The RMM auth bypass is a rerun — and that’s the lesson. CISA added CVE-2026-18577 (CVSS 8.2) — an authentication bypass in N-able N-central — to the KEV catalog Aug 3. It exists because the patch for CVE-2026-18556 was incomplete; attackers moved to the reopened path. Huntress observed one partner account abused to reach nine downstream organizations via the built-in Take Control feature, with tunnels left behind for persistence. N-able has since shipped follow-on hotfixes — so “we patched” needs a version check on the host, against the current advisory, not the one you read two weeks ago.

A worm ate the npm registry’s caching aisle. The self-propagating “ChainDrop” campaign compromised the maintainer account behind keyv/cacheable and poisoned 444 packages (2,212 versions) in under four hours — packages with roughly 2 billion combined monthly downloads. The payload steals npm tokens, cloud credentials and CI/CD secrets via a preinstall hook, then republishes itself; C2 resolves from an Ethereum smart contract, which walks straight past domain blocklists. If your team ran npm installs in the affected window: rotate everything, then check what else those credentials could reach.

Patch Tuesday, plus the one already being used. Microsoft’s August drop fixed 421 CVEs, including CVE-2026-68820 — a use-after-free in the WinSock ancillary function driver exploited as a zero-day for privilege escalation. Priority order writes itself: the exploited one first, then internet-facing, then everything else. And per this week’s theme: verify the fix landed on the host, not just that the deployment job reported green.

FIVE QUESTIONS THAT OUTRANK ANY RMM FEATURE COMPARISON

1  Does the console share an identity system with your
   domain — so one takeover becomes two?
2  Is MFA enforced ON THE CONSOLE — not just on the
   technician's email account?
3  Can any tech open remote control on any endpoint at
   any hour — or is it scoped and scheduled?
4  Does the management server have unrestricted outbound
   access? (Could it quietly tunnel to anywhere?)
5  Is there ONE session record an admin of that same
   server cannot edit?

⚠️ The kit is a review format and a starting point — not managed security services, and not legal, compliance, or audit advice. Vendor advisories change; verify version guidance against the current advisory before acting. If you find evidence of compromise, follow your incident-response plan and engage counsel and your insurer per its terms.

“One tool in our stack can reach every machine we manage — that’s what it’s for. This week a widely used tool in that category was exploited, and the attacker didn’t need malware; they used the product’s own remote-control feature. I want two hours to answer five architecture questions about ours, verify our patch level on the server itself, and pull ninety days of remote-session history. Best case, we write down proof that we’re clean. Worst case, we find out on our schedule instead of theirs.”

Pick the one that stings most. Answers shape the next round of playbooks — anonymous, aggregated, no list-building tricks.