China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

thehackernews.com Oct 16, 2026

China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

Curated by Shubham · TechCapsules · Oct 16, 2026

AI-summarised brief · reviewed before publication

A China‑linked espionage group known as Armory Castle (formerly UNC5221/Warp Panda) exploited a newly disclosed zero‑day in BeyondTrust Remote Support (CVE‑2026‑102764, CVSS 9.3) on August 29, 2026. The flaw, an improper origin validation in an internal messaging component, allowed remote file operations on self‑hosted appliances. After a second public exploitation on September 27, 2026, BeyondTrust issued patches for SaaS customers on October 9 and urged self‑hosted users of versions 24.3.1‑26.2.3 to apply the BT26‑05‑RS update, while older versions must upgrade. Mandiant detailed that the attackers deployed a lightweight PHP web shell (SAWFLY) to gain encrypted C2, elevate privileges, steal stored credentials, and move laterally. The group has a track record of zero‑day attacks on Citrix and Ivanti devices, targeting high‑value sectors for long‑term intelligence gathering.

💡 Why It Matters

· The breach shows how state‑aligned actors can weaponize unpatched remote‑support tools to infiltrate critical infrastructure, forcing organizations to reassess exposure of legacy appliances on the internet.

Capsules Cybersecurity

Read full article on thehackernews.com

Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed…

Drupal’s core Field UI module contains a critical flaw (CVE‑2026‑108097) that allows unauthenticated remote code execution through certain contributed modules. The vulnerability, rated 19/25 by Drupal, was fixed in releases 11.4.10, 11.3.19, and 10.6.19 on October 14. At least one exploit path requires no login, and 28.5% of sites reporting their core version were affected. Sites unable to update immediately can uninstall the Field UI module for temporary protection. The advisory warns that exploits may emerge quickly.

💡 The flaw exposes a high‑risk entry point that bypasses authentication, enabling attackers to run arbitrary code on vulnerable Drupal installations. Prompt patching is essential to prevent potential data breaches and system compromise.

thehackernews.com · Oct 15

Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted…

Citizen Lab confirmed that Israeli spyware vendor Candiru infected Al Jazeera devices via zero‑click online ads served by Discover‑Tech. The ads, which loaded silently, sent device identifiers to a Discover‑Tech server that, if the device matched a target, returned malicious code to the browser or app. At least 45 Al Jazeera devices were compromised in 2024‑25, with evidence linking the attack to Candiru. Google, IAB Europe, and other ad platforms removed Discover‑Tech after the findings.

💡 The case shows that state‑backed spyware can reach high‑profile targets through ordinary ad networks, bypassing traditional security checks. It exposes a loophole that lets malicious actors embed malware in seemingly benign advertising, raising urgent questions about ad‑tech vetting and the protection of journalists.

thehackernews.com · Oct 15

AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete…

Singapore-based Ahsay Backup released security updates for AhsayCBS after two vulnerabilities, CVE‑2026‑105133 and CVE‑2026‑105134, were exploited to drop web shells and XMRig miners. The flaws allowed attackers to bypass authentication and execute arbitrary commands. Initial patches in August 2026 were incomplete; the company now offers hotfixes in versions 9.15.2.59 and 10.3.4.45. Huntress confirmed the new fix blocks the attack chain, and CISA added the flaws to its Known Exploited Vulnerabilities list, mandating federal patching by October 17, 2026.

💡 The vulnerabilities enabled attackers to gain unauthenticated remote code execution, compromising sensitive data and enabling cryptocurrency mining. Prompt patching is essential to protect federal systems and prevent further exploitation.

techcrunch.com · Oct 15

Citizen Lab says governments are abusing online ads to hack people with…

Citizen Lab researchers revealed that Israeli advertising firm Discover‑Tech is being used by government‑backed spyware developers to deliver zero‑click malware through online ads. The study documents that spyware makers Candiru and Bindecy exploited Discover‑Tech’s platform to target devices worldwide, including at least 45 Windows computers at Al Jazeera. The attacks, occurring in 2024‑25, leveraged malicious ad code that infected devices without user interaction. The report provides the first technical evidence of state‑backed spyware being distributed via ad networks, exposing a broad range of potential targets.

💡 The discovery exposes a new vector for covert surveillance, turning ubiquitous advertising into a weapon that can silently compromise high‑profile devices. This escalation forces a reevaluation of ad‑network security and the effectiveness of current defensive measures.

thehackernews.com · Oct 14

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages

Microsoft, Health‑ISAC, JC3, and a coalition of private firms dismantled three phishing kits—CoGUI, Haozi, and Iron Man System—responsible for over one billion scam emails and SMS messages since January 2026. The kits, linked to the YAM Store marketplace, targeted more than 75,000 organizations across 150 countries, exploiting compromised Microsoft and Google cloud environments. The operation, authorized by court order, exposed shared code and infrastructure among the kits, revealing a coordinated Chinese‑speaking cybercriminal ecosystem.

💡 The takedown halts a massive, globally‑scaled phishing infrastructure that siphoned millions of dollars, underscoring the effectiveness of cross‑sector collaboration in neutralizing sophisticated cybercrime networks.

thehackernews.com · Oct 14

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Attackers exploited a command‑injection flaw in Collabora Online’s Built‑in CODE Server app for Nextcloud, allowing unauthenticated web shell deployment when the local document server was offline. The vulnerability, reported on GitHub on September 10, enabled attackers to execute arbitrary commands as the web‑server user. Collabora released a patch in version 26.4.303 on September 11, later issuing CVE‑2026‑110447 on October 14. The fix requires Nextcloud 30+; older installations must upgrade or remove the app. The flaw affected only the built‑in app, not standalone Collabora servers.

💡 The incident exposes how optional add‑ons can become critical attack vectors, underscoring the need for timely updates in open‑source ecosystems. It also highlights that disabling an app is insufficient; proper version control and removal are essential to safeguard server integrity.