GoKawiil
Tech News
BeyondTrust disclosed that the China-linked group Mandiant tracks as Armory Castle exploited a critical zero-day vulnerability, CVE-2026-102764, in its Remote Support appliances starting August 29, 2026. The flaw, rated 9.3 CVSS, stemmed from an internal messaging component failing to validate message origin, letting attackers deploy a custom PHP webshell called SAWFLY within 11 minutes of exploitation.
BeyondTrust has issued a patch for CVE-2026-102764, an authentication bypass flaw in its Remote Support software that attackers exploited since late August to run unauthorized file operations on unpatched appliances. SaaS customers were automatically patched on October 8, while self-hosted users must update manually. Mandiant and GTIG attribute the attacks to a suspected China-nexus group called Armory Castle (also tracked as Warp Panda by CrowdStrike), which used the bug to gain root access, deploy web shells and tunneling malware, and move laterally across victim networks.