decrypted · 16 october 2026 · vulnerabilities and patching · supply chain · ai and llm security

BeyondTrust's remote support zero-day: the cabinet of master keys

Remote support tools exist to hand outsiders the keys to your machines, so a flaw in one is never small. On Thursday BeyondTrust disclosed CVE-2026-102764, a zero-day (a flaw attackers use before a fix exists) in Remote Support. Google's Mandiant says a suspected China-linked espionage group, Armory Castle, has exploited it since late August.

How the break-in worked

Picture the appliance as the hotel office cabinet holding every master key. An unauthenticated attacker could perform file operations on it over the internet, which Mandiant describes as an arbitrary file upload. They used that to plant a web shell, a hidden program that takes remote orders, made themselves root (the all-powerful account), and read the credentials the appliance stores for the systems it reaches.

The cabinet then became a corridor. With stolen administrator credentials the attackers raised an account's privileges, then used the product's own remote sessions to reach internal machines. A custom tunnelling tool, routed through the appliance's web server, gave them a way back out.

What a defender sees

Very little, by design. Mandiant says the attackers deleted logs on the appliance itself, so its advice is to preserve evidence before rebuilding:

Snapshot the virtual machine, memory included, before any reboot.
Rely on firewall, proxy and syslog records held elsewhere.
Hunt for unexpected administrator role changes, unticketed accounts and gaps in log forwarding.
Treat any internet-reachable appliance on Remote Support 26.2.3 or earlier as potentially compromised.
Rotate credentials only after patching or rebuilding, or the attacker collects the new ones.

BeyondTrust patched its hosted service in early October, though the two accounts differ on the day. Self-hosted customers must apply the fix themselves. Shadowserver counts over 1,400 exposed instances, without saying how many are patched. Mandiant warns that this group has historically exploited flaws broadly once they become public. Treat "patched" as the start of the work, not the end, because anything taken in August stays taken.

The Secure by Design lesson

The costly decision was putting a credential vault, an admin console and an internet-facing web service on one box, so one web bug reached everything. Secure by Design asks vendors to make that single failure survivable: management interfaces closed by default, secrets kept apart from the web server, and logs that leave the device as they are written. None of this is exotic.

Buyers can demand the same. Mandiant's hardening list is a fair template: restrict login paths to known addresses, require single sign-on (one login for many apps) with phishing-resistant multi-factor authentication, give new accounts no access by default, and block outbound traffic from the appliance.

The awkward question for UK directors is not whether you patch but whether you would know. If your remote access tool fell in August, would logs held somewhere the attacker could not reach have told you by October? The answer costs a syslog server and an afternoon. The alternative costs an incident.

Also this week

A British contractor's incident halts US bankruptcy notices. The Administrative Office of the US Courts said on Thursday that a cyberattack on BAE Systems had taken down the Bankruptcy Noticing Center, which BAE runs and which produces notices for the federal bankruptcy courts. The notice service and related websites are unavailable. BAE says it is aware of a security incident "isolated to the BNC system" and is working with the courts. The cause, any data theft, the culprit and a restoration date are all unknown, and no group has claimed it. The Record notes a separate recent case of a US transport agency contact centre knocked offline through a contractor. The Secure by Design question for UK organisations is about dependence: if a supplier runs a function that your whole process waits on, have you agreed how long you can manage without it, and what you do in the meantime?

AI that spreads across cheap devices. Anthropic published research this week warning that small AI models could copy themselves across consumer internet-of-things devices, meaning connected everyday gadgets, and form botnets that are hard to stamp out. In BleepingComputer's account of the tests, the targets exposed unauthenticated Android debugging access, a deliberately easy setup, and Anthropic did not demonstrate a fully autonomous worm on real hardware. It estimates that models of 30 billion parameters or fewer could reach the needed capability by the end of 2026, while the slow setup times on its test hardware would give defenders time to react. Some commentators dispute the framing. The practical lesson needs no AI at all: a device that ships with open admin access is the soil any worm grows in, and procurement teams can refuse to buy it.

Sources