Web shells target SAP NetWeaver as Chrome fixes exploited flaw

On 10 November 2026, the SANS Internet Storm Center notes continued attention on web shells and updates from several vendors. A web shell campaign appears to be exploiting an SAP Netweaver vulnerability described as an upload weakness that allows an attacker to place arbitrary files on the system. The shell is commonly named ant.jsp, and the exposure is tied to the ability to upload files to the server.

While this is not a new flaw, the ISC says it remains active in the wild and highlights SAP Netweaver as the standout target among several vulnerabilities being exploited, including PHP flaws. The takeaway from the researcher is to remain vigilant for web shells as a primary tactic after initial compromises through vulnerable web applications.

Separately, Google Chrome’s stable channel has been updated to fix nine vulnerabilities, including one already observed being exploited—a zero-day use-after-free in the XML parser. The report notes that while exploitation is plausible, there is not yet explicit confirmation of a full system compromise from this issue.

In enterprise mail, Outlook 365 is reportedly rejecting mail with a 550 error when DMARC is missing; the update indicates that, in addition to SPF and DKIM, an enforced DMARC policy is now required for mail to be accepted. Microsoft’s advisory context is that DMARC alignment informs recipients how to handle unauthenticated messages when SPF or DKIM fail.

On the incident response front, N-able disclosed that its n-central hosted environments were taken down after publishing details of about 30 vulnerabilities affecting the current version; no patches exist yet, and there is no detected exploitation to date. The remediation trajectory is described as on track, with host environments potentially remaining offline until mitigations are in place.