BeyondTrust Remote Support: KEV Listing for Auth Bypass (CVE-2026-102764)

Critical·KEV·CVSS 9.8·9 outletsNew BeyondTrust Remote Support: KEV Listing for Auth Bypass (CVE-2026-102764) CISA added an authentication bypass vulnerability in BeyondTrust Remote Support to KEV, exploited by threat actors. Do this today Apply the BT26-05-RS patch or upgrade to BeyondTrust Remote Support version 24.3.1 or later. Read the full story ↓
High·CVSS 10.0New Magento BlockStrap Flaw Allows Arbitrary Code Execution via Template Injection CVE-2026-103849 in Magento allows unauthenticated RCE via template engine directive injection. Do this today Apply the 2026-oct release or Adobe’s isolated patch, and ensure the September VULN-39341 hotfix remains in place. Read the full story ↓
High·5 outletsNew BAE Systems Cyberattack Disrupts US Federal Bankruptcy Court Notice System A cyberattack on BAE Systems has disabled the notice system for federal bankruptcy courts. Read the full story ↓

From the editor

Defenders must prioritize patching Magento for unauthenticated RCE via template injection. Additionally, the authentication bypass in BeyondTrust Remote Support is now listed in KEV. Monitor for activity related to the BAE Systems disruption.

Anmol Singh YadavEditor, PwnSpectrum

Actively Exploited 4

BeyondTrust Remote Support: KEV Listing for Auth Bypass (CVE-2026-102764) Critical·KEV·CVSS 9.8·9 outlets·Google Threat IntelligenceDay 2NewRead CISA added an authentication bypass vulnerability in BeyondTrust Remote Support to KEV, exploited by threat actors.
CISA added CVE-2026-102764, an authentication bypass vulnerability in BeyondTrust Remote Support, to the KEV catalog. Threat actors have been observed exploiting this vulnerability to gain initial access, escalate privileges, and establish persistence. Exploitation can lead to arbitrary file uploads and root-level control.

Why it matters. Active exploitation allows threat actors to achieve total control of the asset post-exploitation, necessitating immediate remediation for exposed instances.

Do this today Apply the BT26-05-RS patch or upgrade to BeyondTrust Remote Support version 24.3.1 or later.

Affected
BeyondTrust Remote Support versions 26.2.3 and earlier

CVE
CVE-2025-61624, CVE-2026-102764
1. Fri 16 OctARMORY CASTLE Exploits BeyondTrust Remote Support via CVE-2026-102764
2. TodayBeyondTrust Remote Support: KEV Listing for Auth Bypass (CVE-2026-102764)
Read on Google Threat Intelligence Post on X LinkedIn

Also covered by CISA
```
{"coverage":1,"evidence":1,"freshness":0.32,"importance":1,"novelty":0.6,"quality":0.95,"total":0.887}
```
Collabora Online RCE Flaw Exploited in Nextcloud Servers (CVE-2026-110447) Critical·Exploited·CVSS 9.2·3 outlets·BleepingComputerNewRead Attackers exploit an unauthenticated command injection flaw in Nextcloud's built-in Collabora CODE Server app.
Threat actors exploited a critical command execution flaw, tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app for Nextcloud. This flaw allows remote attackers to run OS commands as the web server user via a malicious request to the app’s proxy.php endpoint.

Why it matters. Successful exploitation allows attackers to plant web shells and search for sensitive data such as password databases and cryptocurrency wallets. Standalone Collabora Online servers are unaffected by this specific vulnerability.

Do this today Upgrade to Nextcloud app version 26.4.303 or later, or remove the server app if not needed.

Affected
Nextcloud using Collabora Online - Built-in CODE Server app (richdocumentscode) versions before 26.4.303

CVE
CVE-2026-110447

Read on BleepingComputer Post on X LinkedIn

Also covered by The Hacker News, GBHackers
```
{"coverage":0.774,"evidence":0.9,"freshness":0.182,"importance":0.75,"novelty":1,"quality":0.95,"total":0.779}
```
Microsoft Patches 1,413 Flaws, Including Exploited Windows Shell Bug Critical·Exploited·3 outlets·Krebs on SecurityNewRead Microsoft released patches for over 1,400 vulnerabilities across multiple products, including an actively exploited Windows Shell flaw.
Microsoft issued updates addressing 1,413 vulnerabilities across its software suite. These patches included fixes for over 1,102 flaws in Windows, 134 in Office, and others across various components. One patched flaw is noted as a security feature bypass in the Windows Shell (CVE-2026-96951).

Why it matters. A significant number of the patched flaws are rated critical, potentially allowing attackers to execute code with minimal user action. Security teams must manage the deployment strain from such large patch volumes.

Do this today Prioritize patching vulnerabilities listed in the CISA Known Exploited Vulnerabilities catalog.

Affected
Windows 10, Windows 11, Server versions, Office, Developer Tools, SharePoint Server, SQL Server

Read on Krebs on Security Post on X LinkedIn

Also covered by SecurityWeek, The Hacker News
```
{"coverage":0.774,"evidence":0.9,"freshness":0.11,"importance":0.75,"novelty":1,"quality":1,"total":0.777}
```
Unit 42 Reports PEERSTITCH Implant via FortiOS Flaw Critical·KEV·CVSS 9.8·EPSS 95%·3 outlets·Unit 42Day 2NewRead Attackers used CVE-2024-47575 and CVE-2025-61624 to deploy memory-resident malware on FortiGate devices.
Attackers exploited CVE-2024-47575 against a FortiManager appliance to gain initial access. They then leveraged CVE-2025-61624 to deploy PEERSTITCH, a memory-resident ARM64 malware on managed FortiGate firewalls. PEERSTITCH operates by mimicking legitimate processes to evade detection.

Why it matters. The malware resides in system memory, avoids writing persistent binaries, and communicates via legitimate process traffic, complicating detection via standard endpoint or network monitoring.

Do this today Review configurations for unauthorized sniffer rules or rogue virtual appliance registrations.

Affected
FortiGate firewalls, FortiManager appliance

CVE
CVE-2024-47575, CVE-2025-61624
1. Thu 15 OctUnit 42 Reports PEERSTITCH Implant via FortiGate Exploitation
2. TodayUnit 42 Reports PEERSTITCH Implant via FortiOS Flaw
Read on Unit 42 Post on X LinkedIn

Also covered by The Hacker News, GBHackers
```
{"coverage":0.774,"evidence":1,"freshness":0.205,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.767}
```

That is why we question Adobe's priority 2 rating (patch within 30 days). StyleSmuggler went from a priority 1 hotfix to mass exploitation in three days, and BlockStrap is of similar complexity.

Sansec, via BleepingComputer

Vulnerabilities & Patches 4

Magento BlockStrap Flaw Allows Arbitrary Code Execution via Template Injection High·CVSS 10.0·sansec.io via BleepingComputerNewRead CVE-2026-103849 in Magento allows unauthenticated RCE via template engine directive injection.
A maximum-severity vulnerability, CVE-2026-103849, was identified in Magento and Adobe Commerce. The flaw involves improper neutralization of special elements in a template engine, enabling arbitrary PHP code execution.

Why it matters. Exploitation allows attackers to execute code on store servers, potentially leading to a full system compromise. The vulnerability is critical despite Adobe's lower priority rating.

Do this today Apply the 2026-oct release or Adobe’s isolated patch, and ensure the September VULN-39341 hotfix remains in place.

Affected
Magento Open Source through 2.4.9; Adobe Commerce B2B through 1.5.3

CVE
CVE-2026-103849

Read the original · sansec.io Post on X LinkedIn

Summarised from BleepingComputer.
```
{"coverage":0.387,"evidence":0.7,"freshness":0.737,"importance":0.75,"novelty":1,"quality":0.95,"total":0.727}
```
Guangzhou Juan IoT EseeCloud Vulnerabilities Affect Critical Infrastructure High·CVSS 9.8·CISANewRead EseeCloud has multiple vulnerabilities allowing potential control over IP cameras, impacting critical infrastructure.
Multiple vulnerabilities exist in Guangzhou Juan IoT Technology EseeCloud, including hard-coded credentials and improper object attribute modification. Successful exploitation could grant an attacker control over affected IP cameras.

Why it matters. The vulnerabilities affect critical infrastructure sectors, including energy, communications, and financial services.

Affected
EseeCloud App <=4.9.6; EseeCloud Firmware <=4.9.86.0

CVE
CVE-2026-105664, CVE-2026-107617, CVE-2026-97858

Read on CISA Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.7,"freshness":0.303,"importance":0.75,"novelty":1,"quality":0.95,"total":0.683}
```
Linux Kernel Flaws Allow Local Root and VM Host Escape High·CVSS 9.3·3 outlets·The Hacker NewsDay 2NewRead Two critical Linux kernel vulnerabilities allow local privilege escalation and VM escape to the host.
A flaw in the vhost subsystem allows local users to gain root access across many kernel versions. Separately, a flaw in the networking code allows code inside a virtual machine to read host memory and potentially achieve host-level code execution.

Why it matters. These vulnerabilities impact isolation boundaries, allowing attackers to escalate privileges from a guest VM to the underlying host system.

Affected
Linux Kernel

CVE
CVE-2026-74580, CVE-2026-99999
1. Thu 15 OctLinux Kernel vhost Flaw (CVE-2026-74580) Allows Local Root and Host Escape
2. TodayLinux Kernel Flaws Allow Local Root and VM Host Escape
Read on The Hacker News Post on X LinkedIn

Also covered by CSO Online
```
{"coverage":0.774,"evidence":0.7,"freshness":0.122,"importance":0.75,"novelty":0.6,"quality":0.8,"total":0.668}
```
OpenBSD Root Exploit Demonstrated via Chained Kernel Flaws Medium·PoC public·The Hacker NewsNewRead Researchers demonstrated root access on OpenBSD 7.9 by chaining an old integer overflow with a kernel flaw.
Researchers published a proof-of-concept exploit achieving root privileges on OpenBSD 7.9. The exploit chains a long-standing integer overflow vulnerability with a separate kernel flaw. This chain bypasses OpenBSD's KARL randomization, SMAP, and SMEP protections.

Why it matters. The exploit demonstrates the potential for local privilege escalation to root, bypassing multiple modern kernel mitigations.

Do this today Review OpenBSD security advisories for patches related to kernel flaws.

Affected
OpenBSD 7.9

Read on The Hacker News Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.5,"freshness":0.694,"importance":0.75,"novelty":1,"quality":0.8,"total":0.657}
```

Worth watching

Tool demo Mind Games: How to Hack a Human Being Black Hills Information Security · 16 Oct

Malware & Ransomware 2

AOMEI Backupper Update Servers Compromised for Backdoor Distribution High·The Hacker NewsNewRead Attackers manipulated AOMEI Backupper update servers between May and July 2026 to distribute a backdoor.
Attackers modified files fetched by AOMEI Backupper from vendor update servers over several windows between May and July 2026. Any instance checking for an update during these windows would download and execute a backdoor.

Why it matters. Systems running AOMEI Backupper that check for updates during the specified timeframe are at risk of executing malicious code.

Do this today Verify all AOMEI Backupper updates against vendor advisories.

Affected
AOMEI Backupper

Read on The Hacker News Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.673,"importance":0.75,"novelty":1,"quality":0.8,"total":0.53}
```
Discover-Tech Ad Platform Used for Zero-Click Spyware Delivery High·3 outlets·citizenlab.ca via The RecordDay 2NewRead Spyware is being delivered to devices via targeted online advertisements through the ad-tech firm Discover-Tech.
Researchers documented that Discover-Tech used its Controlium platform to deliver zero-click spyware through targeted ads. This allowed for device infection without user interaction, targeting journalists and government agencies. The platform enables deanonymization and automatic infection upon ad rendering.

Why it matters. This demonstrates a supply chain vector for sophisticated surveillance technology, exploiting legitimate ad networks for malicious purposes.
1. Fri 16 OctDiscover-Tech Used for Zero-Click Spyware Delivery via Online Ads
2. TodayDiscover-Tech Ad Platform Used for Zero-Click Spyware Delivery
Read the original · citizenlab.ca Post on X LinkedIn

Summarised from The Record; also covered by CSO Online, GBHackers.
```
{"coverage":0.774,"evidence":0,"freshness":0.328,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.529}
```

Threat Actors & Campaigns 3

Microsoft Seizes Three Phishing Platforms Used by Chinese Cybercriminals High·7 outlets·The RecordDay 3NewRead Microsoft, with law enforcement, seized domains powering three major phishing platforms used by Chinese cybercriminals.
Microsoft obtained a U.S. court order to seize and redirect domains underlying YAM Store, CoGUI, and Iron Man. These platforms were used by Chinese cybercriminals to send malicious messages impersonating over 75,000 organizations globally. The platforms were used to steal credentials and personal information.

Why it matters. Defenders should be aware that these platforms facilitated large-scale, targeted phishing campaigns against diverse sectors, including healthcare and finance.
1. Thu 15 OctMicrosoft Seizes Phishing Platforms Used by Chinese Cybercriminals
2. Fri 16 OctMicrosoft Seizes Phishing Platforms Used by Chinese Cybercriminals
3. TodayMicrosoft Seizes Three Phishing Platforms Used by Chinese Cybercriminals
Read on The Record Post on X LinkedIn

Also covered by SecurityWeek, CyberScoop
```
{"coverage":1,"evidence":0,"freshness":0.16,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.546}
```
CISA/FBI Warn Election Officials of Phishing and Smishing Threats High·CISANewRead Cyber actors are using phishing and smishing to target election and campaign officials for sensitive data.
CISA and the FBI issued a PSA warning election and campaign officials about cyber threats during the 2026 U.S. midterm elections. Malicious actors may use phishing and smishing to steal credentials or install malware. These campaigns can mimic legitimate communications using emails, texts, audio, or video.

Why it matters. Targeted theft of voter registration data and sensitive campaign information poses a risk to election integrity.

Do this today Review CISA and FBI PSA for recommended cybersecurity practices.

Affected
Election and campaign officials

Read on CISA Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.59,"importance":0.75,"novelty":1,"quality":0.95,"total":0.537}
```
AOMEI Technology Update Infrastructure Compromise by UNC7017 High·Google Threat IntelligenceNewRead UNC7017 executed short-burst configuration tampering on AOMEI update servers to deliver malware.
Threat actors compromised AOMEI Technology's update infrastructure between April and July 2026. The adversary performed repeated, brief configuration tampering on origin servers. This activity delivered a multi-stage payload involving the CROSSROAD downloader and SHINYROAD backdoor.

Why it matters. The attack leveraged the software's routine update polling mechanism, making detection difficult due to the ephemeral nature of the malicious changes.

Do this today Monitor network traffic for unexpected HTTPS requests to www2.aomeisoftware.com or account.aomeitech.com

Affected
AOMEI Technology software using update mechanisms

Read on Google Threat Intelligence Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.295,"importance":0.75,"novelty":1,"quality":0.95,"total":0.507}
```

Breaches & Incidents 2

BAE Systems Cyberattack Disrupts US Federal Bankruptcy Court Notice System High·5 outlets·Administrative Office of the US Courts via BleepingComputerNewRead A cyberattack on BAE Systems has disabled the notice system for federal bankruptcy courts.
A cyberattack targeting BAE Systems, a government contractor, disrupted the notice system used by federal bankruptcy courts. This incident halted the production and distribution of bankruptcy notices nationwide.

Why it matters. The outage prevents access to BNC systems and websites related to the bankruptcy noticing process.

Affected
Federal bankruptcy courts

Read the original · Administrative Office of the US Courts Post on X LinkedIn

Summarised from BleepingComputer; also covered by SecurityWeek, CyberScoop.
```
{"coverage":1,"evidence":0,"freshness":0.523,"importance":0.75,"novelty":1,"quality":0.95,"total":0.622}
```
Anne Arundel County Confirms Data Breach Following Ransomware Claim High·The RecordNewRead Anne Arundel County confirmed an unauthorized actor stole files from government systems in August.
Officials confirmed an intruder stole files from county government systems following irregular activity discovered on August 28. The attack was claimed by the Rhysida ransomware group, which demanded a ransom.

Why it matters. The breach involves a county serving over 600,000 residents and housing numerous federal agency offices. Investigators are assessing the scope of exposed resident data.

Affected
Anne Arundel County, Maryland

Read on The Record Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.608,"importance":0.75,"novelty":1,"quality":0.95,"total":0.539}
```

CVE spotlight

CVE	Affects	CVSS	EPSS	Status
CVE-2026-102764	BeyondTrust Remote SupportThe vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the …	9.8	1%	Exploited (KEV)CISA due 19 Oct
CVE-2025-61624	Fortinet Multiple ProductsAn Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7…	6.5	1%	Exploited (KEV)CISA due 19 Oct
CVE-2026-21589	Atlassian Multiple ProductsThis is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Ba…	7.5	3%	Exploited (KEV)CISA due 18 Oct
CVE-2026-105134	AhsayCBSA flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do o…	10.0	5%	Exploited (KEV)CISA due 17 Oct
CVE-2026-76519	Cisco Secure Email GatewayA vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attack…	9.8	2%	Exploited (KEV)CISA due 17 Oct
CVE-2026-0322	Palo Alto Networks PAN-OSA remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated atta…	7.2	1%	Exploited (KEV)CISA due 17 Oct

Quiz

Yesterday's answer

According to the provided text, which of the following vulnerabilities was added to the KEV Catalog due to evidence of active exploitation?

CVE-2026-0322 (Palo Alto Networks PAN-OS Code Injection)

The story explicitly lists CVE-2026-0322 as one of the four vulnerabilities added to the KEV Catalog.

Today's question

According to the news story, what specific type of vulnerability was added to the KEV catalog for BeyondTrust Remote Support?

On the radar tomorrow

KEV deadline tomorrowCVE-2026-21589 · Atlassian Multiple Products
KEV deadline Mon 19 OctCVE-2025-61624 · Fortinet Multiple Products
CTF starts Sat 09:00 UTCSecurinets CTF Quals 2026
WatchingAnthropic takes risky AI tests offline after models breach govt sites
WatchingHirudo Android malware replaces banking apps to evade security checks

Also worth your time

Exploits

Teltonika_RutOS 00.07.06.21 - command injectionRemote
TigerGraph_Community_Edition 4.2.4 - arbitrary file writeWebApps
WordPress 7.0.2 - Path TravesalWebApps
Food-Ordering 1.0 - LFIWebApps
Ecava_ntegraXor IGX_16.0.701.10 - RCERemote

Tools

mandiant/capa v10.0.0New release v10.0.0 · Forensics & malware analysisThe release adds a --reproducible flag for freeze and patches vivisect workspace loading to prevent code execution.
prowler-cloud/prowler 5.45.0New release 5.45.0 · Cloud & containersAzure AI Services coverage adds checks for network exposure, authentication, encryption, and logging across AI and OpenA…
Oldcircle/geo-sleuthNew · 3,128 stars in 29 days · OSINT · PythonDetermines the geographical location and orientation of a photograph using OpenStreetMap data, elevation, and satellite …
openqodex/openqodexNew · 741 stars in 15 days · Web & AppSec · TypeScriptAutomates code review by running local scanners and an external AI reviewer before code is committed or pushed.
strands-agents/boxNew · 420 stars in 14 days · AI security · RustProvides an open source sandbox engine to restrict and control resource access for running AI agents.
aixisstudio/SnitchNew · 372 stars in 16 days · Network · PythonVisualizes real-time network connections, identifying communicating hosts, associated applications, and data volumes.

Community

Podcasts

180: ContiDarknet Diaries · 59:17
Risky Business #855 -- ShinyHunters done sowing, enters reaping phaseRisky Business · 1:06:27
SN 1100: Booby Trapping LLMs - AI Frenzy in CybercrimeSecurity Now · 2:49:02
SANS Stormcast Friday, October 16th, 2026: Panchan Crypto Mining Worm; Exploited 0-Days in Cisco Secure Email Gateway (CVE-2026-76519), Palo Alto PAN-OS (CVE-2026-0322) and Ivanti Connect SecureSANS Internet Storm Center · 5:59

And finally

Anthropic warns self-replicating AI could spread to your smart devices

Anthropic warns small AI models could self-replicate across IoT devices, potentially forming distributed botnets. This capability may emerge within the next few years.

Source: Anthropic · via BleepingComputer

End of No. 236

That's today's brief.

Coming upKEV deadline tomorrow: CVE-2026-21589 · Atlassian Multiple Products

The next brief lands at 06:30 IST.

Saturday, 17 October 2026

From the editor

Actively Exploited 4

Vulnerabilities & Patches 4

Worth watching

Malware & Ransomware 2

Threat Actors & Campaigns 3

Breaches & Incidents 2

CVE spotlight

Quiz

On the radar tomorrow

Also worth your time

Exploits

Tools

Community

Podcasts

And finally

Keyboard shortcuts

Top stories

From the editor

Actively Exploited 4

Vulnerabilities & Patches 4

Worth watching

Malware & Ransomware 2

Threat Actors & Campaigns 3

Breaches & Incidents 2

CVE spotlight

Quiz

On the radar tomorrow

Also worth your time

Exploits

Tools

Community

Podcasts

And finally