TL;DR for CISOs: BeyondTrust disclosed that a suspected China-nexus group exploited a Remote Support zero-day from August 29, and attackers are chaining two AhsayCBS backup server flaws after an incomplete vendor fix. Quieter day otherwise, so this is a shorter edition.
- Remote support, privileged access and backup consoles hold stored credentials and reach deep into the network. Treat them as tier-zero assets, not utilities.
- Evidence on the appliance cannot be trusted once an attacker has root. Forward logs off the device before you need them.
- A vendor patch can be incomplete. Ahsay's first fix did not hold, so verify the running build instead of closing the ticket on the vendor's word.
Lead story: China-linked actor exploited a BeyondTrust Remote Support zero-day
CRITICAL · REMOTE ACCESS / PRIVILEGED ACCESSFlaw: CVE-2026-102764 in BeyondTrust Remote Support, tracked in advisory BT26-05. The Hacker News describes it as improper origin validation in an internal messaging component, scored CVSS 9.3, that lets a remote attacker perform file operations on the appliance
Who is exposed: Self-hosted Remote Support appliances. BeyondTrust says Privileged Remote Access shares the affected code; it found no way to exploit it but released a patch as a precaution. SaaS instances were patched by BeyondTrust
Exploitation: BeyondTrust reports the zero-day was used on August 29 against one BeyondTrust-hosted instance and one self-hosted appliance. Its proactive hunt found the SaaS intrusion on September 28, and it contained that incident 27 minutes after detection
Attribution: BeyondTrust assesses with moderate to high confidence a China-nexus espionage actor. Mandiant tracks it as UNC5221 (ARMORY CASTLE) and CrowdStrike as WARP PANDA
Reported attacker activity: Per Google Threat Intelligence Group and Mandiant as reported by The Hacker News: root access, a PHP web shell named SAWFLY, a SOCKS5 tunneler named BARECLAW, an attempt to harvest credentials from the appliance's secrets database, and deletion of system, web server and application logs
Fixes: BeyondTrust's timeline lists an October 8 patch and an October 15 coordinated disclosure. The Hacker News reports SaaS patching by October 9 and says self-hosted versions 24.3.1 through 26.2.3 need the BT26-05-RS patch, while older versions must upgrade first. Outlets differ by a day on the SaaS date
Not confirmed: How many other customers were affected. BeyondTrust describes two confirmed incidents and gives no total. Credential theft is described as an attempt. BeyondTrust's view that the actor picks targets in advance and used AI to build exploit chains is a working assessment
What happened
BeyondTrust published its advisory and a Mandiant analysis on October 15, after patching its hosted service and shipping a fix for self-hosted customers a week earlier. The vendor says two intrusions occurred on August 29, and that it found the hosted one only through its own threat hunting a month later.
Mandiant and Google's threat intelligence group describe an actor that gained root, left a web shell and a traffic relay, reached into stored secrets and removed logs. They say any internet-reachable appliance on a vulnerable version during the exposure window should be treated as potentially compromised until reviewed. BeyondTrust is withholding technical details until self-hosted patching is further along.
Evidence
Verified against independently fetched sources:
1. BeyondTrust, ARMORY CASTLE and BT26-05: patch self-hosted Remote Support and PRA now
2. The Hacker News, China-linked hackers exploited BeyondTrust zero-day to take over Remote Support servers
Corroborating coverage: Cyber Security News
What this means for your team
A remote support appliance is a broker. It stores credentials, holds a list of systems it can reach and is often reachable from the internet so that support staff can use it. An attacker who controls it inherits that trust, and the first thing this actor did was remove the logs that would show it.
The timeline is the planning lesson. Exploitation began about six weeks before public disclosure, and detection came from the vendor's hunt, not from a customer alert. Patching today closes the door but does not tell you who walked through it, so the review window matters as much as the patch.
Third-party risk also shows up here in a practical form: your exposure depended on a vendor's detection speed and on how quickly it chose to disclose. Ask your critical remote access vendors how they hunt and how fast they notify.
Action checklist
- Inventory every BeyondTrust Remote Support and Privileged Remote Access instance, hosted or self-hosted, and record the version. Apply the BT26-05 patch path that matches each deployment and confirm the running build.
- Restrict administrative interfaces to trusted networks and control outbound traffic from the appliances, so a compromised unit cannot expose a tunnel to the internet.
- Forward appliance logs and session events to your SIEM in near real time. Hunt for unrecognized privileged sessions, unexpected scripts in web directories, permission changes and gaps in log forwarding.
- If compromise is possible, image the appliance first, then rebuild it, rotate every credential it brokered and review new MFA registrations on privileged accounts.
Supporting story: Attackers chain two AhsayCBS flaws after an incomplete patch
HIGH · BACKUP INFRASTRUCTUREFlaws: CVE-2026-105133, an authentication bypass, and CVE-2026-105134, an OS command injection in the Replication Receiver component of the AhsayCBS backup server. Chained, they allow unauthenticated code execution with SYSTEM privileges
Exploitation: Huntress reported attacks against at least five organizations as of October 8. SecurityWeek reports NIST disclosed the flaws on October 4 and that exploit code had been released. eSecurity Planet places first observed exploitation on October 7
Observed payloads: JSP web shells, XMRig cryptominers disguised as Microsoft Edge executables, a fake Edge update service for persistence and a vulnerable kernel driver, per Huntress as reported
Fix status: Ahsay confirmed on October 10 that version 10.3.4.0 had not adequately addressed the flaws and issued hotfix 10.3.4.45 through its partner portal. The sources reviewed contain no independent test confirming the hotfix fully resolves both flaws
Federal listing: A daily threat brief that reproduces CISA catalog data lists both CVEs as added to the Known Exploited Vulnerabilities catalog on October 14 with an October 17 federal due date. Severity scores differ between sources
Not confirmed: Huntress did not report ransomware or confirmed theft of backup data. The five organizations were targeted, not confirmed breached
What happened
Researchers saw exploitation within days of the flaws becoming public. Ahsay's first fix, released in version 10.3.4.0, turned out to be inadequate, which left customers who had already upgraded still exposed until the hotfix appeared.
Evidence
Verified against independently fetched sources:
1. SecurityWeek, unpatched AhsayCBS vulnerabilities exploited in the wild
2. eSecurity Planet, AhsayCBS patch fails to fix two exploited flaws
What this means for your team
Backup servers are attractive because they hold copies of everything and often run with broad privileges. They are also widely deployed by managed service providers, so your exposure may sit in a supplier's environment rather than your own.
The incomplete first patch is a reminder to verify remediation. A version number that matches the vendor's advisory is not proof that the flaw is closed.
Action checklist
- Find every AhsayCBS server, including those run by your managed service providers, and apply hotfix 10.3.4.45. Reboot and verify the running build.
- Restrict the management interface to trusted addresses or a VPN until you have confirmed the fix.
- Hunt for child processes of the AhsayCBS service, JSP files in web directories, unfamiliar Windows services and processes impersonating Edge. Preserve forensic evidence first.
- Verify backup integrity and rotate credentials stored on any server you suspect was touched.
Also notable
- Spyware delivered through online ads: Citizen Lab reports an ad vendor, Discover-Tech, supplied a platform that Candiru and Bindecy used to target devices, and says it is the first confirmation of government-backed zero-click spyware delivered through ads. At least 45 Windows computers at Al Jazeera were reportedly compromised in 2024 and 2025. Which governments were responsible is not identified. Source: TechCrunch (single source reviewed).
- Park Dental Partners: In an SEC filing signed October 13, the dental support organization says unauthorized network access identified August 28 resulted in data being acquired, and that it has identified affected patients whose protected health information was involved. It does not disclose a count, reports no material financial impact so far and notes four putative class actions in Minnesota. Source: SEC Form 8-K.
- MLD Mortgage: An incident tracker lists a confirmed data breach disclosed through an attorney general filing on October 15, with the number of records undisclosed. Source: Board Cybersecurity incident tracker (single source reviewed).
Frequently asked questions
What is CVE-2026-102764?
A zero-day in BeyondTrust Remote Support, described by The Hacker News as an improper origin validation flaw in an internal messaging component with a CVSS score of 9.3. A remote attacker could perform file operations on an affected appliance. BeyondTrust says a suspected China-nexus group exploited it from August 29, 2026.
Which BeyondTrust products need the patch?
Self-hosted Remote Support appliances need the BT26-05 patch. Privileged Remote Access shares the affected code, and BeyondTrust patched it as a precaution after finding no way to exploit it. SaaS instances were patched by BeyondTrust.
Who is ARMORY CASTLE?
The name Mandiant uses for the cluster it also tracks as UNC5221. CrowdStrike calls it WARP PANDA. BeyondTrust assesses with moderate to high confidence that it is a China-nexus espionage actor.
Why did the actor delete logs?
Per BeyondTrust and Mandiant, the actor removed system, web server and application logs on the appliance to hinder detection. For that reason, BeyondTrust advises forwarding appliance logs to a SIEM in near real time so evidence survives on a separate system.
What are the AhsayCBS flaws, CVE-2026-105133 and CVE-2026-105134?
An authentication bypass and an OS command injection in the AhsayCBS backup server. Attackers chained them for unauthenticated code execution with SYSTEM privileges. Ahsay confirmed on October 10 that version 10.3.4.0 had not adequately fixed them and issued hotfix 10.3.4.45.
What should a CISO do first this week?
Identify every remote support, privileged access and backup management appliance reachable from the internet, confirm patch status, restrict administrative interfaces to trusted networks, and send their logs to a system the appliance cannot alter.
Curated by Pritha Aash, Community Head, CISO Platform
Subscribe to the weekly newsletter
More from the Breach Intelligence hub, including yesterday's look at the Cisco Secure Email Gateway flaw and the Ivanti Connect Secure zero-day chain, plus vulnerability management coverage on CISO Platform.
Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.
Comments