Defender DailyThe daily security brief for enterprise defenders
Daily Brief
BeyondTrust Privileged Remote Access and Remote Support
BeyondTrust says an attacker first used it on Aug 29 against one of its hosted instances, and self-hosted appliances need patch BT26-05-RS.
Unit 42 says attackers used it at a telecom MSP in a September 2024 intrusion, and FortiOS 7.6.5 and 7.4.10 fix it.
Source: CISA’s Known Exploited Vulnerabilities catalog, version 2026.10.16
Rapid7’s exploit needs push access to a public project and an unauthenticated request to the lint endpoint, and no exploitation has been reported.
An attacker signed in with the app’s credential on Oct 15, and by Oct 17 Huntress had counted successful sign-ins in more than 300 tenants.
The states say XTIUM lacked the logging and monitoring to detect misuse of its remote support tool account, and the breach reached 18 client networks.
Cisco Talos
Talos asks readers to check that their tools handle six-digit CVE IDs and the forensicTriage column CISA added to KEV.
GuidePoint Security
GuidePoint found no CVE or malware use in 5,692 messages showing operators posing as IT by phone and sending agents to plug in storage devices.
Read: GuidePoint Security on leaked chats of a group posing as law firms’ IT staffEdited by Austin Simas