Huntback reports that attackers deployed cryptocurrency miners on 21 production N-central servers on November 12, including 19 reporting build 2026.4.1.26. That is the Hotfix 2 build released two days earlier, making the findings relevant to administrators who have already upgraded.
The 4EverAble2Shell chain combines Apache Axis command execution with a separate privilege escalation to root. Publicly described exploitation requires an enabled Legacy API; Huntback does not document that setting for each identified victim.
The researchers combined decoy observations with mining-pool records and checks of associated N-central installations. Their 21-server count is a snapshot of one observed operation, rather than a worldwide compromise total.
N-able’s Hotfix 2 guidance requires customers to upgrade Agents and Probes, including on hosted deployments. Those updates do not establish that the newly disclosed chain is blocked.
Huntback recommends keeping Legacy API disabled and checking for unexpected xvd.service persistence, mining processes, and files under /tmp/.xvd or /var/tmp/.xvd. Evidence of the attack warrants treating the server as fully compromised.
Administrators should follow N-able’s incident guidance for the latest mitigation status. Its live update page was inaccessible during this review.
