ARMORY CASTLE
Threat actorSecurity timeline
- Vulnerability reported by CISA AlertsFresh probes target critical BeyondTrust Remote Support flaw CVE-2026-102764
- Vulnerability reported by Zero Day Initiative BlogGitLab CVSS 10.0 flaw targeted on Alpine Linux server; Ivanti, LiteLLM and UAT-6275 also reported
Recent news
Fresh probes target critical BeyondTrust Remote Support flaw CVE-2026-102764
Previdian reported two probes against decoy BeyondTrust Remote Support appliances in the US and Europe, both from one Hong Kong IP address, targeting POST /api/startsession. The traffic resembled a Metasploit module under review, though not an exact match, and no successful exploitation was observed. The flaw is CVE-2026-102764 (CVSS 9.3), which affects Remote Support 26.2.3 and earlier, and CISA has added it to the Known Exploited Vulnerabilities catalogue.
GitLab CVSS 10.0 flaw targeted on Alpine Linux server; Ivanti, LiteLLM and UAT-6275 also reported
Alpine Linux said on 28 October that an attacker tried to exploit GitLab flaw CVE-2026-97229 (CVSS 10.0) on its GitLab server a week after the fix was released, with no evidence of success. Roundups also cover actively exploited Ivanti Connect Secure and Windows Shell bugs, LiteLLM gateway flaws fixed in version 1.83.9, and Talos and Recorded Future research on UAT-6275, a Kazakhstan-nexus group targeting CIS governments.