BeyondTrust zero-day exploited, Atlassian flaw under attack | Cyber Security News Oct 16
Daily DefSec BriefShow Notes
Attackers are using a BeyondTrust Remote Support zero-day and the Atlassian Data Center file-read flaw. Also: Office Preview Pane flaws, AI coding tokens stolen, Drupal, Next.js and NGINX fixes, hijacked NAS boxes, spyware in ads, and AI agents on leaked credentials. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: Where do your developers' AI tool tokens live, and how long do they last? Reply in the comments or at [email protected].
1. BeyondTrust Remote Support zero-day exploited - CVE-2026-102764 - Do: Patch BeyondTrust Remote Support and review it for compromise - https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/ 2. Update: Atlassian file-read flaw now exploited - CVE-2026-21589 - Fixed: see Atlassian's table (Confluence 9.2.26 / 10.2.19, Jira 9.12.40 / 10.3.26 / 11.3.12, Bitbucket 9.4.26 / 10.2.8 / 10.5.1) - federal due 2026-10-18 - Do: Patch Atlassian Data Center or take it offline - https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html 3. Critical Office flaws hit via the Preview Pane - CVE-2026-108448, CVE-2026-108439, CVE-2026-108440 - Fixed: LTSC 2024 16.0.17932.21056, LTSC 2021 16.0.14334.20974, Mac 16.114.26101123 - Do: Make sure Tuesday's Office update actually installed - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108448 4. Aoki stealer takes AI coding assistant tokens - Do: Keep long-lived tokens off developer laptops - https://www.infosecurity-magazine.com/news/aoki-infostealer-ai-coding/ 5. Drupal critical flaw; 28% on end-of-life branches - CVE-2026-108097 - Fixed: 11.4.10, 11.3.19 or 10.6.19 - Do: Update Drupal core, or uninstall Field UI - https://www.drupal.org/sa-core-2026-014 6. Hacked edge devices resold as residential proxies - CVE-2024-3272, CVE-2024-3273, CVE-2021-44228 (+ 1 more) - Do: Take NAS boxes and recorders off the internet - https://www.greynoise.io/blog/proxyjacking-edge-devices-residential-proxies 7. Next.js out-of-band fix for two critical RCEs - CVE-2026-96889 - Fixed: 16.4.1 or 15.5.28 - Do: Upgrade Next.js - https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw 8. Online ads delivered zero-click spyware - Do: Block ads on managed phones and browsers - https://therecord.media/spyware-citizen-lab-advertising 9. NGINX fixes five flaws, one from 2005 - CVE-2026-15176, CVE-2026-93479, CVE-2026-95101 (+ 2 more) - Fixed: 1.30.6 or 1.31.7 - Do: Upgrade NGINX - https://nginx.org/en/security_advisories.html 10. Test AI agents got in on leaked credentials - Do: Find and rotate credentials sitting in your code - https://thehackernews.com/2026/10/cert-in-warns-ai-agents-accessed.html
More from Daily DefSec Brief
Attackers are now exploiting PHP2Shell, a poisoned LiteLLM release carried a stealer for AI and cloud keys, and Fortinet shipped critical fixes while holding the CVEs until November 10. Every version number and every fix in this episode was checked against the vendor's own advisory or the researchers' report before it aired. Today's question: How do you check that your security alerts still reach a person? Reply in the comments or at [email protected].
PHP ships fixes today for two critical flaws whose details leaked ahead of disclosure, and a certificate authority's signing keys turned out to be guessable, one of them the number four. Also: a joint advisory on SafePay ransomware, a hijacked account that swapped OVHcloud's CLI downloads for a stealer, and a test account with the password Password1. Fixes were checked against the vendor's advisory or release notes where one exists, and against the researchers' report where not. Today's question: How does your team find accounts that should have been deleted? Reply in the comments or at [email protected].
The NetScaler flaw that crashed appliances is a step in a root takeover whose implant tries to copy itself to the HA partner. ClickFix crews bring a signed Siemens program to run their malware, Plex servers are being hijacked a day after an exploit went public, and a fake WatchGuard download site collects VPN logins. Every version number and every fix in this episode was checked against the vendor's advisory, release notes or the CVE record before it aired. Today's question: Where does your team tell people to get the VPN client? Reply in the comments or at [email protected].
Attackers used ConnectWise's app credentials to enter Microsoft 365 tenants. Also: a FortiGate implant, stolen UpdraftCentral keys, NTLMv1 blocks, AOMEI's update servers, and fixes. Every version number and every fix in this episode was checked against the vendor's advisory or the CVE record before it aired. Today's question: How do you review vendor apps in your tenant? Reply in the comments or at [email protected].
Attackers are getting root on Cisco Secure Email Gateways with a crafted attachment, and the fix is a month old. Also: a PAN-OS zero-day, Ahsay's failed patch, Nextcloud, Zimbra, curl, Claude Code Desktop, and which package managers check their downloads. Every version number and every fix in this episode was checked against the vendor, the CVE record or the researcher who found it before it aired. Today's question: Have you ever turned on a package manager's integrity checks on purpose, and what made you do it? Reply in the comments or at [email protected].