Top stories.
- BeyondTrust patches a critical zero-day.
- CISA warns of actively exploited Atlassian flaw.
- Ransomware gangs increasingly threaten physical violence.
BeyondTrust patches a critical zero-day.
BeyondTrust has patched a critical flaw in its Remote Support (RS) appliances that’s been exploited in zero-day attacks by a suspected Chinese APT since late August, SecurityWeek reports. The vulnerability (CVE-2026-102764) can “allow an attacker to perform file operations on the appliance.” BeyondTrust is withholding technical details of the flaw to give customers time to apply the patches.
Mandiant published a report alongside BeyondTrust’s disclosure, stating that the China-nexus espionage actor ARMORY CASTLE has been exploiting the flaw to gain initial access since at least August 29th, 2026.
The researchers stated, “Throughout the intrusion, ARMORY CASTLE leveraged a deep understanding of BeyondTrust appliance internals, as evidenced by their abuse of proprietary CLI utilities, startup configuration templates, and local reverse-proxy routing. The threat actor used newly identified custom malware, the SAWFLY webshell and the BARECLAW tunneler to interact with the BeyondTrust device. Additionally, the actor routinely deleted appliance logs and endpoint artifacts to maintain access and evade detection.”
Mandiant added, “Organizations should prepare for potential widespread exploitation following this disclosure, as ARMORY CASTLE and other threat actors have historically conducted broad, opportunistic exploitation once the vulnerability becomes public.”