N-able took its hosted N-central environments offline.^[1] It urged customers who run N-central on their own premises to shut down their servers.^[2] N-central is a remote monitoring and management platform.^[3] It is the kind of software an IT provider uses to reach into its clients' machines, which is why flaws in it matter beyond the company that makes it. What was published A researcher disclosed more than 30 alleged zero-day vulnerabilities in N-central.^[4] He published proof-of-concept exploits in a GitHub repository called Able2Shell.^[5] The flaws include remote code execution and authentication bypass.^[6] The two reports give the researcher's first name differently. BleepingComputer calls him Sean Bales. TechCrunch calls him Ben Bales.^[7] Why he published Bales claimed N-able ignored vulnerability reports he had submitted before.^[8] He released the bugs after the company allegedly failed to patch flaws reported earlier.^[9] That is his account. Neither report carries N-able's answer to it. What N-able says N-able said no successful exploitation of the bugs has been confirmed.^[10] It had observed no active exploitation as of 9 November.^[11] It confirmed it was developing a hotfix.^[12] The outage N-able had not set a timeline for restoring the service.^[13]