VulnHub

A cyber espionage group linked to China, known as Armory Castle, exploited a recently discovered zero-day vulnerability in BeyondTrust Remote Support software. This flaw, identified as CVE-2026-102764, allows unauthorized access to internal messaging components, which could enable attackers to take control of remote support servers. The vulnerability carries a high severity score of 9.3, indicating its potential impact on organizations using this software. Companies that rely on BeyondTrust for remote support need to be vigilant, as this exploit was actively used in the wild shortly after its discovery. Organizations should prioritize patching their systems to mitigate the risk of unauthorized access.

BeyondTrust has alerted its customers about a serious vulnerability in its Remote Support software that has been actively exploited by attackers since late August. The flaw allows unauthorized access, making it a prime target for cybercriminals looking to compromise systems. Users of BeyondTrust's Remote Support should prioritize applying the latest patches to protect against potential breaches. This situation emphasizes the importance of keeping software updated, especially when vulnerabilities are being actively exploited in the wild. Companies relying on this software should ensure their systems are secured as soon as possible to mitigate risks.

A sophisticated threat actor is exploiting a vulnerability in Fortinet's FortiOS, which affects several of its products including FortiPAM, FortiProxy, and FortiSwitchManager. The flaw, identified as CVE-2025-61624, allows attackers to bypass security checks on tagged VPN sessions. This exploitation leads to the deployment of a new type of malware called PEERSTITCH, which operates in memory on ARM64 architecture. The CVSS score for this vulnerability is 5.4, indicating a moderate level of risk. Companies using these Fortinet products should be vigilant and assess their systems for potential attacks, as the exploitation is currently active in the wild.

Between January and June 2026, there were over 9.1 million DDoS attacks reported globally, marking a nearly 25% increase from the previous year, according to Netscout’s DDoS Threat Intelligence Report. Notably, attacks exceeding 1 Tbps saw an astonishing rise of 1,286%, largely driven by botnets associated with groups like Aisuru and Kimwolf. This trend indicates that attackers are becoming more efficient, requiring fewer devices to execute large-scale attacks. The implications of these findings are significant, as businesses and service providers may struggle to defend against such overwhelming traffic before their systems reach capacity. Companies need to reassess their cybersecurity measures to counter this growing threat effectively.

Citizen Lab has reported that targeted ads were used to deliver Candiru spyware to devices belonging to Al Jazeera without requiring any interaction from users. This form of attack raises significant concerns about the effectiveness of traditional security measures, as the spyware can infiltrate systems without the need for users to click on malicious links. The implications are serious, especially for media organizations like Al Jazeera, which could be targeted due to their reporting on sensitive issues. This incident highlights the increasing sophistication of cyberattacks and the need for heightened security awareness among individuals and organizations. Keeping devices secure from such threats is now more critical than ever.

Hackers are taking advantage of a serious command execution vulnerability, identified as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app, which is used within Nextcloud. This flaw allows attackers to run arbitrary commands on affected systems, potentially leading to unauthorized access and backdoors in Nextcloud servers. Organizations using this application are at risk, as the exploitation of this vulnerability is already occurring in the wild. Users need to take immediate action to secure their systems and ensure they are not compromised. The issue highlights the ongoing challenges in securing collaborative tools that are increasingly used for remote work and data sharing.

A serious vulnerability in the Linux kernel, identified as CVE-2026-99999 and dubbed PwnEscape, has been revealed, allowing virtual machines (VMs) to access the memory of the host system. This flaw is located within the networking code of the Linux kernel, meaning it affects multiple cloud environments, not just one particular setup. A researcher demonstrated this vulnerability on Vercel's cloud sandboxes, and the company confirmed the issue. This breach poses significant risks, as it could enable attackers to extract sensitive data from the host machine, potentially compromising the integrity and confidentiality of the systems involved. Companies using Linux-based virtual machines should be vigilant and take appropriate measures to safeguard their environments.

A recent campaign has targeted D-Link and Ubiquiti devices across 34 countries, allowing hackers to hijack these devices to create a commercial residential proxy network. This practice, known as proxyjacking, enables attackers to monetize stolen bandwidth from unsuspecting users. The impact is significant as it not only affects individual users' internet speeds and data privacy but also raises concerns about the security of these widely used devices. Users whose devices have been compromised may find their internet connections slower and could potentially face additional security risks if their devices are manipulated for illicit purposes. The situation underscores the need for users to secure their devices and remain vigilant against unauthorized access.

Recently, malicious packages mimicking two widely-used Arch Linux tools, yay and paru, were discovered in the Arch User Repository (AUR). These fake packages were designed to install malware with root privileges, posing a significant risk to users who unknowingly downloaded them. The attackers exploited the trust users place in popular software by creating these deceptive packages. This incident emphasizes the importance of verifying package sources before installation, as users can be easily misled by seemingly legitimate software. Those affected are primarily Arch Linux users who rely on AUR for software installation, and they need to remain vigilant against similar threats in the future.

Researchers from Citizen Lab reported that the Israeli spyware company Candiru has successfully infected devices at Al Jazeera using zero-click attacks via online advertisements. This means that users did not need to interact with the ads for the malware to activate; it could run automatically when an ad loaded, even if it was hidden from view. This incident raises serious concerns about the security of digital advertising and how it can be exploited to target specific organizations. Al Jazeera, a prominent news network, is particularly significant as it plays a crucial role in global media coverage. The ability for spyware to infiltrate devices without any user action emphasizes the need for stronger security measures in ad systems and for organizations to be vigilant against such sophisticated attacks.

The threat actor known as Silent Lynx has been linked to a series of attacks targeting government agencies in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks utilize various methods to deploy malware, including macro-enabled documents, PS2EXE downloaders, PowerShell scripts hosted on GitHub, and specifically crafted WinRAR archives. The use of these techniques allows attackers to establish reverse shells on compromised systems, giving them remote access. This situation is particularly concerning for government organizations, as it compromises sensitive information and operational security. The ongoing threat demonstrates the need for heightened vigilance and security measures in these sectors.