Zero-Day Exploits Hit BeyondTrust, PAN-OS as Ransomware Claims Climb

The week in one sentence

The week of October 19, 2026 showed a pattern that is now familiar. The appliances companies use to manage, filter and secure their networks were attacked through flaws nobody had patched yet. At the same time, ransomware crews kept posting victims faster than defenders could keep track, and a run of breach disclosures traced back to stolen logins rather than clever malware. Taken together, the coverage points to one conclusion: the perimeter is now the target, and credentials are the easiest way in.

BeyondTrust: a remote-support zero-day exploited for weeks

The most serious disclosure of the week was CVE-2026-102764, an authentication bypass in BeyondTrust Remote Support. It lets an unauthenticated remote attacker perform file operations on appliances running version 26.2.3 or earlier.21 BeyondTrust rates it CVSS 4.0 9.3 and traces it to improper origin validation in an internal messaging component.28

The timeline is the worrying part. Exploitation started on August 29, when one BeyondTrust-hosted instance and one self-hosted appliance were compromised. The company found the activity while threat hunting on September 28, shipped a patch on October 8 and disclosed the CVE publicly on October 15.30 That means attackers had roughly six weeks of quiet access before defenders knew there was anything to fix.

Mandiant and Google Threat Intelligence Group attribute the campaign to a suspected China-nexus espionage actor they call Armory Castle, formerly UNC5221. CrowdStrike tracks the same group as Warp Panda.21 Once inside, the attackers escalated to root by setting SUID permissions. They then deployed a Sawfly web shell and a Bareclaw tunneler, wiped logs and moved laterally using administrator credentials.21 Investigators also saw them abusing the appliance's own bt-secrets utility to try to pull stored passwords and API keys. They altered the HAProxy configuration so the tunneler could hide behind the appliance's legitimate HTTPS traffic.28

CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 16 and urged organizations to patch.9 The coverage agrees on one detail that matters most for defenders: patching closes the hole, but it does not remove an implant that is already there. Any internet-facing appliance left unpatched during the exploitation window should be treated as possibly compromised.28 Mandiant also warned that this group has a habit of switching from selective zero-day use to broad opportunistic attacks once a flaw becomes public. As of the October 15 analysis, however, mass exploitation had not been confirmed.2130 On that record, the next few weeks look like the riskiest period for self-hosted customers who have not yet applied the BT26-05 patch.

Edge devices keep falling

BeyondTrust was not alone. Palo Alto Networks patched CVE-2026-0322, a PAN-OS management-interface flaw that lets an authenticated attacker run code as root. The company said it had seen "very limited exploitation" and released IP-based indicators.29 Cisco's Secure Email Gateway flaw, CVE-2026-76519, is rated CVSS 9.8. It can be triggered by a crafted attachment when File Reputation is enabled, which means an email-security box can be compromised by the very traffic it exists to inspect.7 Ivanti Connect Secure had another authentication bypass, CVE-2026-104935, added to KEV on October 13.7 Huntress first saw exploitation of the AhsayCBS backup software chain on October 7, and Ahsay admitted its earlier patches had not fully fixed the problem.6

CISA's KEV catalog counted nine actively exploited entries between October 12 and 18. Almost all of them affect remote-access, firewall, email-gateway or backup infrastructure.8 The run continued on October 20, when the agency added six more. Four were the Plex Media Server bugs known together as "Plex2Shell." The other two were a SiteGuard Server Edition command injection and a DLL side-loading flaw in Siemens Software Center.1 Reports describe Plex2Shell as a chain that gives unauthenticated remote code execution. Attackers have been using it to install cryptocurrency miners and proxy malware.4 The timeline is a lesson in itself. Plex warned users on September 1, the researcher published proof-of-concept code on October 16, and exploitation appeared in honeypots the next day.10 Siemens linked its flaw to a ClickFix campaign called Romulus. In that campaign, attackers placed malicious DLLs next to a genuine, signed copy of the Siemens program.10

In every one of these cases, a fix already existed before attacks became widespread. The real gap is not between disclosure and patch release. It is between patch release and actual deployment.

Patch Tuesday's record and a counting dispute

Microsoft's October release was enormous by any measure, though outlets disagree on the size. BleepingComputer counted 1,411 flaws.22 CyberScoop and others reported 1,413, more than Microsoft's previous record for a full year of 1,261 CVEs, set in 2020.2423 One patch-ranking service counted 1,771 CVEs, including 174 rated Critical.27 The differences most likely come from how each tracker handles third-party and cloud-side entries. Whichever figure is right, this was an unusually heavy month for patching teams.

The priority is clearer than the totals. CVE-2026-96951, a Windows Shell command-injection flaw that bypasses Mark of the Web protections, was exploited before the patch shipped.22 It is rated CVSS 8.8 and needs the victim to interact with a crafted file. That fits phishing-led intrusions.26 Microsoft credited researchers from Fujitsu, along with one researcher who reported the flaw "using Claude with Anthropic."26 Two further flaws were publicly disclosed before fixes were available, in .NET Framework and MessagePack-CSharp.27 In the same cycle, Citrix, Fortinet and Ivanti each patched bugs that had already been exploited as zero-days.22

Ransomware: volume, newcomers and backup destruction

Leak-site tracking shows how much ransomware activity there is. HackerFeeds counted 672 victims claimed between October 1 and 19, against 891 for all of September. Three groups made up 41.5% of claims: N0n with 113, The Gentlemen with 89 and Qilin with 77.31 N0n's jump stands out, since it claimed only 18 victims in all of September. Manufacturing was the most targeted sector, and U.S. organizations made up about a third of victims.31 Three new names appeared this month: Scarlettgroup, UmBra and 0x00.31

Claims posted this week included law firms Baker Donelson and Latham & Watkins, as well as Seminole Schools.31 Mimori listed industrial software maker Aveva and enterprise software firm OpenText, claiming about 177,000 and 94,000 files respectively and setting late-October publication dates.3638 These are attacker claims, not confirmed breaches, and should be read that way.

The most significant intelligence product of the week was a joint advisory on SafePay, released October 20 by CISA, the FBI, the Secret Service and German and British partners. It says the group has compromised at least 600 organizations since August 2024 and deliberately attacks backup systems to block recovery.32 This ties into an earlier incident this month. A ransomware attack on IDC Frontier's IDCF Cloud East Japan Region 1 on October 7 knocked services offline for 495 companies and local governments.39 Both stories point the same way: if your only backups sit with the same provider or in the same environment the attacker can reach, you may not be able to recover.

Breaches: stolen keys, not broken locks

The week's breach disclosures had a common thread. Sourcenext said a third party misused a member-information API from October 9 to 13, possibly exposing up to 22.5 million records.15 Nikkei disclosed its third breach in a month. Stolen credentials for a development cloud service exposed about 1.83 million records, around 150,000 of them containing personal data.11 In California, the Department of Education began notifying families on October 16 after Educational Testing Service found that an intruder had been copying files since May. The intruder reportedly got in through a compromised credential on a file transfer site.12

The OpenCode Console breach is a newer kind of incident. Attackers took OpenAI, Anthropic and Google API keys from a legacy system that was being decommissioned. They then used the keys for a high-volume "distillation attack" that left some users with charges in the hundreds or thousands of dollars.16 Stored AI credentials are turning into a direct way to steal money, not just a configuration risk.

The takeaway

The coverage this week largely agrees, and it supports a firm reading. The most effective attacks are not new. They go after trusted infrastructure that has privileged access, and they use credentials that never should have been exposed. Patch counts and leak-site tallies give a sense of scale, but they do not set priorities. For most organizations, the urgent work is narrower: patch and investigate every internet-facing appliance on the KEV list, keep backups out of reach of attackers, and treat stored secrets as exposed until they are rotated.