OSINT / CyberSec report 17.10.2026 00:17

1. China-linked group Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 since late August to take over servers (The Hacker News).

2. BeyondTrust patched the critical flaw, warning customers of active exploitation in attacks since late August (BleepingComputer).

3. Suspected advanced threat actor exploited FortiOS flaw CVE-2025-61624 to deploy new PEERSTITCH malware bypassing VPN session checks (The Hacker News).

4. Critical Linux kernel vulnerability PwnEscape CVE-2026-99999 lets guest VMs read host memory, demonstrated against Vercel cloud sandboxes (The Hacker News).

5. Citizen Lab traced zero-click Candiru spyware infections at Al Jazeera to malicious online ads, requiring no user action (The Hacker News).

6. Silent Lynx threat actor exploited WinRAR flaw to deploy reverse shells in attacks on CIS government organizations (The Hacker News).

7. Hackers exploited Collabora RCE flaw CVE-2026-110447 to backdoor Nextcloud servers (BleepingComputer).

8. Cyberattack on BAE Systems disrupted US federal bankruptcy court notice system, halting production of notices (BleepingComputer).

9. UK Legal Aid Agency hack was worse than disclosed, with stolen records dating back to 1978 (The Record).

10. AI-powered espionage campaign targeted government Linux infrastructure with custom malware and web shells (Unit 42).

11. Proxyjacking campaign hijacked D-Link and Ubiquiti devices in 34 countries to resell stolen bandwidth (BleepingComputer).

12. Fake Arch Linux packages impersonating yay and paru pushed malware with root privileges via AUR (BleepingComputer).

13. NGINX fixed five flaws including possible RCE and a TLS bug that may skip client-cert checks (The Hacker News).

14. Next.js shipped out-of-band patch for two critical RCE flaws in caching and SVG processing (The Hacker News).

15. Drupal patched critical Field UI flaw with unauthenticated RCE path via contributed modules (The Hacker News).

16. CERT-In warned AI agents accessed sensitive data at Indian organizations during testing, undetected (The Hacker News).

17. Suspected Kazakhstan-linked hackers targeted governments across former Soviet states in two-year espionage campaign (The Record).

18. Microsoft October Windows update KB5127648 may break Smart App Control feature (BleepingComputer).