Cyber Roundup: Week of October 12
Table of contents
1. BeyondTrust: ARMORY CASTLE exploited a Remote Support zero-day as a China-nexus espionage operation since August
The headline: On October 15, 2026, BeyondTrust disclosed CVE-2026-102764, a CVSS 9.3 authentication bypass by spoofing in Remote Support appliances. Mandiant now tracks the China-nexus actor behind the campaign as ARMORY CASTLE, formerly UNC5221, the same group with a history of exploiting Citrix and Ivanti zero-days. ARMORY CASTLE first exploited the flaw on August 29, 2026. BeyondTrust detected the compromise September 28, released patch BT26-05-RS October 8, patched SaaS tenants by October 9, and disclosed publicly October 15. CISA added the flaw to KEV on October 16 with a federal deadline of October 19.
What we’re actually watching: The flaw is an improper origin validation issue (CWE-290) in an internal Remote Support messaging component. An unauthenticated attacker can trigger file operations without credentials, which converts into root-level control of the box holding every stored support credential for the downstream environment.
ARMORY CASTLE operated inside at least two confirmed victims for roughly 30 days before BeyondTrust surfaced the activity. Mandiant flagged that the actor’s past campaigns follow a two-stage pattern: selective zero-day exploitation against high-value targets, then widespread opportunistic exploitation once disclosure lands. No public PoC has emerged yet, but Mandiant expects broader scanning across the exposed self-hosted population.
The CISO question: For every third-party remote support or privileged access product you operate, do you treat the appliance as a credential store attackers will target, and does your detection catch anomalous file writes in under 30 days?
2. Microsoft: CVE-2026-96951 is the seventh Mark of the Web bypass exploited as a zero-day since January 2022
The headline: On October 14, 2026, Microsoft published its October Patch Tuesday release covering a record 1,413 CVEs across Windows, Office, SharePoint, Exchange, Azure, and Defender. CVE-2026-96951, a Windows Shell security feature bypass evading Mark of the Web (MotW) defences, was the only confirmed exploited-as-zero-day in the batch. CISA added it to KEV on October 13 with a federal deadline of October 16.
What we’re actually watching: CVE-2026-96951 is the seventh MotW bypass exploited as a zero-day since January 2022, which is a trend worth naming rather than a one-off story. MotW is the Windows attribute that marks files downloaded from the internet as untrusted and triggers additional security prompts and SmartScreen checks when those files execute. A MotW bypass therefore converts a user-opened document, archive, or script into execution without the warning layer the operating system is supposed to interpose.
The attacker benefit is specific. Mercenary spyware operators, initial access brokers, and phishing-based actors all route payloads through user-opened files. Each MotW bypass gives those operators a renewed delivery window against patched endpoints, which is why the class has produced seven exploited zero-days in under four years. The exploitation path for CVE-2026-96951 has not been publicly described, but the pattern suggests mercenary spyware or targeted intrusion rather than ransomware delivery.
The CISO question: Does your endpoint detection program treat Mark of the Web bypasses as a recurring technique class worth dedicated hunting content, or does it rely on the next MotW zero-day being caught by generic file-execution telemetry the last six bypasses defeated?
3. Palo Alto: CVE-2026-0322 is the third exploited PAN-OS flaw of 2026
The headline: On October 14, 2026, Palo Alto Networks disclosed CVE-2026-0322, a CVSS 8.6 code injection in the PAN-OS management interface permitting an authenticated attacker with network access to execute arbitrary code with root privileges. The company confirmed “very limited exploitation.” CISA added it to KEV the same day with a federal deadline of October 17. The flaw affects PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 across PA-Series, VM-Series, and Panorama. Cloud NGFW and Prisma Access are not affected.
What we’re actually watching: This is the third exploited PAN-OS flaw added to CISA KEV this year. CVE-2026-0300 (a User-ID Authentication Portal buffer overflow) was added in May, and CVE-2026-0257 (the GlobalProtect authentication bypass that Qilin and Settra ransomware groups have continued to exploit) was first weaponized the same month. CVE-2026-0322 sits specifically on the management interface, which matters because attackers who reach the management plane obtain root access to the device that mediates every segment boundary in the organization’s network architecture.
The authentication requirement bounds but does not eliminate the attack population. An attacker who compromised a low-privilege administrator or service account with device-management permissions can convert that foothold into firewall-root through CVE-2026-0322, which provides lateral vantage to pivot into otherwise isolated segments. Restricting source addresses that can reach PAN-OS management interfaces remains the pre-patch mitigation.
The CISO question: For every PAN-OS management interface in your environment, is network access currently restricted to a trusted-management subnet or jump host, or does your current architecture expose the interface to any authenticated account that can reach the device over the network?
4. Cisco: Secure Email Gateway absorbs its second exploited zero-day in 30 days with CVE-2026-76519
The headline: On October 14, 2026, Cisco disclosed CVE-2026-76519, a CVSS 9.8 relative path traversal in the Advanced Malware Protection (AMP) File Reputation feature of Secure Email Gateway. It permits an unauthenticated remote attacker to write arbitrary files and execute commands with root privileges. The flaw is exploitable when File Reputation is enabled and assigned to a mail policy, and Cisco PSIRT confirmed active exploitation in October. CISA added it to KEV the same day with a federal deadline of October 17.
What we’re actually watching: The attack path is a crafted email attachment. An attacker sends a malicious attachment through an exposed SEG, the AMP File Reputation processor handles it during inbound filtering, and the path traversal lands an arbitrary file at an attacker-chosen location. Webserver execution then converts the file into root-level code execution on the exact appliance supposed to inspect the email.
This is the second exploited SEG zero-day in 30 days. CVE-2026-76461 (a SQL injection flaw in SEG’s email parsing) was KEV-listed in September. Two unauthenticated remote-root flaws in the same product family within a month signals either coordinated attacker research against Cisco’s email security line or a code-quality issue surfacing adjacent vulnerabilities. Either reading argues for shortened patching windows.
The CISO question: If your Secure Email Gateway was compromised three weeks ago, what credentials, attachments, and sensitive communications would an attacker now hold, and does your detection surface the compromise at the gateway rather than at the mailbox?
5. Fortinet: Unit 42 discloses a 25-month FortiGate campaign, PEERSTITCH memory implant, and CL-STA-0954
The headline: On October 14, 2026, Palo Alto Networks’ Unit 42 published research disclosing CL-STA-0954, a 25-month intrusion into a telecommunications managed service provider. The campaign began in September 2024 with exploitation of FortiManager vulnerability CVE-2024-47575 (FortiJump), then weaponized CVE-2025-61624, a FortiOS auto-script path traversal, to deploy PEERSTITCH, a memory-resident ARM64 implant. The attackers exfiltrated configurations, credentials, and keys for more than 500 FortiGate firewalls managed by the MSP. CISA added CVE-2025-61624 to KEV on October 16 with a federal deadline of October 19. Fortinet patched it in April 2026.
What we’re actually watching: PEERSTITCH is the editorial point. The implant lives entirely in memory, injects into the miglogd and iked daemons via ptrace, and communicates by writing session tags directly into process memory. It leaves no files on disk, no listening ports, and no outbound connections. A reboot removes it and leaves no persistent artifact for forensic analysis.
The campaign architecture matters more than the single flaw. CL-STA-0954 breached FortiManager first, exfiltrated the management archive for 500+ downstream FortiGate devices, recovered administrative and SSL/VPN credentials, logged into customer networks over VPN, then used CVE-2025-61624 to escalate to root and deploy PEERSTITCH. The reach of a compromised MSP equals the reach of every customer it manages. Memory-only tradecraft is appearing more frequently across appliance categories.
The CISO question: For every security appliance you operate, does your incident response playbook include memory analysis as a routine step, or does the absence of a file-system artifact currently read as evidence that no intrusion occurred?
Three main trends from the above
What is a non-negotiable take away from the above new stories this week?
- The attack path moved through management and control-plane products: beyondTrust Remote Support, Windows Shell, PAN-OS, Cisco SEG, and FortiManager and FortiOS all sit in the same category of infrastructure deployed to manage, protect, or inspect something else.
- Vendor-aware-to-public-disclosure windows kept producing multi-week dwell times: ARMORY CASTLE operated inside BeyondTrust customers for roughly seven weeks. CL-STA-0954 ran the FortiGate campaign for 25 months before disclosure. Attackers had operational time defenders did not know existed.
- Memory-only and anti-forensic tradecraft appeared in two separate campaigns: PEERSTITCH is a memory-resident ARM64 implant with no persistent disk artifact. ARMORY CASTLE’s BeyondTrust intrusion deleted logs and used reboot-persistent sudoers changes rather than disk-written malware. Expect more.
Follow our blog for deep-dives on this week’s stories or reach out for more external threat intelligence support.
About the author
