GoKawiilBeyondTrust patches Remote Support zero-day exploited since August by China-linked hackers
BeyondTrust has issued a patch for CVE-2026-102764, an authentication bypass flaw in its Remote Support software that attackers exploited since late August to run unauthorized file operations on unpatched appliances. SaaS customers were automatically patched on October 8, while self-hosted users must update manually. Mandiant and GTIG attribute the attacks to a suspected China-nexus group called Armory Castle (also tracked as Warp Panda by CrowdStrike), which used the bug to gain root access, deploy web shells and tunneling malware, and move laterally across victim networks.