Friday, October 16, 2026
Published 7:01 AM · 120 articles from 14 sources · about 5 min to read in full
The day in brief
Remote-access and edge software dominated again. BeyondTrust patched a critical Remote Support zero-day, CVE-2026-102764 (CVSS 9.3), which the China-nexus group Armory Castle has exploited since late August. Attackers are also backdooring Nextcloud servers through a Collabora Online RCE, CVE-2026-110447, and a FortiOS flaw is delivering memory-resident ARM64 malware. Add fixes for Drupal, NGINX and Next.js plus a new Atlassian entry in CISA's KEV catalog, and defenders face many internet-facing components needing patches at once. Bank of America's 1,000 contractors patching bugs found by Mythos show how large that volume has become. A Linux kernel networking flaw, PwnEscape (CVE-2026-99999), lets guest VMs read host memory and was confirmed on Vercel sandboxes, which matters for multi-tenant hosting. Citizen Lab traced zero-click Candiru spyware at Al Jazeera to malicious online ads, a new delivery route. A cyberattack on BAE Systems took down the federal bankruptcy courts' notice system. Elsewhere, BIPM voted to end leap seconds from May 20, Meta released the open-weight Muse Spark Open, and the FTC is reportedly probing Anthropic and OpenAI.
Top stories
- 1BeyondTrust Remote Support zero-day exploited by China-linked group since August
BeyondTrust urged customers to patch CVE-2026-102764 (CVSS 9.3), a critical Remote Support flaw that the China-nexus group Armory Castle used as a zero-day to take over servers. Exploitation began in late August, so the window before the patch was about two months. Remote support servers hold privileged access into customer networks, so treat any unpatched instance as potentially compromised. The Hacker News
- 2PwnEscape Linux kernel flaw lets guest VMs read host memory
CVE-2026-99999, nicknamed PwnEscape, is a critical kernel networking flaw that lets a VM guest read host memory. It was confirmed exploitable on Vercel sandboxes, so it is not only theoretical. Multi-tenant hosts and sandbox providers should prioritise kernel updates. The Hacker News
- 3Attackers backdoor Nextcloud servers via Collabora Online RCE
BleepingComputer reports active exploitation of CVE-2026-110447, a critical RCE in Collabora Online CODE Server for Nextcloud, to install backdoors. Self-hosted collaboration servers are often internet-exposed and lightly monitored. Patch, then check for signs of compromise. BleepingComputer
- 4Zero-click spyware delivered through online ads, Citizen Lab finds
Citizen Lab traced zero-click Candiru infections at Al Jazeera to malicious online ads that executed with no user interaction. The Verge reports that Citizen Lab and Confiant name the Israeli ad firm Discover-Tech as the delivery vendor. Ars calls it likely the first confirmed case of this method, which means ad networks are now a mercenary-spyware delivery path. The Hacker News
- 5BAE Systems cyberattack takes down federal bankruptcy court notice system
An attack on government contractor BAE Systems disrupted the notice system used by US federal bankruptcy courts. The summary gives no detail on the attack type or recovery timeline. It shows how a single contractor failure can disrupt court operations. BleepingComputer
Since yesterday
- BIPM voted to abolish the leap second, with the change set to take effect May 20 next year. This resolves the standards vote flagged in the previous brief. Timekeeping and infrastructure software will need to stop assuming leap-second insertions. The Verge ↗
- On the French supermarket refrigeration attacks: The Register reports researchers had warned in August that attackers could disrupt refrigeration systems, months before the attack. The Register ↗
By topic
- Cyber security8 items · 45 articles
Perimeter and server software supplied most of the day's exploitation and patching, across BeyondTrust, Collabora, FortiOS and Atlassian, plus a large batch of patches for web infrastructure. Supply-chain and ICS advisories round out the list.
- · Drupal fixed a critical RCE in Field UI in versions 11.4.10, 11.3.19 and 10.6.19. A no-login exploit path exi…
- · Next.js shipped an out-of-band patch for two critical unauthenticated RCE flaws, in React Server Components c…
- · A suspected advanced actor is exploiting Fortinet FortiOS flaw CVE-2025-61624 to deploy PEERSTITCH, memory-re…
- Tech industry7 items · 25 articles
Memory shortages driven by AI demand hit consumer hardware, and chip supply chains are renegotiating around US capacity. Platform terms and AI-assisted engineering produced the other notable items.
- · Bank of America's CEO says the bank hired 1,000 contractors in Q2 to patch vulnerabilities identified by Myth…
- · Smartphone shipments fell sharply as AI-driven memory shortages raised component costs. Analysts expect littl…
- · SK Hynix's Solidigm reportedly seeks US approval to ship more chip equipment to its China fab while weighing…
- AI7 items · 24 articles
Meta released a very large open-weight model tuned for Macs, while regulators and independent evaluators drew attention to AI safety and security practice. Prompt injection and agent security continued to move from research into field observation.
- · Meta released Muse Spark Open, an 816B-parameter open-weight model on Hugging Face. Built with Apple, it is o…
- · The FTC is reportedly investigating Anthropic and OpenAI over security incidents, with possible fines compara…
- · A CERT-In advisory says AI agents under testing accessed sensitive business and personal data at Indian organ…
- IT & infrastructure6 items · 15 articles
A heavy Linux and open-source release day: Ubuntu 26.10, KDE's move off X11 and Libreboot. Routing security and Windows Server lifecycle news are the operational items.
- · Ubuntu 26.10 shipped with Linux 7.3 and GNOME 51, completed the Rust coreutils migration, and expanded Entra…
- · Windows Server 2022 has reached end of mainstream support and stays in extended support until October 2031.
- · An IPinfo analysis says RPKI route origin validation now covers about 70% of internet routes.
- CS & research5 items · 3 articles
The day's research came from cs.CR and covers hardware isolation, side channels, cryptographic deployment attacks and runtime supply-chain defence.
- · PAGE404 shows how hardware-assisted page migration on NVIDIA Grace Hopper GH200 can be abused to break GPU is…
- · A reaction attack recovers a CKKS ternary secret key with asymptotically optimal query complexity, using clie…
- · A paper formalises hardware-software leakage contracts so programmers can reason about Spectre-style microarc…
Themes today
Read the analysis →- Remote-access and collaboration servers are the main attack surface
- AI-found bugs are becoming a staffing problem
- Ad networks are now a delivery channel for mercenary spyware
- Agents are exposed to hostile input in the wild
- Shared infrastructure isolation is under pressure