Daily digest,
Critical Zero-Day Exploit Found in BeyondTrust Remote Support (+7 more)
Vulnerabilities
Critical Zero-Day Exploit Found in BeyondTrust Remote Support
BeyondTrust disclosed a critical vulnerability, CVE-2026-102764, in its Remote Support product, exploited by the suspected China-linked group ARMORY CASTLE since August 2026. This flaw, with a CVSS score of 9.3, allows attackers to perform arbitrary file uploads and gain host-level control without requiring credentials or user interaction. The vulnerability affects all Remote Support versions up to 26.2.3. BeyondTrust identified the exploitation on August 29 and released a patch on October 8, 2026. Google and Mandiant have warned that the disclosure could lead to widespread exploitation, urging organizations to apply the patch immediately. The attackers used a web shell named SAWFLY to maintain access after exploiting the flaw. BeyondTrust's sensors failed to detect the initial intrusion due to false positives in its third-party detection system.
APT · 2 sources · score 81 · CVE-2023-46805, CVE-2024-21887, CVE-2026-102764, CVE-2026-1731, Armory Castle
CISA Adds Critical Vulnerabilities in PAN-OS, Cisco, and Ahsay to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and AhsayCBS. The vulnerabilities are CVE-2026-0322 (high-severity code injection), CVE-2026-76519 (critical relative path traversal), CVE-2026-105133 (improper authentication), and CVE-2026-105134 (critical command injection). Active exploitation has been confirmed for these vulnerabilities, particularly CVE-2026-76519 and CVE-2026-105134, which have been used to deploy web shells and cryptocurrency miners. Ahsay customers are specifically advised to address these vulnerabilities due to previous patches failing to fully mitigate the issues. Federal agencies have until October 17, 2026, to remediate these vulnerabilities. The vulnerabilities were added to the KEV catalog on October 14, 2026, based on evidence of active exploitation.
Vulnerability · 3 sources · score 73 · CVE-2026-0322, CVE-2026-105133, CVE-2026-105134, CVE-2026-76519, XMRig
Next.js Releases Security Update for RCE Vulnerabilities
On October 14, 2026, Vercel released an out-of-band security update for Next.js, addressing two unauthenticated remote code execution (RCE) vulnerabilities and a high-severity denial-of-service flaw. The update, available in versions 16.4.1 and 15.5.28, fixes issues with React Server Components and the librsvg library used for SVG image rendering. The first RCE vulnerability, affecting versions 16.0.0 to 16.4.0, can be exploited when server responses include multiple typed arrays and an attacker-controlled value. The second flaw, tracked as CVE-2026-96889, is a memory bug in librsvg that allows code execution on glibc-based Linux systems. The denial-of-service flaw can cause high CPU usage in affected applications, leading to service disruption. Developers are urged to upgrade immediately, even if their applications do not utilize the vulnerable functions.
Vulnerability · 3 sources · score 72 · CVE-2026-96889
Breaches
Magna Hospitality Group Data Breach Exposes Sensitive Personal Information
Magna Hospitality Group, a Rhode Island-based real estate investment firm, reported a data breach due to a ransomware attack attributed to the Qilin group. The breach occurred between May 22 and May 24, 2025, when unauthorized access to company systems allowed the intruder to copy files. The stolen data includes Social Security numbers, financial accounts, and driver's licenses, affecting numerous individuals. Magna notified affected consumers and reported the incident to the California Attorney General on October 13, 2026. The company is offering complimentary access to credit monitoring services for those impacted. Legal representatives are investigating the possibility of a class action lawsuit for affected individuals. The breach involved approximately 385 GB of data being stolen, as claimed by the ransomware group.
Ransomware · 2 sources · score 62 · Qilin
Cyber Hygiene and Resilience Amid Rising Attacks in the UK
In 2026, the UK faces increasing cyber threats, with notable breaches affecting organizations like Beacon CRM and Manchester Airport Group. The National Cyber Security Centre (NCSC) emphasizes a whole-of-state approach to cyber resilience, urging both public and private sectors to collaborate. Cyber hygiene is critical, focusing on risk assessment, incident response, and minimizing damage during breaches. The rise of AI in cyber attacks complicates defenses, making continuous vigilance essential. Phishing remains a significant threat, with over half of businesses experiencing attacks this year. The Cyber Essentials standard is promoted as a foundational measure for organizations, particularly SMEs, to bolster their defenses. Recent reports indicate that only 27% of organizations conduct incident simulations with partners, highlighting a gap in preparedness.
Breach · 2 sources · score 58
AI Misuse Risks Highlighted Amid Growing Cybersecurity Concerns
Recent reports from cybersecurity experts emphasize the potential for AI-enabled terrorism, particularly in cyber, biological, and chemical domains. The Belfer Center identifies critical choices in AI model deployment that could lower the barrier for such attacks, while the World Economic Forum stresses the need for zero-trust principles in AI cybersecurity. The resignation of AI researcher Jacob Coxan from Anthropic has raised alarms about AI's existential risks. Notable incidents, such as the Hugging Face security breach, illustrate how AI systems can act unpredictably, leading to misuse. Both articles highlight the urgent need for heightened risk control and accountability in AI development and deployment. The consensus is that without proper safeguards, the likelihood of AI misuse will increase, necessitating immediate action from enterprises and governments alike.
Breach · 2 sources · score 55
Burnaby School Cyberattack Exposes Personal Data of Students and Staff
A ransomware attack on the Burnaby School District on September 21, 2026, resulted in the theft of personal information belonging to students, parents, and staff. The district confirmed that unauthorized access led to the copying of files containing names, birthdates, grades, and school names. Additionally, sensitive documents such as residency confirmation and kindergarten assessment notes were potentially compromised. The district has reported the incident to the Burnaby RCMP and the Office of the Information and Privacy Commissioner for B.C. In response, they offered affected individuals registration with TransUnion’s Fraud Alert Database to monitor for potential fraud. The district maintains that the impact on the community is limited, though it urges vigilance against suspicious communications. Investigations are ongoing to assess the full scope of the breach.
Breach · 2 sources · score 52
Threat actors and malware
Canada's Data Centres Face Rising Security Risks Amid Strategic Developments
The Canadian Security Intelligence Service (CSIS) warns that data centres in Canada are becoming increasingly critical for national security, yet they face growing security risks from cyberattacks, supply chain vulnerabilities, and foreign threats. A recent assessment highlights the importance of these facilities in protecting sensitive information and supporting economic stability. The report emphasizes that foreign ownership poses significant risks, particularly from companies in China. Concurrently, the Canadian government plans to construct a new data centre for the Communications Security Establishment (CSE) in Ottawa, aimed at enhancing secure computing capacity. This facility will support mid to long-term objectives related to operations and technology modernization. The estimated cost of the project is between $1.5 billion and $1.8 billion, with a tender expected in 2027. The assessment also notes that data centres can be targets for cyberattacks, citing recent incidents involving Iranian and Russian attacks on data centres.
Supply Chain · 2 sources · score 58
New on leak sites
42 victims listed on ransomware leak sites by 13 groups in the 24 hours before this issue. The most active:
Also moving
- CVEs: CVE-2026-105133, CVE-2026-105134, CVE-2022-37434, CVE-2023-46805, CVE-2024-21887
- Malware: Shai-hulud, Bareclaw, CikaBika Bot, CikaBika Bot RAT, ClickFix
- Campaigns: AdFection
- APT groups: APT28, APT29, Armory Castle, Candiru, Cozy Bear
- Ransomware groups: Cl0p
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.