Today's outlook

CISA adds actively-exploited BeyondTrust Remote Support auth bypass to its KEV catalog

By The IT Security Desk

Good morning. CISA said on 16 October that it is aware of a critical authentication bypass vulnerability in BeyondTrust Remote Support (formerly Bomgar), versions 26.2.3 and earlier, and added it to the Known Exploited Vulnerabilities catalog the same day. CISA states that threat actors are actively exploiting it to gain initial access, then establishing persistence, escalating privileges and moving laterally. CISA urges organisations with affected self-hosted Remote Support appliances to apply the BT26-05-RS patch as outlined in BeyondTrust's Security Advisory BT26-05. CISA says patches are available for supported versions 24.3.1 and later; organisations on older versions must upgrade first. Treat any self-hosted appliance as a priority for patching and for compromise assessment given the active exploitation CISA describes.

Three further flaws carry active-exploitation status on CISA's KEV catalog. CISA lists CVE-2026-0322 in Palo Alto Networks PAN-OS (versions before the fix in 10.2.0) as known exploited; its CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base score 7.2. CISA lists CVE-2026-96951 in Microsoft Windows Server, with Microsoft's advisory naming the fix in build 10.0.14393.9612; vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 8.8. CISA lists CVE-2026-104935 in Ivanti Connect Secure 22.8; vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, base score 8.6. Apply each vendor's fixed release per its advisory.

Google's Chrome advisory lists the fix in 155.0.8059.79 for three flaws — CVE-2026-110165, CVE-2026-110161 and CVE-2026-110159 — each carrying vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base score 9.6. Update Chrome and confirm the version. Separately, SecurityWeek reported a $250,000 Chrome exploit among its roundup.

BleepingComputer reported a maximum-severity "BlockStrap" flaw in Magento and Adobe Commerce that researchers warn allows attackers to run arbitrary PHP code on store servers.

In the day's other reporting: The Hacker News reported that attackers tampered with AOMEI Backupper's own update servers in five-to-ten-minute windows between May and July 2026 to deliver a backdoor. BleepingComputer reported Candiru spyware delivered to Al Jazeera Media Network devices through targeted ads in a zero-click attack. Help Net Security reported Fortra researcher Cadence Riddle tracking a twelvefold rise in "RFQ"-themed malicious emails aimed at sales and procurement staff. The Hacker News reported the UAT-11985 campaign using fake event invites and Google adversary-in-the-middle phishing against Taiwan research affiliates. The Register reported an attack on a BAE-managed system disrupting US bankruptcy courts, and The Record reported Anne Arundel County, Maryland, confirming an August data breach and Moscow detaining three suspected DataSuckers members.