Huntress

Huntress is an American managed detection and response firm that watches customers' endpoints and publishes research on the attacks it sees. Wikipedia, the only available source for its origins, says it was founded in 2015 in Columbia, Maryland, by Kyle Hanslovan, Chris Bisnett and John Ferrell, former National Security Agency operators, and names Hanslovan as chief executive.

In August 2026 Huntress saw attackers use N-central's Take Control feature to pivot onto managed endpoints, tunnelling through Cloudflare's own service to stay hidden. On 3 August it counted 13.6 per cent of reachable N-central servers still unpatched. On 28 August its researchers rebuilt the PaperCut NG/MF pre-authentication chain on a stock server and found it running in two customer environments.

Then on 4 and 5 September a fully patched customer N-central server was compromised. Huntress built a proof of concept for the new bypass chain before reporting the case. CISA's listing came while N-able still had no confirmations, which suggests outside responders such as Huntress see these consoles abused before the vendor's own telemetry does. Huntress researcher John Hammond has also warned that the SimpleHelp single sign-on bypass CVE-2026-48558 matters more than its severity score suggests.