask your IT provider whether they use N-central. If they do, ask whether it's offline until patched and whether they've reviewed logins, new admin accounts and remote sessions since November 8.
SonicWall SSL-VPN: a flaw that can get around MFA
On November 6 CISA added CVE-2026-19868, a SonicWall SonicOS SSL-VPN flaw, to its Known Exploited Vulnerabilities catalog. CISA's entry says someone with valid credentials for another sign-in method may be able to bypass SAML authentication, and with it MFA that's enforced through SAML. Federal agencies have until November 20. SonicWall's advisory is SNWLID-2026-0014.
MFA is the lock most of us are counting on for remote access. This one goes around it, which is why it's on the list.
What to do: If staff reach the office through a SonicWall VPN, have your IT provider apply SonicWall's fix for SNWLID-2026-0014 now and look over recent VPN logins for anyone unfamiliar.
WordPress core: update the site
On November 3 CISA added CVE-2026-119977, a race condition in WordPress core, to its exploited list and gave federal agencies just three days to act. CISA's entry says an attacker with no login could run code on the server during the window when WordPress is upgrading itself. CISA points to the WordPress 7.1.4 release for the fix.
What to do: Log in to your WordPress dashboard, or ask your web host or developer, and confirm the site is on 7.1.4 or the latest security release for its branch, with automatic background updates on.
Old iPhones, iPads and Macs: a 2024 bug is back in use
On November 4 CISA added CVE-2024-27834, an Apple WebKit flaw, to its exploited list. Apple fixed it in Safari 17.5, released May 13, 2024, along with matching iOS and macOS updates. Apple describes it as letting an attacker who already has read and write access bypass Pointer Authentication, a built-in memory protection. Being added two years later tells you who's being targeted: devices nobody has updated since.
What to do: Check every Apple device in the office under Settings > General > Software Update (or System Settings on a Mac). Update what can be updated, and put the ones that can't on the replacement list.
One thing to do this week
Ask your IT provider one question: "What tools can reach into our computers remotely, and who's watching them?" This week it was N-central and SonicWall. Next week it'll be something else. You want an answer with names in it, not "we've got it covered." If nobody's watching after hours, our post on who answers a 2am security alert covers what to ask.
Related reading
- AI Voice Cloning Scams: Would Your Staff Spot a Fake Call From You?
- Our Only IT Person Is Out. Who Answers a 2am Security Alert?
- WordPress Site Hacked or Redirecting to Spam? First Steps
Originally published November 2026.
No comments yet