Daily DefSec Brief·Oct 16, 2026·4m

BeyondTrust zero-day exploited, Atlassian flaw under attack | Cyber Security News Oct 16

Show notes

1. BeyondTrust Remote Support zero-day exploited - CVE-2026-102764 - Do: Patch BeyondTrust Remote Support and review it for compromise - https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/

2. Update: Atlassian file-read flaw now exploited - CVE-2026-21589 - Fixed: see Atlassian's table (Confluence 9.2.26 / 10.2.19, Jira 9.12.40 / 10.3.26 / 11.3.12, Bitbucket 9.4.26 / 10.2.8 / 10.5.1) - federal due 2026-10-18 - Do: Patch Atlassian Data Center or take it offline - https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html

3. Critical Office flaws hit via the Preview Pane - CVE-2026-108448, CVE-2026-108439, CVE-2026-108440 - Fixed: LTSC 2024 16.0.17932.21056, LTSC 2021 16.0.14334.20974, Mac 16.114.26101123 - Do: Make sure Tuesday's Office update actually installed - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108448

4. Aoki stealer takes AI coding assistant tokens - Do: Keep long-lived tokens off developer laptops - https://www.infosecurity-magazine.com/news/aoki-infostealer-ai-coding/

5. Drupal critical flaw; 28% on end-of-life branches - CVE-2026-108097 - Fixed: 11.4.10, 11.3.19 or 10.6.19 - Do: Update Drupal core, or uninstall Field UI - https://www.drupal.org/sa-core-2026-014

6. Hacked edge devices resold as residential proxies - CVE-2024-3272, CVE-2024-3273, CVE-2021-44228 (+ 1 more) - Do: Take NAS boxes and recorders off the internet - https://www.greynoise.io/blog/proxyjacking-edge-devices-residential-proxies

7. Next.js out-of-band fix for two critical RCEs - CVE-2026-96889 - Fixed: 16.4.1 or 15.5.28 - Do: Upgrade Next.js - https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw

8. Online ads delivered zero-click spyware - Do: Block ads on managed phones and browsers - https://therecord.media/spyware-citizen-lab-advertising

9. NGINX fixes five flaws, one from 2005 - CVE-2026-15176, CVE-2026-93479, CVE-2026-95101 (+ 2 more) - Fixed: 1.30.6 or 1.31.7 - Do: Upgrade NGINX - https://nginx.org/en/security_advisories.html

10. Test AI agents got in on leaked credentials - Do: Find and rotate credentials sitting in your code - https://thehackernews.com/2026/10/cert-in-warns-ai-agents-accessed.html

← Previous

Cisco email gateway exploited, PAN-OS zero-day, Zimbra send-as flaw | Cyber Security News Oct 15

Attackers are using a BeyondTrust Remote Support zero-day and the Atlassian Data Center file-read flaw. Also: Office Preview Pane flaws, AI coding tokens stolen, Drupal, Next.js and NGINX fixes, hijacked NAS boxes, spyware in ads, and AI agents on leaked credentials. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: Where do your developers' AI tool tokens live, and how long do they last? Reply in the comments or at [email protected] . 1. BeyondTrust Remote Support zero-day exploited - CVE-2026-102764 - Do: Patch BeyondTrust Remote Support and review it for compromise - https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/ 2. Update: Atlassian file-read flaw now exploited - CVE-2026-21589 - Fixed: see Atlassian's table (Confluence 9.2.26 / 10.2.19, Jira 9.12.40 / 10.3.26 / 11.3.12, Bitbucket 9.4.26 / 10.2.8 / 10.5.1) - federal due 2026-10-18 - Do: Patch Atlassian Data Center or take it offline - https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html 3. Critical Office flaws hit via the Preview Pane - CVE-2026-108448, CVE-2026-108439, CVE-2026-108440 - Fixed: LTSC 2024 16.0.17932.21056, LTSC 2021 16.0.14334.20974, Mac 16.114.26101123 - Do: Make sure Tuesday's Office update actually installed - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108448 4. Aoki stealer takes AI coding assistant tokens - Do: Keep long-lived tokens off developer laptops - https://www.infosecurity-magazine.com/news/aoki-infostealer-ai-coding/ 5. Drupal critical flaw; 28% on end-of-life branches - CVE-2026-108097 - Fixed: 11.4.10, 11.3.19 or 10.6.19 - Do: Update Drupal core, or uninstall Field UI - https://www.drupal.org/sa-core-2026-014 6. Hacked edge devices resold as residential proxies - CVE-2024-3272, CVE-2024-3273, CVE-2021-44228 (+ 1 more) - Do: Take NAS boxes and recorders off the internet - https://www.greynoise.io/blog/proxyjacking-edge-devices-residential-proxies 7. Next.js out-of-band fix for two critical RCEs - CVE-2026-96889 - Fixed: 16.4.1 or 15.5.28 - Do: Upgrade Next.js - https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw 8. Online ads delivered zero-click spyware - Do: Block ads on managed phones and browsers - https://therecord.media/spyware-citizen-lab-advertising 9. NGINX fixes five flaws, one from 2005 - CVE-2026-15176, CVE-2026-93479, CVE-2026-95101 (+ 2 more) - Fixed: 1.30.6 or 1.31.7 - Do: Upgrade NGINX - https://nginx.org/en/security_advisories.html 10. Test AI agents got in on leaked credentials - Do: Find and rotate credentials sitting in your code - https://thehackernews.com/2026/10/cert-in-warns-ai-agents-accessed.html