Here are today’s top cybersecurity stories for Friday, October 16, 2026.
China-Linked Armory Castle Exploited BeyondTrust Remote Support Zero-Day Since Late August
BeyondTrust patched CVE-2026-102764, a CVSS 9.3 origin-validation flaw in an internal messaging component of Remote Support. Google Threat Intelligence Group and Mandiant tie exploitation to Armory Castle, also tracked as UNC5221. SaaS customers received the fix on October 9, while self-hosted versions 24.3.1 through 26.2.3 need the BT26-05-RS patch. The Hacker News
BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts
An incident at contractor BAE Systems took the Bankruptcy Noticing Center offline. The center has produced no notices for federal bankruptcy courts for about a week, and the National Creditor Registration Service is also down. Neither BAE nor the judiciary has named a cause or confirmed any data loss. SecurityWeek
Attackers Tampered With AOMEI Backupper Update Servers for Minutes at a Time to Deliver a Backdoor
Google Threat Intelligence Group, Mandiant, and ManageEngine report three short windows from late spring to July 2026 in which AOMEI’s update files carried a backdoor. The software does not cryptographically verify its update files. Victims span IT services, telecommunications, and higher education in 11 countries. The Hacker News
PEERSTITCH Malware Hides in FortiOS Daemons After Telecom Provider Intrusion
Palo Alto Networks Unit 42 found the memory-resident ARM64 implant while investigating an intrusion at a telecommunications managed service provider. Attackers exploited CVE-2025-61624, a CVSS 5.4 FortiOS flaw patched in April 2026. The actor also took configuration data on more than 500 managed FortiGate firewalls. The Hacker News
F5 and Juniper Networks Patch Critical Vulnerabilities
F5 fixed 11 NGINX defects, including three critical memory bugs with a path to remote code execution when ASLR is off or bypassed. Juniper published 17 advisories covering more than 150 flaws in Junos OS and Junos OS Evolved, about two dozen of them critical. Neither vendor reports exploitation. SecurityWeek
Microsoft Patches Two Dozen Remote Code Execution Flaws in Office
Microsoft released fixes for more than 30 new vulnerabilities, including two dozen high-severity remote code execution bugs. Word received most of the patches, and about half a dozen are triggered through the Preview Pane. Microsoft reports no exploitation in the wild. SecurityWeek
PwnEscape Linux Kernel Flaw Lets Guest VMs Read Host Memory
CVE-2026-99999 carries a CVSS score of 9.3 in the published record. Researcher Paulos Yibelo of pwn.ai showed memory reads against Vercel’s production sandboxes, while host crashes and code execution stayed in lab tests. Fixes ship in stable kernels such as 6.12.113 and 6.18.57, and no exploitation is reported. The Hacker News
Fake yay and paru Packages Push Root-Level Malware on the Arch User Repository
A user named marchos1as uploaded typosquatted packages with an install script which ran a remote shell script as root. A community member flagged the packages on October 13, and the AUR team banned the account. Anyone who installed them is advised to treat the system as compromised. BleepingComputer
Hackers Hijack D-Link and Ubiquiti Devices to Resell Stolen Bandwidth
A proxyjacking campaign compromised devices in 34 countries. The operators monetized victims’ internet connections through a commercial residential proxy network. BleepingComputer
UAT-11985 Uses Fake Event Invites to Phish Taiwan Research Affiliates With a Google AitM Kit
Cisco Talos tracks the actor, which impersonates Taiwanese and academic institutions and likely uses AI to produce lures. A spoofed Google login relays credentials and MFA codes to the real service in real time. Some campaigns altered event posters with malicious QR codes. The Hacker News
Stay tuned for today’s in-depth analysis posts.
