Cybersecurity Threat Digest November 12, 2026: Red Hat Quay Flaws, ScreenConnect MSP Attacks, and Linux Persistence

Top Stories#

• Critical Red Hat Quay vulnerabilities threaten container registries. Two newly reported flaws could expose robot-account credentials across namespaces or enable unauthenticated attackers to forge tokens and replace private image tags. See the Red Hat advisory for CVE-2026-110697 and the advisory for CVE-2026-123710.

• Active ScreenConnect attacks are targeting MSPs. Attackers are compromising managed service provider environments and deploying rogue remote-access clients to downstream customer devices. BleepingComputer reports that the campaign creates supply-chain risk across MSP customer networks.

• Attackers are abusing GSocket for Linux persistence. Threat actors are using the legitimate open-source remote-access tool to maintain access after patching the vulnerabilities used for initial compromise. Review the BleepingComputer report and hunt for unauthorized binaries, services, listeners, and outbound connections.

• Qilin ransomware activity remains substantial. Qilin has claimed at least 365 organizations over the past three months, according to KrebsOnSecurity. Reported operational-security mistakes may provide useful intelligence about the group’s administration, but defenders should prioritize detection, containment, and recovery readiness.

• eMudhra revoked eight additional CA certificates. The certificate authority identified improper private-key handling during certificate generation. Organizations should review certificate inventories, trust chains, and affected services using the BleepingComputer coverage as a starting point.

• Microsoft reports Windows update installation and SQL Server issues. November 2026 security updates may fail on some Windows 11 systems with the October preview update, while recent Windows updates are causing SQL Server performance and stability problems. See Microsoft-related reporting on installation failures and SQL Server regressions.

Analyst’s Take: Start with Red Hat Quay and ScreenConnect because both can extend beyond a single host or tenant. Treat possible registry credentials, signing keys, and remote-access changes as incident-response data, not routine patching tasks. GSocket hunting should follow on Linux systems where an earlier compromise may have survived remediation. For background, see our cloud security basics glossary.

Critical Vulnerabilities#

Red Hat Quay cross-tenant credential exposure

CVE-2026-110697 has a CVSS score of 9.9. A namespace owner may exploit SQL LIKE wildcard handling in the robot-account listing function to retrieve robot accounts and decrypted authentication tokens belonging to other tenants. Successful exploitation could enable unauthorized image operations and cross-tenant credential theft.

References:

• Red Hat security advisory
• Red Hat solution
• Red Hat Bugzilla

Red Hat Quay token-forgery and signing-key weakness

CVE-2026-123710 has a CVSS score of 9.8. An unauthenticated attacker may obtain an anonymous registry token with a controlled audience, install an attacker-controlled signing key through the service key-rotation endpoint, and forge tokens. Impact may include read and write access to private images and replacement of repository tags.

References:

• Red Hat security advisory
• Red Hat solution
• Red Hat Bugzilla

Treat potentially exposed registry credentials, signing keys, images, and tags as compromised until reviewed.

OpsTree REMS authentication bypass

CVE-2026-126768 has a CVSS score of 9.8 and affects OpsTree REMS through version 1.0.0. The reported flaw allows unauthenticated attackers to obtain valid JWTs by controlling the is_local_auth field, potentially granting SuperUser administrative access.

References:

• VulnCheck advisory
• Technical report
• OpsTree REMS project page

NextScan hardcoded JWT signing key

CVE-2026-126797 has a CVSS score of 9.8 and affects NextScan versions 1.1.0 through 1.2.0. A hardcoded JWT signing key in ns-admin can allow unauthenticated attackers to forge administrator tokens and access user management, scan tasks, and stored vulnerability results.

References:

• VulnCheck advisory
• NextScan Docker Compose configuration
• NextScan issue 48

blueprintUE exposed MariaDB root account

CVE-2026-126812 affects blueprintUE Self-Hosted Edition before 4.3.7. Its Docker Compose configuration enables an empty MariaDB root password and publishes port 3306. Attackers with network access may read, modify, or delete application databases.

References:

• blueprintUE release 4.3.7
• Affected database configuration
• Remediation commit

None of the listed vulnerabilities appears in the supplied CISA Known Exploited Vulnerabilities data. Their severity, authentication weaknesses, and potential exposure nevertheless warrant immediate triage. Review our CVE-2026-76519 coverage for additional vulnerability-analysis context.

What Defenders Should Do Today#

1. Inventory and remediate Red Hat Quay. Identify every Quay deployment, confirm affected versions, apply vendor fixes, and rotate robot-account credentials, registry credentials, and signing keys where exposure is possible.

2. Validate registry integrity. Review image pulls, pushes, token issuance, signing-key changes, repository-tag modifications, and administrative actions. Compare tags against trusted image digests and investigate unexpected changes.

3. Protect CI/CD secrets. Assume credentials stored in or used by affected registries may have been exposed. Rotate pipeline secrets, review service-account permissions, and scan build configurations for embedded registry tokens.

4. Harden ScreenConnect administration. Restrict administrative interfaces to approved networks, enforce multifactor authentication, review administrator and client changes, and remove unauthorized remote-access clients. MSPs should separately investigate connections and changes across customer tenants.

5. Hunt Linux systems for GSocket. Search for unexpected GSocket binaries, renamed copies, systemd services, cron entries, shell profiles, unusual listeners, and persistent outbound connections. Preserve evidence before removal when incident response is required.

6. Patch or isolate vulnerable applications. Upgrade OpsTree REMS, NextScan, and blueprintUE to fixed versions when available. Until then, remove public exposure, restrict administrative interfaces, block unnecessary database ports, and eliminate default, empty, or hardcoded credentials.

7. Control Windows update rollout. Assess Windows 11 November update installation failures in a pilot ring before broad deployment. Monitor SQL Server workloads for performance or stability regressions and consult current Microsoft guidance before applying mitigations.

8. Review certificate dependencies. Compare internal certificate inventories and trust stores against eMudhra revocation information. Replace affected chains, validate service certificates, and confirm that private keys are generated, stored, and accessed under controlled procedures.

9. Prepare for ransomware response. Preserve authentication, endpoint, file-access, backup, and remote-management logs. Confirm offline or otherwise isolated backups, test restoration, and verify that emergency response contacts and escalation paths are current.

Technical Deep Dive#

Red Hat Quay investigation checklist

Prioritize Quay audit records covering:

• Robot-account enumeration and unusual namespace access
• Token issuance from unexpected IP addresses or user agents
• Signing-key rotation or key-management events
• Image pushes from unfamiliar automation identities
• Repository-tag changes without corresponding build activity
• Pulls or writes involving sensitive repositories
• Access across tenant or namespace boundaries

Example log triage pattern:

# Adjust paths and field names to match the Quay deployment.
grep -Ei \\
  'robot|token|signing.?key|rotate|repository|tag|push|pull|namespace' \\
  /var/log/quay/*.log

For registries using structured logs, filter by actor, source address, repository, action, and result rather than relying only on text searches. Preserve original logs and record the time window, affected namespaces, and credential rotations.

Linux GSocket hunting

Search common persistence locations and identify unexpected processes or listeners:

# Process and network review
ps auxww
ss -lntup
lsof -nP -i

# Search likely persistence locations
find /tmp /var/tmp /dev/shm /opt /usr/local/bin \\
  -type f -perm /111 -printf '%TY-%Tm-%Td %TT %p\\n' 2>/dev/null

grep -RniE 'gsocket|gs-netcat|socat|curl|wget' \\
  /etc/systemd /etc/cron* /etc/rc.local \\
  /home/*/.ssh /root/.ssh 2>/dev/null

Do not delete suspicious files before collecting hashes, timestamps, process details, command lines, network destinations, and relevant system logs. After evidence collection, remove unauthorized persistence, rotate credentials, invalidate active sessions, and validate the host from a trusted baseline.

ScreenConnect and MSP review

Review:

• New or modified administrative users
• MFA enrollment and recovery-method changes
• New client records and unexpected deployment activity
• Remote sessions to customer systems outside normal support windows
• Newly installed remote-access software
• Changes to deployment policies, scripts, or automation
• Connections between MSP management infrastructure and customer endpoints

A useful initial query concept for a SIEM is:

where product == "remote-management"
  and (
    action in ("user_created", "user_modified", "client_added",
               "software_deployed", "policy_changed")
    or source.ip not in approved_admin_ranges
  )
| sort by timestamp desc

Adapt field names to the platform’s event schema and establish an approved administrative baseline before declaring an event malicious.

Windows update and SQL Server monitoring

Track update deployment status and correlate failures with server workload health:

# Installed updates and recent servicing events
Get-HotFix | Sort-Object InstalledOn -Descending |
  Select-Object -First 20

Get-WinEvent -LogName System -MaxEvents 500 |
  Where-Object {
    $_.ProviderName -match 'WindowsUpdate|Servicing|WUSA'
  } |
  Select-Object TimeCreated, Id, ProviderName, LevelDisplayName, Message

For SQL Server, compare query latency, wait statistics, CPU, memory pressure, storage latency, connection failures, and application error rates against a pre-update baseline. Avoid removing security updates solely on anecdotal performance reports; use controlled rollback or vendor guidance when operational impact is confirmed.

Risk Priorities#

Sources

• Red Hat: CVE-2026-110697
• Red Hat: CVE-2026-123710
• BleepingComputer: Active ScreenConnect attacks
• BleepingComputer: GSocket Linux persistence
• KrebsOnSecurity: Qilin ransomware
• BleepingComputer: eMudhra certificate revocations
• BleepingComputer: Windows update installation issues
• BleepingComputer: SQL Server performance issues

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.