2026-W32
供應鏈與遠端管理平台同時失守：N-able N-central 遭接管、npm 蠕蟲擴散逾千套件Supply chain and remote management under fire: N-able N-central takeovers, an npm worm past a thousand packages
本週兩起事件的共通點是攻擊者選擇打「你信任的中介」，而不是直接打你。N-able N-central 是 MSP 用來管理客戶端點的 RMM 平台，認證繞過漏洞讓攻擊者接管管理主機後，直接觸及底下所有受管系統；npm 上的自我傳播蠕蟲則從一個快取套件擴散到上千個相依專案。兩者都不是靠使用者點錯連結，而是靠既有的信任關係自動散播。
另外 CISA 本週把三個漏洞列入 KEV，其中 IBM Langflow 的程式碼注入在預設部署下即可未授權遠端執行程式碼——如果你有把 AI 工作流平台開在對外網段，這一則優先處理。
Both major incidents this week share a shape: the attacker went after something you trust in the middle, not at you directly. N-able N-central is the RMM platform MSPs use to manage customer endpoints — an authentication bypass let attackers take over the management server and reach every system beneath it. On npm, a self-propagating worm spread from a single caching package into more than a thousand dependents. Neither needed a user to click the wrong link; both rode existing trust relationships.
CISA also added three flaws to the KEV catalog this week. The IBM Langflow code injection stands out: default deployments allow unauthenticated remote code execution. If you have an AI workflow platform reachable from the internet, start there.
攻擊手法與漏洞通報Advisories
N-able N-central 認證繞過遭實際利用，管理主機被接管後波及所有受管客戶N-able N-central authentication bypass exploited; management server takeover reaches every managed customer
受影響Affected N-central 2026.3.1.7 之前的版本，雲端託管與地端部署皆受影響N-central builds prior to 2026.3.1.7 — both hosted and on-premises
發生什麼事What happened
N-able 證實攻擊者利用 N-central 的認證繞過漏洞取得遠端管理權限，並進一步觸及透過這些主機所管理的客戶系統。這個漏洞編號 CVE-2026-18577（CVSS 8.2），起因是先前 CVE-2026-18556（CVSS 8.2）的修補並不完整——也就是說，已經套過第一次修補的環境仍然中招。
N-able 於 8 月 2 日釋出 2026.3.1.7 作為第一個不受影響的版本，CISA 隨即在 8 月 3 日將其列入 KEV 目錄。
N-able confirmed attackers exploited an authentication bypass in N-central to gain remote administrative access, then reached customer systems managed through those servers. Tracked as CVE-2026-18577 (CVSS 8.2), it exists because the earlier fix for CVE-2026-18556 (CVSS 8.2) was incomplete — environments that had already applied the first patch were still exposed.
N-able shipped 2026.3.1.7 on 2 August as the first unaffected build; CISA added the flaw to the KEV catalog on 3 August.
攻擊手法Attack technique
「Authentication Bypass Using an Alternate Path or Channel」——存在一條未經過正規驗證檢查的替代存取路徑。攻擊者不需要有效憑證即可取得管理帳號權限，接著就是合法功能的濫用：RMM 平台本來就有對受管端點派送指令與軟體的能力，接管平台等同取得下游環境的執行權。
這正是 RMM／MSP 類平台的風險特徵：單一漏洞的影響半徑不是一台主機，而是整個客戶名單。
"Authentication bypass using an alternate path or channel" — an access route that skips the normal verification check. No valid credentials are needed to reach administrative privileges, after which the attacker simply abuses legitimate functionality: an RMM platform exists to push commands and software to managed endpoints, so owning the platform means execution across everything downstream.
This is the defining risk of RMM/MSP tooling: the blast radius of one flaw is not one host, it is the entire customer list.
影響範圍Who is affected
使用 N-central 的 MSP 與其所有客戶。若你是委外託管 IT 的一方，即使自家沒有裝 N-central，仍可能因服務商的平台被接管而受影響——這一題需要主動向你的 MSP 求證。
MSPs running N-central and all of their customers. If you outsource IT, you may be affected through your provider even without running N-central yourself — ask your MSP directly.
該怎麼做What to do
1. 立即升級至 2026.3.1.7 或更新版本。已套用前一次 CVE-2026-18556 修補的環境不能視為安全。
2. 升級前後都要做入侵跡證盤查：檢視管理主機的帳號建立紀錄、非預期的排程工作與腳本派送、對外連線紀錄。
3. 把 N-central 管理介面從公開網際網路移除，限制在 VPN 或特定來源 IP 之後。
4. 輪換 N-central 上的所有管理憑證與 API token。
5. 若你是委外方，向 MSP 索取其 N-central 版本與盤查結果。
1. Upgrade to 2026.3.1.7 or later immediately. Having applied the earlier CVE-2026-18556 patch does not mean you are safe.
2. Hunt for compromise either side of the upgrade: review account creation on the management server, unexpected scheduled tasks and script deployments, and outbound connections.
3. Take the N-central console off the public internet — put it behind VPN or source-IP restrictions.
4. Rotate every administrative credential and API token in N-central.
5. If you outsource IT, ask your MSP for their N-central build number and hunt results.
偵測建議Detection
在受管端點側觀察「經由 RMM agent 派送、但不在你變更紀錄裡」的執行行為——這比在被接管的管理主機上找記錄更可靠，因為攻擊者有能力清理後者。
Look at the managed-endpoint side for execution delivered via the RMM agent that has no matching entry in your change record. That is more reliable than trusting logs on a management server the attacker controlled.
MITRE ATT&CK
npm 自我傳播蠕蟲擴散逾千套件，並在開發者機器植入編輯器 hookSelf-propagating npm worm spreads past a thousand packages, plants editor hooks on developer machines
受影響Affected npm 生態；起點為 keyv@6.0.0，擴散至 Keyv／Cacheable 以外的多個組織命名空間The npm ecosystem; originated in keyv@6.0.0 and spread beyond the Keyv and Cacheable namespaces
發生什麼事What happened
一支竊取憑證的 npm 蠕蟲最早出現在 keyv@6.0.0，並於 8 月 4 日擴散到多個組織的數百個套件。各家統計的規模不一：SafeDep 驗證出 79 個套件名稱下的 353 個受污染版本，其監測顯示更廣的足跡達 353 個名稱下的 442 個版本，Aikido 通報至少 868 個套件；BleepingComputer 以 ChainDrop 稱呼這波攻擊，指其影響超過 1,300 個套件、合計每月下載量約 20 億次。
特別值得注意的是，惡意程式會在受害機器上植入 Claude Code 與 VS Code 的 hook——也就是說它不只竊取當下的憑證，還在開發環境裡留下持續執行的位置。
A credential-stealing npm worm first appeared in keyv@6.0.0 and spread into hundreds of packages across multiple organisations on 4 August. Counts differ by vendor: SafeDep verified 353 poisoned versions across 79 package names, with monitoring suggesting a wider footprint of 442 versions across 353 names; Aikido reported at least 868 packages. BleepingComputer tracks the campaign as ChainDrop and puts it at more than 1,300 packages with roughly 2 billion combined monthly downloads.
Notably, the malware plants Claude Code and VS Code hooks on victim machines — it does not merely steal the credentials present at install time, it establishes a persistent foothold inside the development environment.
攻擊手法Attack technique
自我傳播的邏輯是：竊取開發者的 npm 發布 token → 用該 token 對開發者有權限的套件發布植入惡意程式的新版本 → 這些套件的使用者安裝後再次被竊取 token。每一次感染都會製造新的傳播源，這是它能在一天內從單一套件擴散到上千個的原因。
感染途徑是安裝期腳本，不需要你在程式中真的呼叫那個套件。
The propagation loop: steal a developer's npm publish token → use it to publish trojanised versions of every package that developer can publish → users of those packages install, and their tokens are stolen in turn. Each infection manufactures a new propagation source, which is how it went from one package to over a thousand within a day.
Infection happens through install-time scripts — you do not have to actually call the package in your code.
影響範圍Who is affected
任何在本週執行過 npm install 且相依樹中包含受影響套件的開發者機器與 CI 環境。因為是相依傳遞，你的 package.json 沒有直接列出 keyv 不代表沒有中招。
Any developer machine or CI environment that ran npm install this week with an affected package anywhere in its dependency tree. Because it spreads transitively, keyv not appearing in your package.json does not mean you are clear.
該怎麼做What to do
1. 輪換所有 npm token，以及該機器上曾出現過的其他憑證（雲端 key、CI secret、SSH key）。
2. 用 npm ls keyv cacheable 檢查相依樹；有命中就比對受影響版本清單。
3. 檢查 ~/.claude/settings.json 與 VS Code 設定中是否有非你新增的 hook 或 task。
4. CI 端加上 npm ci --ignore-scripts，阻斷安裝期腳本這條路徑。
5. 導入 lockfile 審查與相依掃描（本期工具 Trivy 可掃 package-lock.json）。
1. Rotate every npm token, plus any other credential that has been present on the machine (cloud keys, CI secrets, SSH keys).
2. Check your tree with npm ls keyv cacheable; if it hits, compare against the affected-version lists.
3. Inspect ~/.claude/settings.json and your VS Code configuration for hooks or tasks you did not add.
4. Use npm ci --ignore-scripts in CI to cut off the install-script path.
5. Adopt lockfile review and dependency scanning — Trivy, featured this week, scans package-lock.json.
偵測建議Detection
在開發者機器與 CI runner 上找 npm install 期間產生的非預期對外連線，特別是連往非 registry 網域者。另外檢查 npm 帳號的發布紀錄有無你不認得的版本。
Hunt for unexpected outbound connections during npm install on developer machines and CI runners, especially to non-registry domains. Also review your npm account's publish history for releases you do not recognise.
MITRE ATT&CK
IBM Langflow 程式碼注入：預設部署即可未授權遠端執行程式碼IBM Langflow code injection: unauthenticated RCE on default deployments
受影響Affected IBM Langflow（AI 工作流建構平台）IBM Langflow (AI workflow builder)
發生什麼事What happened
Langflow 存在程式碼注入漏洞，未經驗證的攻擊者可在預設部署上取得完整遠端程式碼執行權限。CISA 已於 8 月 4 日將其列入 KEV 目錄，代表已有實際遭利用的證據。
這一則的重點在「預設部署」四個字——不需要特殊設定錯誤，開箱即用的狀態就是可利用的。
Langflow contains a code injection flaw that lets unauthenticated attackers achieve full remote code execution on default deployments. CISA added it to the KEV catalog on 4 August, indicating confirmed exploitation in the wild.
The operative phrase is "default deployments" — no unusual misconfiguration required; out of the box is exploitable.
攻擊手法Attack technique
程式碼注入（CWE-94）：使用者可控的輸入被送進會執行程式碼的處理路徑。AI 工作流平台這類產品常見的設計是允許使用者定義自訂節點或運算式，若這段執行環境沒有與外部輸入隔離，就等同對外開放一個直譯器。
Code injection (CWE-94): user-controlled input reaches a path that executes code. Products like AI workflow builders commonly let users define custom nodes or expressions; when that execution context is not isolated from untrusted input, it amounts to exposing an interpreter to the internet.
影響範圍Who is affected
任何對外開放的 Langflow 執行個體。因為這類工具常在概念驗證階段被快速架起來、之後忘了收掉，先盤點你組織裡有沒有沒人認領的 Langflow。
Any internet-reachable Langflow instance. These tools often get stood up for a proof of concept and then forgotten, so start by finding the Langflow nobody remembers owning.
該怎麼做What to do
1. 依 IBM 公告升級至已修補版本。
2. 在完成修補前，將 Langflow 從對外網段撤下。
3. 假設已遭入侵並進行盤查：Langflow 執行身分下的異常程序、對外連線、新增的檔案。
4. 輪換該主機上所有 API key——AI 工作流平台通常存放大量第三方服務憑證。
1. Upgrade to the fixed release per IBM's advisory.
2. Until patched, remove Langflow from internet-facing networks.
3. Assume compromise and hunt: anomalous processes under the Langflow service account, outbound connections, newly written files.
4. Rotate every API key on that host — AI workflow platforms typically hold a lot of third-party service credentials.
MITRE ATT&CK
Greatness 釣魚服務加入 device code 釣魚，用合法 OAuth 流程繞過 MFAGreatness PhaaS adds device code phishing, bypassing MFA through a legitimate OAuth flow
受影響Affected 使用 OAuth 2.0 裝置授權流程的雲端身分服務（Microsoft Entra ID、Google Workspace 等）Cloud identity providers supporting the OAuth 2.0 device authorization grant (Microsoft Entra ID, Google Workspace, and others)
發生什麼事What happened
商業釣魚即服務工具包 Greatness 新增了 device code 釣魚的支援。這個手法濫用的是 OAuth 2.0 Device Authorization Grant ——一個完全合法、原本設計給電視盒與 CLI 工具這類「不方便輸入密碼的裝置」使用的登入流程。
Greatness 原本就支援 AiTM（中間人）憑證竊取，加上這一項之後，攻擊者有了兩條互補的路徑。釣魚服務化的意義是：這個手法的使用門檻從「需要懂 OAuth」降到「會付月租」，接下來數量會上升。
The commercial phishing-as-a-service kit Greatness has added device code phishing. The technique abuses the OAuth 2.0 device authorization grant — a fully legitimate sign-in flow designed for devices where typing a password is awkward, like TV boxes and CLI tools.
Greatness already supported AiTM credential theft; with this addition attackers get two complementary paths. The significance of it arriving in a PhaaS kit is that the barrier drops from "understands OAuth" to "pays a subscription" — expect volume to rise.
攻擊手法Attack technique
攻擊者在自己的裝置上發起裝置授權流程，取得一組使用者代碼，接著誘使受害者到真正的官方登入頁輸入該代碼並完成驗證（包含 MFA）。受害者所有的驗證步驟都在合法網域上完成，因此沒有可疑網址、沒有假冒登入頁、瀏覽器不會示警。
受害者按下「同意」的瞬間，token 被發給攻擊者的裝置。MFA 被完整通過了，只是通過的是攻擊者的登入請求。
The attacker starts a device authorization flow on their own device, obtains a user code, then persuades the victim to enter that code on the genuine official sign-in page and complete verification, MFA included. Every step happens on a legitimate domain: no suspicious URL, no fake login page, no browser warning.
The moment the victim approves, the token is issued to the attacker's device. MFA was fully satisfied — it just satisfied the attacker's sign-in request.
影響範圍Who is affected
所有依賴 MFA 作為主要防線的組織。這個手法的可怕之處在於使用者做的每件事都是對的：正確的網域、正確的 MFA、沒有輸入密碼給第三方。傳統的「檢查網址列」教育在這裡完全無效。
Any organisation treating MFA as its main line of defence. What makes this dangerous is that the user does everything right: correct domain, correct MFA, no password handed to a third party. Traditional "check the address bar" training is useless here.
該怎麼做What to do
1. 若無明確需求，於身分提供者停用裝置授權流程（Entra ID 可用 Conditional Access 的 authentication flows 條件封鎖）。
2. 有需求的情境改為限定特定應用程式與受信任網路。
3. 使用者教育要更新：任何人請你「唸出／輸入一組代碼來完成登入」都應視為攻擊，無論對方自稱是誰。
4. 監控裝置代碼流程的登入事件，特別是使用者所在地與裝置不符者。
1. Disable the device authorization flow at your identity provider unless you have a concrete need (in Entra ID, block it with a Conditional Access authentication-flows condition).
2. Where it is needed, restrict it to specific applications and trusted networks.
3. Update user training: anyone asking you to read out or type a code to complete a sign-in should be treated as an attack, whoever they claim to be.
4. Monitor sign-ins that used the device code grant, especially where user location and device do not match.
偵測建議Detection
在 Entra ID 登入記錄篩選 authentication protocol 為 Device Code 的事件。這在多數組織是罕見流程，基數低、訊噪比高，是很划算的一條偵測規則。
Filter Entra ID sign-in logs for an authentication protocol of Device Code. In most organisations this flow is rare, so the baseline is low and the signal-to-noise ratio is excellent — a cheap, high-value detection.
MITRE ATT&CK
- Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens · The Hacker News
DOUBLECUP 把 ClickFix 打包成租用服務，惡意程式藏在瀏覽器快取的 PNG 裡DOUBLECUP turns ClickFix into a rentable service, hiding malware in browser-cached PNGs
受影響Affected Windows 與 macOS 使用者（CountLoader 兩平台皆有，DeviceManager RAT 為 Windows）Windows and macOS users (CountLoader targets both; the DeviceManager RAT is Windows-only)
發生什麼事What happened
資安業者 SOCRadar 揭露一個俄語系的載入器即服務（Loader-as-a-Service）DOUBLECUP。租用者可把它的程式碼嵌進自架的惡意網站，用偽造的驗證畫面（ClickFix）誘使使用者自行執行剪貼簿裡的指令，最終植入 CountLoader（Windows／macOS）與一支先前未被記錄的 Windows 遠端存取木馬 DeviceManager。
SOCRadar disclosed DOUBLECUP, a Russian-language loader-as-a-service. Subscribers embed its code into their own malicious sites and use fake verification screens (ClickFix) to get users to run a command from their clipboard, ultimately delivering CountLoader (Windows and macOS) and a previously undocumented Windows RAT called DeviceManager.
攻擊手法Attack technique
兩個值得注意的技術點：
其一，ClickFix 讓使用者自己動手。 頁面顯示「請完成人機驗證」之類的畫面，指示使用者按下 Win+R（或在 macOS 開啟終端機）並貼上一段已被悄悄複製到剪貼簿的指令。因為執行動作由使用者本人完成，許多以「檔案下載後執行」為觸發條件的防護不會啟動。
其二，第二階段藏在瀏覽器快取。 第一階段把一張以隱寫術夾帶內容的 PNG 放進瀏覽器快取，再從快取中取出隱藏內容並執行。惡意內容在網路層看起來就是一張正常圖片，落地後也不是一個可疑的執行檔。
Two techniques worth noting:
One: ClickFix makes the user do it. The page shows something like a human-verification prompt and instructs the user to press Win+R (or open Terminal on macOS) and paste a command that has quietly been placed on their clipboard. Because the user performs the execution themselves, controls keyed to "file downloaded, then run" never fire.
Two: stage two hides in the browser cache. The first stage drops a steganographic PNG into the browser's cache, then retrieves the hidden content from it and executes it. On the wire the payload looks like an ordinary image, and on disk it is not a suspicious executable.
影響範圍Who is affected
一般端點使用者。ClickFix 之所以在近一年快速擴散，是因為它繞過的不是技術控制而是使用者的判斷，而且服務化之後任何人都能發動。
Ordinary endpoint users. ClickFix has spread quickly over the past year because what it bypasses is not a technical control but the user's judgement — and now, as a service, anyone can run it.
該怎麼做What to do
1. 使用者教育要具體到動作：任何網頁要求你按 Win+R、開啟 PowerShell 或終端機並貼上指令，一律是攻擊，沒有例外。合法的人機驗證不需要你離開瀏覽器。
2. 以群組原則限制一般使用者存取 Win+R 執行對話框。
3. 監控由 explorer.exe 直接生成 powershell.exe／cmd.exe 且命令列含編碼字串的行為。
4. macOS 端監控 Terminal 中出現 curl | sh 這類模式。
1. Make training concrete about the action: any web page telling you to press Win+R, open PowerShell, or open Terminal and paste a command is an attack, without exception. Legitimate human verification never asks you to leave the browser.
2. Restrict the Run dialog for standard users via group policy.
3. Alert on explorer.exe spawning powershell.exe or cmd.exe directly with encoded command lines.
4. On macOS, watch for curl | sh patterns in Terminal.
偵測建議Detection
explorer.exe → powershell.exe 的父子程序關係在正常使用中很少見（使用者通常從開始選單啟動，父程序不同），配合命令列含 base64 或 -enc 參數，是辨識 ClickFix 相當可靠的訊號。
An explorer.exe → powershell.exe parent-child relationship is uncommon in normal use (users typically launch from the Start menu, which yields a different parent). Combined with base64 or -enc on the command line, it is a reliable ClickFix signal.
MITRE ATT&CK
cPanel 權限越界：一般虛擬主機客戶可用資料庫 root 身分執行 SQLcPanel privilege boundary break: a hosting customer can run SQL as database root
受影響Affected cPanel（未套用該次安全性更新的版本）cPanel installations without the targeted security release
發生什麼事What happened
cPanel 修補了一個讓已通過驗證的虛擬主機客戶以資料庫 root 身分執行 SQL 的漏洞，跨越了 cPanel 帳號與伺服器管理資料庫身分之間的權限邊界。編號 CVE-2026-58048，CVSS 4.0 評分 9.4。同一次安全性更新另外修補了兩條同樣可越過帳號邊界的路徑。
iThome 指出，近兩三個月鎖定 cPanel 的攻擊行動持續發生，這類平台一旦有嚴重漏洞就會迅速成為攻擊目標。
cPanel patched a flaw allowing an authenticated hosting customer to execute SQL in the database's root context, crossing the privilege boundary between a cPanel account and the server's administrative database identity. Tracked as CVE-2026-58048 with a CVSS 4.0 score of 9.4, it shipped in a targeted security release that closes two other routes past account boundaries.
iThome notes that cPanel has been under sustained attack for the past two to three months — severe flaws in this class of platform draw attackers quickly.
攻擊手法Attack technique
多租戶主機平台的核心安全假設是「租戶之間彼此隔離、且都低於管理層級」。這個漏洞打破的正是這條假設：攻擊者只需要買一個最便宜的虛擬主機方案取得合法帳號，就能升級到資料庫最高權限，進而讀寫同一台主機上所有其他客戶的資料。
The security assumption of a multi-tenant hosting platform is that tenants are isolated from each other and all sit below the administrative tier. This flaw breaks exactly that: an attacker only needs to buy the cheapest hosting plan to obtain a legitimate account, then escalate to full database privileges and read or write every other customer's data on that server.
影響範圍Who is affected
虛擬主機業者及其所有客戶。若你的網站託管在共用主機上，你的資料庫安全取決於同一台機器上其他租戶的良善程度與業者的修補速度。
Hosting providers and all of their customers. If your site is on shared hosting, your database security depends on the goodwill of the other tenants on that machine and on how fast your provider patches.
該怎麼做What to do
1. 主機業者：立即套用該次安全性更新。
2. 客戶端：向業者確認 cPanel 版本與修補時間。
3. 敏感資料不要放在共用主機的資料庫；至少確保應用層加密。
4. 檢查資料庫的存取紀錄有無非預期的跨帳號查詢。
1. Hosting providers: apply the security release now.
2. Customers: ask your provider for their cPanel version and patch date.
3. Keep sensitive data out of shared-hosting databases, or at minimum encrypt at the application layer.
4. Review database access logs for unexpected cross-account queries.
MITRE ATT&CK
本期工具介紹Tools
Trivy
一支指令掃遍容器映像、原始碼相依套件、IaC 設定與密鑰外洩。One command to scan container images, code dependencies, IaC configs, and leaked secrets.
Nuclei
以 YAML 樣板驅動的漏洞掃描器，社群樣板庫覆蓋大量已知 CVE 與設定疏失。Template-driven vulnerability scanner with a large community library covering known CVEs and misconfigurations.
延伸閱讀Further reading
- INC 勒索軟體成為利用 SonicWall SMA 1000 漏洞的主要威脅行為者INC Ransomware emerges as dominant actor exploiting SonicWall SMA 1000 flaws · The Hacker News
- Pass the Passkey：無密碼驗證的新攻擊面（Unit 42 技術分析）Pass the Passkey: a novel attack surface in passwordless authentication (Unit 42) · Unit 42
- 惡意程式可劫持受 passkey 保護的帳號，無需指紋或 PINGoogle Password Manager attacks could let malware hijack passkey-protected accounts · The Hacker News
- 18 個惡意 npm 套件針對阿里巴巴開發工具使用者投放跨平台 RAT18 malicious npm packages deliver cross-platform RAT to Alibaba tool users · The Hacker News
- QuickFox 供應鏈攻擊：遭植入後門的 Windows 安裝程式散布 FDMTPQuickFox supply chain attack delivers FDMTP backdoor via trojanised Windows installer · The Hacker News
- CISA 呼籲供水與污水處理業者防護遭鎖定的 PLC 設備CISA urges water and wastewater systems sector to protect OT against activity targeting PLCs · CISA