BeyondTrust suspects Armory Castle uses AI to model target products for exploit development
Armory Castle began exploiting BeyondTrust zero-day CVE-2026-102764 on August 29, 2026.
patch
Our coverage: 69 reports since October 8, 2026. Latest: BeyondTrust suspects Armory Castle uses AI to model target products for exploit development, October 18, 2026.
-
-
SANS ISC researchers release YARA rule to detect orphaned VBA in DWG files
The rule, named autocad_orphaned_vba_project, detects orphaned VBA projects hidden inside DWG files.
-
Enterprise IT checklist for auditing Intel‑only Mac software before Rosetta removal
Tech Times notes that iMazing’s scanner, Jamf Pro MDM audits, and the RosettaCheck database can identify Intel‑dependent apps, and 9To5Mac advises auditing fleets now before upgrading.
-
TP‑Link releases firmware fixing six flaws in Tapo C200 V5 and C120 V1
Combining the authentication bypass and command‑injection flaws lets attackers on the same network gain admin access and run commands.
-
Security researchers report high‑severity VBS enclave flaw CVE‑2026‑108471
SentinelOne, app.opencve.io, PremierePC Technology Group and TheHackerWire report that the flaw carries a CVSS v3.1 base score of 8.8, rated as high severity.
-
Microsoft discloses SharePoint privilege‑escalation flaw CVE-2026-96044
The flaw carries a CVSS score of 8.8 and is rated Important by Microsoft.
-
AI-driven attacks now move 4 times faster
Palo Alto Networks’ Unit 42 finds threat actors using AI to slash breach cycles to under an hour, while its service integrates OpenAI and Anthropic models to detect vulnerabilities continuously
-
China-linked espionage group exploited BeyondTrust zero-day in Remote Support appliances
Armory Castle, tracked by Mandiant and Google Threat Intelligence, used the flaw starting August 29 to deploy backdoors and harvest credentials, with patches now available.
-
Claude Code Desktop preview pane flaw rated High severity by Anthropic
Anthropic assigned the vulnerability a CVSS v4.0 score of 8.7, equivalent to host code execution, according to CSO Online and noma.security
-
Drupal patches two critical RCE flaws affecting all supported versions
Patched releases include Drupal core 10.6.19, 11.3.19, 11.4.10 and Entity List module 3.0.10.
-
Hackers breach ETS system, exposing California student records
The California Department of Education disclosed the breach on October 16, 2026.
-
Armory Castle escalates BeyondTrust zero-day exploitation with credential theft and lateral movement
Google warns of continued targeting of edge devices as the group deploys webshells, backdoors and SOCKS5 tunneling after patch release