105

NCentral notifies all customers to "Shut your servers down until further notice" Nov 9 2026 (lemmy.nz)

submitted 18 hours ago* (last edited 13 hours ago) by Reygle@lemmy.world to c/sysadmin@lemmy.world

21 comments fedilink hide all child comments

It appears another (there have been many the past months) CRITICAL "zero auth" attack for N-Able dropped over the weekend, and N-Able has no response other than "Shut it down and await further instructions" today.

Sorry for linking to poison site, but it's the only place they have a public visible mention of it. Nothing on their site, not even logged in.

https://old.reddit.com/r/Nable/comments/1xrspdf/important_ncentral_critical_security_incident/

I know we're in the age of AI ruining absolutely everything, but the last few months of them calling us ON THE PHONE to insist we patch RIGHT NOW, TODAY leading up to WE HAVE NO PATCH, SHUT IT DOWN is my "last straw" with this company.

Will edit this post when/if I hear back. We're what- 6 hours in as a paying customer and they're full radio silence outside of the email telling us to shut 'er down.

edited again: 8 hours later, absolute radio silence. If you have NABL stock, (not a financial advisor) I suggest you dump it first thing in the morning.

top 21 comments

sorted by: hot top new old

[-] tomcatt360@lemmy.zip 3 points 7 hours ago

Here's a link to the public incident page. It looks like they are on track to release a fix by mid day tomorrow.

https://uptime.n-able.com/event/202561/

[-] JRaccoon@discuss.tchncs.de 20 points 16 hours ago

Here are the published vulnerabilities, published 15 hours ago: https://github.com/Oracle-Security/CVEs/tree/main/0-Days/N-Central%20N-Able

N-Able status page is saying it's "public disclosure and non-responsible communication of critical vulnerabilities" but according to the GitHub repo author

These are disclosed responsibly and vendors have been contacted. In any instance where it works against the live version, the vendor has not responded to my emails.

It's pretty much he said, she said, but the repo author has no reason to lie about this while the corporate has plenty of reasons...

[-] jonathan7luke@lemmy.zip 2 points 10 hours ago

"I disclosed 2 unrelated RCEs for a different N-able product, along with a priv esc vulnerability 5 or 6 months ago. These have yet to be patched. I did not disclose any of the 0-days I posted last night," Bales told BleepingComputer.

https://www.bleepingcomputer.com/news/security/n-able-takes-cloud-platform-offline-after-30-plus-zero-days-published/

[-] frongt@lemmy.zip 2 points 8 hours ago

Fuckass.

[-] Reygle@lemmy.world 6 points 16 hours ago

Nailed it RIGHT on the head.

[-] assembly@lemmy.world 12 points 17 hours ago

Looks like old.reddit is now requiring authentication for me. That’s new.

[-] thermal_shock@lemmy.world 3 points 13 hours ago

Very recently, like within last 2 weeks.

[-] Sibbo@sopuli.xyz 7 points 16 hours ago

I see what you did there

[-] assembly@lemmy.world 6 points 14 hours ago

It’s the most clever thing I’ve come up with this year…glad someone noticed.

[-] twistabledeer@lemmy.world 3 points 14 hours ago

Yeah, reddit is removing old.reddit.com access from accounts that haven't used it in 6 months...

[-] Reygle@lemmy.world 5 points 16 hours ago

Yeah sorry for linking to that site filled with bots and trash, it's the only public-facing admission I can find.

[-] daychilde@lemmy.world 3 points 16 hours ago

I didn't downvote you but you've missed numerous threads about it. :)

[-] deadbeef79000 8 points 16 hours ago

Never heard of them before, are (were) they a credible vendor? Their website just seems to have CxO marketing drivel as far as I could be bother navigating.

[-] frongt@lemmy.zip 8 points 16 hours ago

Yes. They've been around for years and were owned by Solarwinds for a while. Product is a bit janky but broadly works, about par for the course for enterprise software.

[-] deadbeef79000 7 points 16 hours ago

Amazing. "Shut it down" is an apocalyptic level response.

I mean, I've experienced that response on individually compromised hosts/appliances, but not for an entire software suite before.

[-] Reygle@lemmy.world 9 points 16 hours ago* (last edited 13 hours ago)

It's their cloud hosted AND self hosted. The entire NCentral platform on AND off-cloud is currently completely shut down. No update from them for 4 hours since the announcement.

This comes after 2 months of EMERGENCY, DROP WHAT YOU ARE DOING AND PATCH IMMEDIATELY updates- over and over and over.

edited: words are hard
edited again: 8 hours later, absolute radio silence. If you have NABL stock, (not a financial advisor) I suggest you dump it first thing in the morning.