🛡️ Cybersecurity Vulnerability Watch

Week of: 2026-10-11 to 2026-10-17 Reporting window: Most recently completed Sunday–Saturday (excludes the in-progress week).

---

1. Top Action Item

Patch BeyondTrust Remote Support now: CVE-2026-102764 (CVSS 9.3) was exploited as a zero-day in late August 2026 by the China-nexus group Armory Castle (formerly UNC5221/Warp Panda) to take over Remote Support servers. The flaw is an improper origin validation issue in an internal messaging component that a remote attacker can use to compromise the appliance. Anyone running internet-facing BeyondTrust Remote Support — MSPs and their customers in particular — should apply the fixed build and then hunt for unauthorized administrative activity, because successful exploitation means the appliance itself may be under attacker control.

---

2. Exploited This Week

BeyondTrust Remote Support — CVE-2026-102764

• Source: The Hacker News
• Link: The Hacker News
• Severity: Critical — CVSS 9.3
• What's happening: The China-nexus espionage group Armory Castle (previously tracked as UNC5221 or Warp Panda) exploited this improper origin validation flaw in an internal messaging component as a zero-day in late August 2026 to seize Remote Support servers.
• Fix: Apply the patched BeyondTrust Remote Support release (see source for version) and review appliances for post-exploitation activity.

FortiOS / FortiPAM / FortiProxy / FortiSwitchManager — CVE-2025-61624

• Source: The Hacker News
• Link: The Hacker News
• Severity: CVSS 5.4
• What's happening: A suspected advanced threat actor exploited this path traversal flaw in the command line interpreter to deliver PEERSTITCH, a previously unreported memory-resident ARM64 implant that bypasses checks on tagged VPN sessions.
• Fix: Upgrade the affected Fortinet products per the vendor advisory (see source); because the implant is memory-resident, plan on reimaging compromised FortiGate devices rather than only removing files.

FortiManager — CVE-2024-47575

• Source: Palo Alto Unit 42
• Link: Palo Alto Unit 42
• Severity: see source
• What's happening: Unit 42 investigated an intrusion in which attackers exploited CVE-2024-47575 to target more than 500 firewalls and deploy the PEERSTITCH implant — an older flaw still being used to gain a foothold at scale.
• Fix: Confirm FortiManager is on a fixed release (see source) and inspect managed FortiGate firewalls for PEERSTITCH indicators.

---

3. Critical Patch Roundup

Fortinet

FortiSandbox / FortiSandbox Cloud — FG-IR-26-185

• Source: Fortinet FortiGuard
• Link: Fortinet FortiGuard
• Severity: Critical — CVSS 9.6
• What's happening: Authentication bypass using an alternate path or channel in the FortiSandbox web management interface lets a remote unauthenticated attacker bypass authentication with crafted HTTP requests.
• Fix: Upgrade FortiSandbox to a release listed in the advisory.

FortiSIEM — FG-IR-26-180 (grpc phQueryMaster arbitrary file write)

• Source: Fortinet FortiGuard
• Link: Fortinet FortiGuard
• Severity: Critical — CVSS 9.4
• What's happening: A path traversal in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets.
• Fix: Apply the FortiSIEM update referenced in the advisory.

FortiAnalyzer / FortiManager (incl. Cloud) — FG-IR-26-178

• Source: Fortinet FortiGuard
• Link: Fortinet FortiGuard
• Severity: High — CVSS 7.9
• What's happening: SQL injection enables a low-privileged user to execute arbitrary commands and perform arbitrary file read/write via crafted requests.
• Fix: Upgrade FortiAnalyzer and FortiManager per the advisory.

FortiMail webmail — FG-IR-26-184

• Source: Fortinet FortiGuard
• Link: Fortinet FortiGuard
• Severity: High — CVSS 7.7
• What's happening: SQL injection in FortiMail webmail lets an authenticated attacker execute unauthorized code or commands via crafted HTTP requests.
• Fix: Apply the FortiMail update referenced in the advisory.

Microsoft

October 2026 Patch Tuesday

• Source: Cisco Talos
• Link: Cisco Talos
• Severity: 85 vulnerabilities rated "Critical" out of 1,415 total
• What's happening: Microsoft's monthly security release covers 1,415 vulnerabilities across its product range, 85 of them critical; Talos published Snort rules and a breakdown of the prominent ones.
• Fix: Deploy the October 2026 monthly security updates; prioritize internet-facing roles called out in the roundup.

Microsoft Edge (Chromium-based) — multiple Chromium CVEs

• Source: Microsoft MSRC
• Link: Microsoft MSRC
• Severity: see source
• What's happening: Edge ingests Chromium fixes for a batch of Chrome-assigned CVEs this week, including CVE-2026-106258, CVE-2026-106263, CVE-2026-106264, CVE-2026-106268, CVE-2026-106270, CVE-2026-106271, CVE-2026-106273, CVE-2026-106274, CVE-2026-106276 and CVE-2026-106278 (use-after-free, missing/incorrect authorization, uninitialized resource, improper input validation, UI misrepresentation).
• Fix: Update Edge to the current build; Chrome release notes are referenced from the MSRC advisories.

Visual Studio Tools for Applications / SQL Server Management Studio — CVE-2026-103572

• Source: Microsoft MSRC
• Link: Microsoft MSRC
• Severity: see source (remote code execution)
• What's happening: A remote code execution vulnerability affecting Visual Studio Tools for Applications and SQL Server Management Studio; MSRC added download and KB links for the fixed Visual Studio builds.
• Fix: Install the fixed builds listed in the advisory.

Linux kernel — CVE-2026-99999 ("PwnEscape")

• Source: The Hacker News
• Link: The Hacker News
• Severity: Critical (per source)
• What's happening: A flaw in the Linux kernel's networking code lets code inside a guest VM read host memory; a researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. It affects the kernel itself, not one cloud's configuration.
• Fix: Update to a kernel release containing the fix (see source); multi-tenant and VM-hosting environments should treat this as top priority.

OpenBSD 7.9 — local privilege escalation

• Source: The Hacker News
• Link: The Hacker News
• Severity: see source
• What's happening: Researchers at Calif chained a roughly 37-year-old integer overflow with a separate kernel flaw to gain root on OpenBSD 7.9, bypassing KARL, SMAP and SMEP, and published a full proof-of-concept after fixes shipped.
• Fix: Apply the OpenBSD fixes referenced in the writeup.

---

4. Home / SOHO Impact

• Update Microsoft Edge (and any Chromium browser) right away. This week's Edge/Chromium batch includes use-after-free and authorization flaws; the update is a normal browser restart-and-install.
• If you use AOMEI Backupper on Windows, update it from AOMEI directly and run a full malware scan. Attackers tampered with the vendor's own update servers in five-to-ten-minute windows between May and July 2026, so any copy that checked for updates during those windows could have pulled a backdoor.
• Ignore fake "Claude" and "ChatGPT" pages and pop-ups. Impersonation campaigns are surging and typically use ClickFix-style tricks that tell you to paste a command into Windows Run or PowerShell — never do it.
• Small offices running FortiMail webmail or FortiSandbox should patch now — both have high/critical fixes out this week (SQL injection and an authentication bypass, respectively).
• Keep your Linux machines and any home lab VMs on current kernels — the "PwnEscape" kernel flaw lets a guest VM read host memory.
• Check your router/firewall vendor's advisory page if you run Fortinet gear at home or in a home office — FortiOS has active exploitation and several new fixes this week.

---

5. Enterprise Impact

• Treat BeyondTrust Remote Support as a compromised-appliance scenario, not just a patch ticket. CVE-2026-102764 (CVSS 9.3) was exploited as a zero-day by Armory Castle; after patching, audit administrative accounts, sessions, and configuration changes on any internet-facing Remote Support instance, and assume credential material on the box was exposed.
• FortiGate/FortiManager estates need a hunt, not just an upgrade. PEERSTITCH is memory-resident ARM64 malware delivered via CVE-2025-61624, and separately via CVE-2024-47575 against 500+ firewalls; because it lives in memory, reimage affected appliances and review VPN session handling for the tagging bypass described.
• Patch the two 9.x Fortinet bugs on any internet-reachable appliance first: FortiSandbox FG-IR-26-185 (CVSS 9.6, unauthenticated auth bypass) and FortiSIEM FG-IR-26-180 (CVSS 9.4, unauthenticated command execution). Then cover FortiAnalyzer/FortiManager (FG-IR-26-178, 7.9) and FortiMail webmail (FG-IR-26-184, 7.7).
• Run October 2026 Patch Tuesday on an accelerated schedule: 1,415 vulnerabilities, 85 rated critical. Use the Talos roundup and Snort rules to prioritize exposed services and to add detection coverage.
• Patch Linux kernel hosts that run untrusted workloads. CVE-2026-99999 lets a guest read host memory and was demonstrated against a live cloud sandbox provider — CI runners, container hosts, and VDI/VM fleets are the exposure.
• MSPs: investigate the ConnectWise Cloud Backup (formerly SkyKick) credential abuse. A compromised M365 credential tied to the service was used to sign in to 173 Microsoft 365 tenants; rotate affected credentials and review M365 sign-in logs for unfamiliar tenants, applications, and MFA patterns.
• Sweep developer and build pipelines for the MALFEX npm package imgdecode. The package hides a shellcode loader in a Windows native addon, has been downloaded 979 times, and was still live on npm at time of reporting — remove it, rotate any tokens exposed to install-time scripts, and check for the loader on Windows build agents.
• Edge devices remain the top initial-access vector. Unit 42 ranks edge exploits first among observed initial-access vectors, and Dark Reading reports Ivanti, Cisco and Palo Alto Networks edge-device vulnerabilities also came under attack this week — inventory and patch internet-facing edge appliances even where no CVE is named.
• Legacy BSD and management tooling still counts: the OpenBSD 7.9 root exploit has public PoC code, and the SQL Server Management Studio / VSTA RCE (CVE-2026-103572) needs the fixed builds from MSRC on admin workstations.

---

6. What To Patch First

1. BeyondTrust Remote Support — fixed release for CVE-2026-102764 (exploited zero-day, CVSS 9.3)
2. FortiOS / FortiPAM / FortiProxy / FortiSwitchManager — fix for CVE-2025-61624 (exploited to deliver PEERSTITCH)
3. FortiManager — fixed release for CVE-2024-47575 (exploited; 500+ firewalls targeted)
4. FortiSandbox / FortiSandbox Cloud — FG-IR-26-185 (CVSS 9.6, unauthenticated auth bypass)
5. FortiSIEM — FG-IR-26-180 (CVSS 9.4, unauthenticated command execution)
6. Microsoft October 2026 security updates — 85 critical fixes across the product line
7. Microsoft Edge / Chromium — current build covering CVE-2026-106258 and related CVEs (browser, widely deployed)
8. Linux kernel — CVE-2026-99999 "PwnEscape" (critical VM-to-host memory read)
9. FortiAnalyzer / FortiManager — FG-IR-26-178 (CVSS 7.9 SQL injection) and FortiMail — FG-IR-26-184 (CVSS 7.7)
10. OpenBSD 7.9 — patches for the chained local root exploit (public PoC available)
11. SQL Server Management Studio / Visual Studio Tools for Applications — fixed builds for CVE-2026-103572 (RCE)

---

Sources

• China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers — https://thehackernews.com/2026/10/china-linked-hackers-exploited.html
• BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs — https://www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugs
• PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions — https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html
• Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant — https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
• Arbitrary file write in grpc phQueryMaster (FG-IR-26-180) — https://fortiguard.fortinet.com/psirt/FG-IR-26-180
• Improper access control and session management in the web management interface (FG-IR-26-185) — https://fortiguard.fortinet.com/psirt/FG-IR-26-185
• Multiple Arbitrary File Read/Write via SQL Injection (FG-IR-26-178) — https://fortiguard.fortinet.com/psirt/FG-IR-26-178
• SQL command injection in webmail (FG-IR-26-184) — https://fortiguard.fortinet.com/psirt/FG-IR-26-184
• Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities — https://blog.talosintelligence.com/microsoft-patch-tuesday-for-october-2026/
• Chromium CVE-2026-106258: Uninitialized resource (and related MSRC Chromium advisories) — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106258
• CVE-2026-103572 Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103572
• Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory — https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html
• Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug — https://thehackernews.com/2026/10/researchers-demonstrate-openbsd-root.html
• Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor — https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html
• MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon — https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html
• Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants — https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html
• Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk — https://www.darkreading.com/application-security/fake-claude-chatgpt-attacks-developers-risk
• Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 — https://unit42.paloaltonetworks.com/top-5-initial-access-vectors-september-2026/