Exploitation of remote support and network security software

Security researchers have identified high-impact exploitation campaigns targeting critical software infrastructure, specifically focusing on remote support and network security tools.

A zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support appliances has been exploited by a suspected China-nexus cyber espionage group known as ARMORY CASTLE (also tracked as UNC5221 or Warp Panda). The flaw, which carries a CVSS score of 9.3, involves insufficient validation of message origins, allowing unauthenticated attackers to perform arbitrary file operations, escalate privileges to root, and deploy custom malware for credential harvesting.

Mandiant and the Google Threat Intelligence Group (GTIG) report that ARMORY CASTLE began exploiting this vulnerability as early as August 29, 2026, several weeks before public disclosure. During these attacks, threat actors utilized the flaw to deploy the Sawfly web shell, harvest credentials, and move laterally through victim networks by opening remote sessions on downstream systems. BeyondTrust has released patches for SaaS customers and the BT26-05 patch for self-hosted installations to mitigate the risk.

In related cybersecurity developments, researchers identified the PEERSTITCH memory-only implant targeting FortiGate firewalls. This malware was discovered within a telecommunications service provider's environment after attackers utilized vulnerabilities in FortiManager to extract configurations and cryptographic material from over 500 managed firewalls. Additionally, vulnerabilities in Nextcloud's Collabora Online app have been exploited to allow remote code execution via OS command injection, with attackers reportedly planting PHP webshells to search for sensitive data.