1. Top Action Item

Patch BeyondTrust Remote Support now: CVE-2026-102764 (CVSS 9.3) was exploited as a zero-day in late August 2026 by the China-nexus group Armory Castle (formerly UNC5221/Warp Panda) to take over Remote Support servers. The flaw is an improper origin validation issue in an internal messaging component that a remote attacker can use to compromise the appliance. Anyone running internet-facing BeyondTrust Remote Support — MSPs and their customers in particular — should apply the fixed build and then hunt for unauthorized administrative activity, because successful exploitation means the appliance itself may be under attacker control.

2. Exploited This Week

BeyondTrust Remote Support — CVE-2026-102764

• Source: The Hacker News
• Link: The Hacker News
• Severity: Critical — CVSS 9.3
• What's happening: The China-nexus espionage group Armory Castle (previously tracked as UNC5221 or Warp Panda) exploited this improper origin validation flaw in an internal messaging component as a zero-day in late August 2026 to seize Remote Support servers.
• Fix: Apply the patched BeyondTrust Remote Support release (see source for version) and review appliances for post-exploitation activity.

FortiOS / FortiPAM / FortiProxy / FortiSwitchManager — CVE-2025-61624

• Source: The Hacker News
• Link: The Hacker News
• Severity: CVSS 5.4
• What's happening: A suspected advanced threat actor exploited this path traversal flaw in the command line interpreter to deliver PEERSTITCH, a previously unreported memory-resident ARM64 implant that bypasses checks on tagged VPN sessions.
• Fix: Upgrade the affected Fortinet products per the vendor advisory (see source); because the implant is memory-resident, plan on reimaging compromised FortiGate devices rather than only removing files.

FortiManager — CVE-2024-47575

• Source: Palo Alto Unit 42
• Link: Palo Alto Unit 42
• Severity: see source
• What's happening: Unit 42 investigated an intrusion in which attackers exploited CVE-2024-47575 to target more than 500 firewalls and deploy the PEERSTITCH implant — an older flaw still being used to gain a foothold at scale.
• Fix: Confirm FortiManager is on a fixed release (see source) and inspect managed FortiGate firewalls for PEERSTITCH indicators.

3. Critical Patch Roundup

Fortinet

FortiSandbox / FortiSandbox Cloud — FG-IR-26-185

• Source: Fortinet FortiGuard
• Link: Fortinet FortiGuard
• Severity: Critical — CVSS 9.6
• What's happening: Authentication bypass using an alternate path or channel in the FortiSandbox web management interface lets a remote unauthenticated attacker bypass authentication with crafted HTTP requests.
• Fix: Upgrade FortiSandbox to a release listed in the advisory.

FortiSIEM — FG-IR-26-180 (grpc phQueryMaster arbitrary file write)

• Source: Fortinet FortiGuard
• Link: Fortinet FortiGuard
• Severity: Critical — CVSS 9.4
• What's happening: A path traversal in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets.
• Fix: Apply the FortiSIEM update referenced in the advisory.

FortiAnalyzer / FortiManager (incl. Cloud) — FG-IR-26-178

• Source: Fortinet FortiGuard
• Link: Fortinet FortiGuard
• Severity: High — CVSS 7.9
• What's happening: SQL injection enables a low-privileged user to execute arbitrary commands and perform arbitrary file read/write via crafted requests.
• Fix: Upgrade FortiAnalyzer and FortiManager per the advisory.

FortiMail webmail — FG-IR-26-184

• Source: Fortinet FortiGuard
• Link: Fortinet FortiGuard
• Severity: High — CVSS 7.7
• What's happening: SQL injection in FortiMail webmail lets an authenticated attacker execute unauthorized code or commands via crafted HTTP requests.
• Fix: Apply the FortiMail update referenced in the advisory.

Microsoft

October 2026 Patch Tuesday

• Source: Cisco Talos
• Link: Cisco Talos
• Severity: 85 vulnerabilities rated "Critical" out of 1,415 total
• What's happening: Microsoft's monthly security release covers 1,415 vulnerabilities across its product range, 85 of them critical; Talos published Snort rules and a breakdown of the prominent ones.
• Fix: Deploy the October 2026 monthly security updates; prioritize internet-facing roles called out in the roundup.

Microsoft Edge (Chromium-based) — multiple Chromium CVEs

• Source: Microsoft MSRC
• Link: Microsoft MSRC
• Severity: see source
• What's happening: Edge ingests Chromium fixes for a batch of Chrome-assigned CVEs this week, including CVE-2026-106258, CVE-2026-106263, CVE-2026-106264, CVE-2026-106268, CVE-2026-106270, CVE-2026-106271, CVE-2026-106273, CVE-2026-106274, CVE-2026-106276 and CVE-2026-106278 (use-after-free, missing/incorrect authorization, uninitialized resource, improper input validation, UI misrepresentation).
• Fix: Update Edge to the current build; Chrome release notes are referenced from the MSRC advisories.

Visual Studio Tools for Applications / SQL Server Management Studio — CVE-2026-103572

• Source: Microsoft MSRC
• Link: Microsoft MSRC
• Severity: see source (remote code execution)
• What's happening: A remote code execution vulnerability affecting Visual Studio Tools for Applications and SQL Server Management Studio; MSRC added download and KB links for the fixed Visual Studio builds.
• Fix: Install the fixed builds listed in the advisory.

Linux kernel — CVE-2026-99999 ("PwnEscape")

• Source: The Hacker News
• Link: The Hacker News
• Severity: Critical (per source)
• What's happening: A flaw in the Linux kernel's networking code lets code inside a guest VM read host memory; a researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. It affects the kernel itself, not one cloud's configuration.
• Fix: Update to a kernel release containing the fix (see source); multi-tenant and VM-hosting environments should treat this as top priority.

OpenBSD 7.9 — local privilege escalation

• Source: The Hacker News
• Link: The Hacker News
• Severity: see source
• What's happening: Researchers at Calif chained a roughly 37-year-old integer overflow with a separate kernel flaw to gain root on OpenBSD 7.9, bypassing KARL, SMAP and SMEP, and published a full proof-of-concept after fixes shipped.
• Fix: Apply the OpenBSD fixes referenced in the writeup.

4. Home / SOHO Impact

• Update Microsoft Edge (and any Chromium browser) right away. This week's Edge/Chromium batch includes use-after-free and authorization flaws; the update is a normal browser restart-and-install.
• If you use AOMEI Backupper on Windows, update it from AOMEI directly and run a full malware scan. Attackers tampered with the vendor's own update servers in five-to-ten-minute windows between May and July 2026, so any copy that checked for updates during those windows could have pulled a backdoor.
• Ignore fake "Claude" and "ChatGPT" pages and pop-ups. Impersonation campaigns are surging and typically use ClickFix-style tricks that tell you to paste a command into Windows Run or PowerShell — never do it.
• Small offices running FortiMail webmail or FortiSandbox should patch now — both have high/critical fixes out this week (SQL injection and an authentication bypass, respectively).
• Keep your Linux machines and any home lab VMs on current kernels — the "PwnEscape" kernel flaw lets a guest VM read host memory.
• Check your router/firewall vendor's advisory page if you run Fortinet gear at home or in a home office — FortiOS has active exploitation and several new fixes this week.

5. Enterprise Impact

• Treat BeyondTrust Remote Support as a compromised-appliance scenario, not just a patch ticket. CVE-2026-102764 (CVSS 9.3) was exploited as a zero-day by Armory Castle; after patching, audit administrative accounts, sessions, and configuration changes on any internet-facing Remote Support instance, and assume credential material on the box was exposed.
• FortiGate/FortiManager estates need a hunt, not just an upgrade. PEERSTITCH is memory-resident ARM64 malware delivered via CVE-2025-61624, and separately via CVE-2024-47575 against 500+ firewalls; because it lives in memory, reimage affected appliances and review VPN session handling for the tagging bypass described.
• Patch the two 9.x Fortinet bugs on any internet-reachable appliance first: FortiSandbox FG-IR-26-185 (CVSS 9.6, unauthenticated auth bypass) and FortiSIEM FG-IR-26-180 (CVSS 9.4, unauthenticated command execution). Then cover FortiAnalyzer/FortiManager (FG-IR-26-178, 7.9) and FortiMail webmail (FG-IR-26-184, 7.7).
• Run October 2026 Patch Tuesday on an accelerated schedule: 1,415 vulnerabilities, 85 rated critical. Use the Talos roundup and Snort rules to prioritize exposed services and to add detection coverage.
• Patch Linux kernel hosts that run untrusted workloads. CVE-2026-99999 lets a guest read host memory and was demonstrated against a live cloud sandbox provider — CI runners, container hosts, and VDI/VM fleets are the exposure.
• MSPs: investigate the ConnectWise Cloud Backup (formerly SkyKick) credential abuse. A compromised M365 credential tied to the service was used to sign in to 173 Microsoft 365 tenants; rotate affected credentials and review M365 sign-in logs for unfamiliar tenants, applications, and MFA patterns.
• Sweep developer and build pipelines for the MALFEX npm package imgdecode. The package hides a shellcode loader in a Windows native addon, has been downloaded 979 times, and was still live on npm at time of reporting — remove it, rotate any tokens exposed to install-time scripts, and check for the loader on Windows build agents.
• Edge devices remain the top initial-access vector. Unit 42 ranks edge exploits first among observed initial-access vectors, and Dark Reading reports Ivanti, Cisco and Palo Alto Networks edge-device vulnerabilities also came under attack this week — inventory and patch internet-facing edge appliances even where no CVE is named.
• Legacy BSD and management tooling still counts: the OpenBSD 7.9 root exploit has public PoC code, and the SQL Server Management Studio / VSTA RCE (CVE-2026-103572) needs the fixed builds from MSRC on admin workstations.

6. What To Patch First

1. BeyondTrust Remote Support — fixed release for CVE-2026-102764 (exploited zero-day, CVSS 9.3)
2. FortiOS / FortiPAM / FortiProxy / FortiSwitchManager — fix for CVE-2025-61624 (exploited to deliver PEERSTITCH)
3. FortiManager — fixed release for CVE-2024-47575 (exploited; 500+ firewalls targeted)
4. FortiSandbox / FortiSandbox Cloud — FG-IR-26-185 (CVSS 9.6, unauthenticated auth bypass)
5. FortiSIEM — FG-IR-26-180 (CVSS 9.4, unauthenticated command execution)
6. Microsoft October 2026 security updates — 85 critical fixes across the product line
7. Microsoft Edge / Chromium — current build covering CVE-2026-106258 and related CVEs (browser, widely deployed)
8. Linux kernel — CVE-2026-99999 "PwnEscape" (critical VM-to-host memory read)
9. FortiAnalyzer / FortiManager — FG-IR-26-178 (CVSS 7.9 SQL injection) and FortiMail — FG-IR-26-184 (CVSS 7.7)
10. OpenBSD 7.9 — patches for the chained local root exploit (public PoC available)
11. SQL Server Management Studio / Visual Studio Tools for Applications — fixed builds for CVE-2026-103572 (RCE)

Sources

• China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers — https://thehackernews.com/2026/10/china-linked-hackers-exploited.html
• BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs — https://www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugs
• PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions — https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html
• Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant — https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
• Arbitrary file write in grpc phQueryMaster (FG-IR-26-180) — https://fortiguard.fortinet.com/psirt/FG-IR-26-180
• Improper access control and session management in the web management interface (FG-IR-26-185) — https://fortiguard.fortinet.com/psirt/FG-IR-26-185
• Multiple Arbitrary File Read/Write via SQL Injection (FG-IR-26-178) — https://fortiguard.fortinet.com/psirt/FG-IR-26-178
• SQL command injection in webmail (FG-IR-26-184) — https://fortiguard.fortinet.com/psirt/FG-IR-26-184
• Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities — https://blog.talosintelligence.com/microsoft-patch-tuesday-for-october-2026/
• Chromium CVE-2026-106258: Uninitialized resource (and related MSRC Chromium advisories) — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106258
• CVE-2026-103572 Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103572
• Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory — https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html
• Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug — https://thehackernews.com/2026/10/researchers-demonstrate-openbsd-root.html
• Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor — https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html
• MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon — https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html
• Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants — https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html
• Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk — https://www.darkreading.com/application-security/fake-claude-chatgpt-attacks-developers-risk
• Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 — https://unit42.paloaltonetworks.com/top-5-initial-access-vectors-september-2026/