One pattern, four times this week
A management platform, a remote-access add-on, an AI provider, and a newsletter service each exposed businesses that were never breached directly.
Within a few days in November 2026, SecurityWeek reported that N-able took hosted N-central offline after a researcher published more than 30 zero-days. BleepingComputer reported SCKit malware aimed at managed service providers through ScreenConnect. TechCrunch reported a Fireworks AI intrusion that reached Notion AI chat transcripts. ITPro reported Sega's breach through its newsletter vendor. A privately held business with a remote team inherits the security of every vendor, plugin, or managed service provider (MSP) tool that can touch its systems or its customers' data.
When your MSP's tool is the target
N-able took hosted N-central offline after a researcher published more than 30 zero-days. A business that relies on a managed service provider (MSP) inherits that patch speed.
On November 12, 2026, SecurityWeek reported that researcher Sean Bales published proof-of-concept code for more than 30 N-central vulnerabilities, and that on Monday N-able took hosted N-central offline and urged customers to disconnect on-premises deployments. N-able's November 11 update dates that publication to November 9. N-able moved its hosted servers to the fixed version, N-central 2026.4 HF2. Companies that run N-central on their own servers must keep them off the internet until they upgrade, and every customer must also update the N-central software installed on each managed computer. Flaws that need no login are addressed. The rest need an authenticated account, often with elevated privileges, and a later hotfix. N-able sees scanning of the public code and reports no indications of compromise on hosted servers. Any single customer environment still needs its own check.
That schedule belongs to the MSP, or to N-able when the platform is hosted. Eight Chrome zero-days this year show the same lag: the browser fix counts only after it is installed and the browser relaunches. Ask your MSP whether it runs N-central itself or uses N-able's hosted service, and whether the monitoring software on your computers has been updated.
The remote-access add-on nobody was watching
Huntress linked rogue ScreenConnect installs on at least 288 endpoints across 48 organizations to the RMM+ extension. SCKit's worm-like spread to technicians was attempted, and researchers have not seen it succeed. ConnectWise reports no evidence that a ScreenConnect flaw was the way in.
On November 11, 2026, Huntress saw that activity pushed from cloud-hosted ScreenConnect panels. The endpoints it could see were all hit within 90 minutes. RMM+ lets another tool drive sessions without a technician at the console. In versions 1.0.31 and 1.0.32, Huntress says, a blank access key was accepted if none had been set, bypassing ScreenConnect accounts, roles, and multifactor authentication. The commands had no matching login. Builds then current, 26.6.6.9747 and 26.7.6.9783, were affected.
ConnectWise, updated November 12, 2026 at 18:45 UTC, says it has found no evidence of a compromise of its infrastructure and no evidence that initial access involved a ScreenConnect vulnerability. It disabled five extensions, Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link, across approximately 400 partner environments. That figure counts installations. ConnectWise says their presence does not establish compromise, and it is still assessing the RMM+ findings.
SCKit also tries to jump to the technician who connects, using CVE-2026-84869, which CISA added to its Known Exploited Vulnerabilities catalog on September 11, 2026. ConnectWise patched it in client 26.6.5 on September 8, 2026. That version and later block the technique, and updating a cloud console does not update the technician's client. Huntress saw every recovered console-takeover attempt fail. Blackpoint Cyber replayed it on a current release: the guest queued the file, and the technician's client never requested or executed it.
Ask whether ScreenConnect and those extensions are present, and whether technician clients are on 26.6.5 or later. A coming piece asks the parallel question of another product: Check Point's October 23 fix: was the remote-access portal updated?
The AI vendor behind your AI vendor
Notion says AI chat transcripts from under 1% of its workspaces were exposed at Fireworks AI, a provider Notion used. What employees paste into an AI tool can sit with a company they never chose.
Notion's advisory says the November 8 dataset was Insights chat transcripts. Notion says most of the exposed chats were not labeled with who wrote them or which workspace they came from, but the text of each chat was exposed. Other Notion features were unaffected. Insights is disabled, and open-weight models no longer run through Fireworks.
Notion's first review of the November 2 notice found synthetic test data only. It disconnected on November 3 and deleted its data there on November 4. On November 8, after a November 6 warning, Notion found customer transcripts in the dataset Fireworks confirmed that day. It emailed affected customers on November 9, revoked exposed Notion API keys from the messages on November 11, and on November 12 reported other keys to their issuers.
Fireworks' bulletin, updated November 9, follows the chain one vendor further. A cloud provider that hosted Fireworks research and development machines had an incident on October 23. On October 24 that access reached Fireworks development machines. The attackers reached account and billing details such as addresses and payment history, and for a limited set of accounts they accessed secrets, datasets, and incomplete models. Card numbers are not stored. Fireworks reports no detected impact on Inference, Training SDK, and Nexus, the services it says keep no customer data by default.
Most small and mid-sized businesses run a general chatbot, often outside a company account. Agentic tools are already hunting exposed secrets. If Notion has not contacted you, it says your workspace has not been identified as affected.
Newsletters, plugins, and the site everyone is afraid to touch
Sega says 2,196,044 newsletter email address records were exposed through vendor Arara, which now counts 81,329,467 addresses in its breach. A plugin-heavy website carries the same inherited risk until it is replaced with software you own.
Sega's November 9 statement counts 2,196,044 email address records from some Sega and Sega Fave newsletters. The records come from 11 newsletters sent from July 2 to October 28, 2026. Of those records, 92,273 include delivery information Sega is still identifying with Arara. Names, birth dates, gender, postal addresses, phone numbers, card details, and login passwords were outside the leak. So were SEGA Account addresses, which use another system. Sega has not confirmed misuse.
Arara's November 6 notice is the current total: 81,329,467 addresses once duplicates are removed, a count of addresses that includes records Arara says may have been taken. Arara estimates up to about 380 client companies, still being checked, and says the service holds no card numbers. All of Arara Message has been stopped since October 31.
Faster WordPress core fixes, described in the Core Security Initiative update, leave plugins and themes untouched. Stabilize an aging site by listing plugins, confirming updates apply, and seeing who can log in. Or replace it with software you own.
Run a dependency inventory
List every outside service and plugin, who controls it, and what data or systems it can touch.
One row per product: the management tool, ScreenConnect and its extensions, the newsletter platform, each plugin and theme, and each AI chat used for work. In-house means your staff can turn it off. MSP means their patches and add-ons are yours, as with N-central and with RMM+ in the Huntress report. Vendor means they, or their vendor, hold the data: Fireworks behind Notion, Arara behind Sega's lists. The last column is reach. An agent touches the computers it sits on. Huntress says RMM+ 1.0.31 and 1.0.32 could run commands there, with no technician login, when the key was blank. A chat holds pasted passwords and API keys, which Notion told affected customers to rotate. A mail platform holds addresses, and a plugin can reach the site.
Then fill in the gaps with your MSP, whoever runs your website, and each manager whose team uses AI, including on personal accounts.
We can help you with that.
NTx AI Consulting works with owner-led and partner-led privately held businesses that are currently using AI tools in everyday workflows, or would like to be. The complimentary consultation is a working session, not a product demo. If a deeper engagement makes sense, Phase 1 is an AI Disruption Readiness Audit. You can learn more at https://ntx.ventures/ai-consulting/.
Sources
- SecurityWeek. https://www.securityweek.com/hackers-target-n-central-zero-days-as-n-able-rushes-patches/
- BleepingComputer. https://www.bleepingcomputer.com/news/security/new-worm-like-sckit-malware-targets-msps-in-screenconnect-attacks/
- TechCrunch. https://techcrunch.com/2026/11/12/cyberattack-on-fireworks-ai-allowed-hackers-to-access-notion-customers-chat-transcripts/
- ITPro. https://www.itpro.com/security/data-breaches/sega-data-breach-everything-we-know-so-far-as-2-2-million-customers-exposed
- N-able's November 11 update. https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response
- Huntress. https://www.huntress.com/blog/sckit-worm-rogue-screenconnect
- ConnectWise. https://www.connectwise.com/company/trust/advisories
- CISA added to its Known Exploited Vulnerabilities catalog on September 11, 2026. https://www.cisa.gov/news-events/alerts/2026/09/11/cisa-adds-three-known-exploited-vulnerabilities-catalog
- Blackpoint Cyber. https://blackpointcyber.com/blog/screenconnect-attack-sckit/
- Notion's advisory. https://www.notion.com/security/advisories/security-incident-involving-a-third-party-ai-vendor
- Fireworks' bulletin. https://fireworks.ai/security/bulletins/october-2026-security-incident-update
- Sega's November 9 statement. https://www.sega.co.jp/release/261109_1.html
- Arara's November 6 notice. https://www.arara.com/news/info/20261106_arara