China-Linked Hackers Exploit BeyondTrust Zero-Day in Remote Support Servers

The China-nexus cyber espionage group, Armory Castle, exploited a newly disclosed zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support in late August 2026. The flaw, an improper origin validation issue, allowed remote attackers to perform file operations on affected appliances. BeyondTrust released patches for SaaS customers on October 9, 2026, and advises self-hosted customers to update manually.