Threat Digest — October 16, 2026: Active Exploits

Top Stories#

BeyondTrust patches a zero-day exploited since August

BeyondTrust warned customers about a critical flaw in Remote Support that has been exploited in attacks since late August. Internet-facing Remote Support deployments warrant immediate incident review, not just routine patching.

Apply the vendor-provided fix, identify systems exposed to the internet, and review historical administrative and privileged-session activity. If compromise is suspected, revoke active sessions, rotate credentials accessible through the platform, and preserve logs before remediation.

Source: BleepingComputer

Collabora CODE Server attacks target Nextcloud environments

Threat actors are exploiting CVE-2026-110447 in the Collabora Online Built-in CODE Server app for Nextcloud to execute commands and backdoor servers. Nextcloud administrators should update affected deployments, restrict service exposure, and investigate for persistence.

Start with systems that expose Nextcloud or Collabora services directly to the internet. Review administrator accounts, web roots, scheduled tasks, container changes, and unexpected outbound connections. Treat successful command execution as a potential credential-compromise event.

Source: BleepingComputer

BAE Systems cyberattack disrupts federal court operations

A cyberattack affecting contractor BAE Systems disrupted the notice system used by US federal bankruptcy courts. The incident shows how a compromise at a third-party provider can affect public-facing services even when the downstream organization’s own infrastructure is not the initial target.

Organizations should identify critical vendor dependencies, document alternate communication channels, and test continuity plans for notification, court, payment, identity, and other essential services. For related regulatory considerations, review this cybersecurity disclosure rule FAQ.

Source: BleepingComputer

Windows 11 update may affect Smart App Control

Microsoft warned that some users may have trouble enabling Smart App Control after installing the October Windows 11 security update KB5127648.

Administrators should test the update in representative environments and document the Smart App Control impact before broad deployment. Do not delay security updates without a defined compensating control and an approved exception process.

Source: BleepingComputer

Proxyjacking campaign hijacks network devices

A proxyjacking campaign has affected D-Link and Ubiquiti devices in 34 countries. The operators monetize victims’ internet connections through a commercial residential proxy network, potentially creating bandwidth costs, abuse complaints, and reputational risk.

Audit edge devices for unauthorized configuration changes, unknown processes, unexpected outbound connections, and unexplained bandwidth usage. Disable unnecessary WAN administration and isolate devices that cannot be brought to a trusted firmware state.

Source: BleepingComputer

Malicious Arch packages target privileged systems

A threat actor uploaded malicious Arch User Repository packages impersonating the yay and paru helper tools. Package helpers are commonly used to install software and may run with elevated privileges, so successful execution can provide attackers with root-level control.

Review systems that use the Arch User Repository, remove untrusted packages, and require package-source verification. Privileged servers should not rely on unreviewed helper tools or install scripts.

Source: BleepingComputer

Google adds Android protections against scams and call-forwarding abuse

Google announced new AI-powered Android defenses intended to identify messaging scams, fake calls, and call-forwarding abuse. Organizations should pair those device protections with user education and account monitoring.

Brief users about urgent-payment requests, impersonation, fake support calls, and unexpected call-forwarding changes. For managed devices, enable available security controls and alert on changes to calling, account, and device-management settings.

Source: BleepingComputer

Proofpoint owner agrees to acquire Varonis

Thoma Bravo’s Proofpoint agreed to acquire Varonis Systems in a reported $6.3 billion all-cash transaction. Security teams should monitor future product, licensing, integration, and support announcements that may affect roadmap and procurement decisions.

Source: Reuters via Google News

Analyst’s Take: Start with internet-facing systems where the draft identifies exploitation or public exploit code, then preserve evidence before making changes. A successful patch does not settle the question of prior access, especially for BeyondTrust, Collabora, and the affected edge devices.

Critical Vulnerabilities#

CVE-2026-110957: Wavlink WL-WN530BE2-A command injection

• Severity: CVSS 10.0
• Issue: Remote operating-system command injection in the api.cgi login-processing function through the REMOTE_ADDR argument.
• Exploitation: Public exploit disclosed.
• Fix: Upgrade to firmware 2026-09-24-841a51c6d5_tclinux.bin.

Remove affected devices from untrusted network exposure, disable WAN administration where possible, and verify firmware integrity after upgrading.

References: Wavlink firmware, public technical reference, NVD

CVE-2026-110958: Wavlink WN530HG4B buffer overflow

• Severity: CVSS 10.0
• Issue: Remote heap-based buffer overflow in api.cgi.
• Exploitation: Public exploit disclosed.
• Fix: Upgrade to firmware 2026-09-24-841a51c6d5_tclinux.bin.

Inventory the specific hardware model, check whether management services are reachable from the internet, and isolate devices that cannot be patched promptly.

References: Wavlink firmware page, Tenable, NVD

CVE-2026-57155: OPNsense path traversal and firewall compromise

• Severity: CVSS 9.9
• Issue: An authenticated user with Firewall Alias Edit privileges can exploit path traversal in the GeoIP alias importer to write attacker-controlled files as root.
• Impact: The file-write capability can be chained with the default root cron job for complete firewall compromise.
• Fix: Upgrade to OPNsense 26.1.11.

Review users with alias-edit privileges, inspect firewall configuration and scheduled tasks, and investigate unexpected files or configuration changes.

References: OPNsense security advisory, upstream fix, NVD

CVE-2026-110812: Amazon Neptune Gremlin import deserialization

• Severity: CVSS 9.9
• Issue: Deserialization of untrusted data in the Gremlin graph-data import component.
• Required access: An authenticated remote actor with standard database permissions.
• Impact: Arbitrary code execution and access to internal service credentials.
• Fix: Update to Neptune engine 1.5.0.0, or use backported versions 1.4.8.1 and 1.4.7.1.

Review database permissions and import activity in addition to updating the engine. Rotate credentials if unauthorized imports or code execution are suspected.

References: AWS security bulletin, Neptune engine releases, NVD

CVE-2026-109694: Fluent CRM privilege escalation

• Severity: CVSS 9.8
• Affected versions: Fluent CRM through 3.2.5.
• Issue: Incorrect privilege assignment can enable privilege escalation.
• Fix status: The available vulnerability record does not identify a fixed version.

Review WordPress users, administrator activity, plugin installation history, and changes to content or configuration. Until a verified fix is available, consider disabling or removing the plugin based on business impact and validate the decision with the plugin maintainer’s security guidance.

References: Patchstack, WP ManageNinja security contact, NVD

What Defenders Should Do Today#

1. Patch actively exploited and publicly exploitable systems first

Use this order for emergency triage:

1. BeyondTrust Remote Support exposed to the internet.
2. Nextcloud deployments using the Collabora Online Built-in CODE Server app.
3. Wavlink devices affected by the two CVSS 10.0 vulnerabilities.
4. OPNsense firewalls running versions older than 26.1.11.
5. Amazon Neptune clusters requiring the affected engine updates.
6. Fluent CRM installations through version 3.2.5.
7. Other edge devices and services with unknown patch status.

Record asset owner, exposure, version, patch status, and compensating controls for every affected system.

2. Hunt for signs of compromise

Search for:

• Unexpected administrator or privileged accounts.
• New web shells or modified application files.
• Altered cron jobs, scheduled tasks, or startup scripts.
• Unexpected OPNsense firewall aliases or configuration changes.
• Unrecognized Neptune imports or unusual database activity.
• New processes associated with proxying or unexplained bandwidth usage.
• Outbound connections from routers, firewalls, Nextcloud servers, or database hosts.
• Unusual privileged package installations on Arch systems.
• Suspicious BeyondTrust sessions or access outside normal support windows.

Preserve relevant logs before rotating or rebuilding systems. If attackers achieved code execution, assume application, service, and locally accessible credentials may have been exposed.

3. Restrict management interfaces

For remote-support systems, firewalls, routers, and collaboration platforms:

• Remove direct internet exposure where operationally possible.
• Permit administration only from trusted networks or a secure access path.
• Disable unused WAN administration.
• Apply network segmentation between management interfaces and user networks.
• Require multifactor authentication where supported.
• Monitor configuration changes and privileged sessions.

Review security hardening guidance when documenting baseline controls for internet-facing applications and management interfaces. For staff who must administer systems from untrusted networks, an approved VPN service such as NordVPN may provide an additional encrypted access layer, but it does not replace segmentation or multifactor authentication.

4. Review third-party continuity plans

Following the BAE Systems incident, confirm that critical vendors have:

• Documented incident-notification procedures.
• Alternate contact methods.
• Service restoration and recovery objectives.
• Offline or independent communication channels.
• Defined escalation paths for legal, regulatory, and executive teams.

Test those procedures rather than relying on vendor assurances or an unverified contact list.

5. Secure software installation paths

For Arch Linux and other systems that install third-party packages:

• Verify package names, maintainers, repositories, signatures, and checksums.
• Avoid copying installation commands from untrusted sources.
• Review build scripts before running them with elevated privileges.
• Restrict root access and use separate administrative accounts.
• Record package provenance for production systems.
• Remove packages that cannot be traced to an approved source.

6. Test Windows updates without weakening security

Deploy KB5127648 through a controlled pilot ring. Validate:

• Smart App Control status and configuration.
• Application compatibility.
• Endpoint-management reporting.
• Security-control health.
• Recovery and rollback procedures.

If Smart App Control cannot be enabled after the update, document the condition and use approved compensating controls while awaiting further guidance.

7. Educate Android users

Explain that attackers may use fake calls, messaging scams, impersonation, and call-forwarding changes to bypass normal trust. Ask users to report:

• Unexpected verification or payment requests.
• Calls claiming to be from support or financial institutions.
• Messages asking them to install applications or disclose codes.
• Unrecognized call-forwarding changes.
• Alerts about account or device settings they did not change.

Technical Notes#

Asset inventory and exposure checks

Use approved vulnerability-management and configuration tools first. The following examples illustrate local checks and should be adapted to the operating system and change-control process:

# Identify listening services on a Linux host
sudo ss -lntup

# Review installed packages and recently changed package metadata
pacman -Q
grep -R "Installed" /var/log/pacman.log | tail -n 50

# Review scheduled tasks and cron locations
sudo systemctl list-timers --all
sudo find /etc/cron* /var/spool/cron -type f -ls 2>/dev/null

Do not run exploit code against production systems. Validate exposure through authenticated inventory, vendor-supported version checks, and controlled testing.

Log review for web and collaboration servers

Look for unexpected commands, new administrative sessions, file writes, and outbound connections around the first suspicious event. Adjust example searches to the actual log format:

# Search common web and application logs for command-execution indicators
sudo grep -R -Ei \\
  '(/bin/sh|/bin/bash|cmd=|command=|wget |curl |python|perl|nc |base64)' \\
  /var/log 2>/dev/null | tail -n 200

# Review recently modified files in an application directory
sudo find /var/www /opt -type f -mtime -14 -printf '%TY-%Tm-%Td %TH:%TM %p\\n' \\
  2>/dev/null | sort -r | head -n 200

# Review recent outbound network connections
sudo ss -tpn

These searches are triage aids, not proof of exploitation. Correlate results with reverse-proxy logs, identity-provider events, endpoint telemetry, firewall logs, and deployment records.

Firewall and network-device review

For OPNsense, routers, and other edge devices, compare the current state with a known-good configuration. Review:

• Administrative users and privilege assignments.
• Firewall aliases and GeoIP-related configuration.
• Scheduled tasks and persistent startup behavior.
• DNS settings and resolver changes.
• Port-forwarding and WAN-management rules.
• Firmware version and update history.
• Unexpected bandwidth or connection-volume changes.

If a device cannot be confidently validated after a suspected compromise, isolate it, preserve available configuration and logs, and rebuild or replace it using trusted firmware and credentials.

Credential rotation after suspected compromise

After containment:

1. Revoke active sessions and tokens.
2. Reset credentials used by the affected service.
3. Rotate secrets stored in application configuration, environment variables, and automation systems.
4. Review service accounts and API keys for unusual use.
5. Reissue credentials from a clean administrative workstation.
6. Confirm that old credentials no longer authenticate.

Prioritize credentials with access to identity systems, cloud environments, databases, backup platforms, remote support tools, and network infrastructure.

Bottom Line#

Start with internet-facing BeyondTrust and Collabora deployments, then move through the CVSS 10.0 Wavlink devices and the other systems in the emergency triage order. Preserve logs and assess for compromise before treating remediation as complete; where an edge device or service cannot be trusted, isolate it and rebuild or replace it using trusted firmware and credentials. The BAE Systems disruption and malicious Arch packages also make vendor continuity and package provenance immediate operational checks, not follow-up tasks.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.