BeyondTrust suspects Armory Castle uses AI to model target products for exploit development
Armory Castle began exploiting BeyondTrust zero-day CVE-2026-102764 on August 29, 2026.
CVE
Our coverage: 55 reports since October 8, 2026. Latest: BeyondTrust suspects Armory Castle uses AI to model target products for exploit development, October 18, 2026.
-
-
FBI arrests ransomware negotiator Dubrovsky before Philadelphia Cyber Risk Summit on Oct. 8, 2026
Senior DOJ officials described the Martino case as significant and are considering roundtables with cybersecurity firms to discuss insider‑threat prevention.
-
TP‑Link releases firmware fixing six flaws in Tapo C200 V5 and C120 V1
Combining the authentication bypass and command‑injection flaws lets attackers on the same network gain admin access and run commands.
-
Security researchers report high‑severity VBS enclave flaw CVE‑2026‑108471
SentinelOne, app.opencve.io, PremierePC Technology Group and TheHackerWire report that the flaw carries a CVSS v3.1 base score of 8.8, rated as high severity.
-
Microsoft discloses SharePoint privilege‑escalation flaw CVE-2026-96044
The flaw carries a CVSS score of 8.8 and is rated Important by Microsoft.
-
China-linked espionage group exploited BeyondTrust zero-day in Remote Support appliances
Armory Castle, tracked by Mandiant and Google Threat Intelligence, used the flaw starting August 29 to deploy backdoors and harvest credentials, with patches now available.
-
Drupal patches two critical RCE flaws affecting all supported versions
Patched releases include Drupal core 10.6.19, 11.3.19, 11.4.10 and Entity List module 3.0.10.
-
Armory Castle escalates BeyondTrust zero-day exploitation with credential theft and lateral movement
Google warns of continued targeting of edge devices as the group deploys webshells, backdoors and SOCKS5 tunneling after patch release
-
China-linked Armory Castle hijacks BeyondTrust Remote Support Servers via zero-day since August
The espionage group exploited CVE-2026-102764 to deploy custom malware, harvest credentials, and evade detection across enterprise networks, researchers say
-
XBOW gets $250,000 Google Chrome bounty for billion‑user exploit
Researchers demonstrated a proof‑of‑concept industrial control systems (ICS)‑Sniper attack that analyzes virtual private network (VPN)-encrypted packet metadata to time packet drops and disrupt operations on a SWaT water‑treatment testbed
-
CISA warns of critical flaws in EseeCloud IP‑camera firmware and app
The flaws affect EseeCloud App versions ≤4.9.6 and Firmware ≤4.9.86.0, letting attackers gain full control of devices.
-
CISA warns of six vulnerabilities in J4Care dcm4chee‑arc‑light
CISA reported that CVE-2026-97851 has a CVSS v3.1 base score of 9.1 (Critical) due to missing authorization on a storage status‑change REST endpoint.