[armory-castle]

October 17, 2026

• CISA added CVE-2026-102764 (CVSS 9.3, improper origin validation in an internal messaging component) in BeyondTrust Remote Support to KEV and told organisations to apply the BT26-05-RS patch, restrict appliance exposure, and run network and memory forensics — hunting for unrecognised privileged sessions, stray script files, gaps in log forwarding and unauthorised session-policy changes (CISA). Versions ≤26.2.3 are affected, SaaS tenants are already patched, and Armory Castle (previously UNC5221 / Warp Panda) has been exploiting it as a zero-day since late August, deploying custom tooling and deleting logs (SecurityWeek). CERT-SE and NCSC-NL echoed the advisory (CERT-SE) (earlier coverage). · Active Exploitation

in Thirty-Seven Years of a Signed Short, and a Root Shell on OpenBSD

October 16, 2026

• Suspected PRC-nexus actor ARMORY CASTLE exploited BeyondTrust CVE-2026-102764 as a zero-day in late August. ARMORY CASTLE, formerly tracked as UNC5221, used the critical unauthenticated file-upload flaw against BeyondTrust Remote Support appliances; successful exploitation can lead to host-level control. Google Threat Intelligence Group ties the observed exploitation to the actor. · Vulnerabilities & Exploits

in The Ad-Tech Pipeline Delivered Zero-Click Mercenary Spyware