This is the edge-appliance playbook again. BeyondTrust published BT26-05 and CVE-2026-102764 today alongside Mandiant’s ARMORY CASTLE analysis. The bug sits in an internal messaging component that did not adequately validate message origin. Under the right conditions, that becomes unauthenticated file operations on the appliance — and from there, host-level control and every credential the box stores or brokers. Victim count: Undisclosed. BeyondTrust is withholding exploit details while self-hosted customers finish patching.
Who got hit, and when. Per BeyondTrust’s timeline, the actor exploited a single BeyondTrust-hosted Remote Support instance and a single self-hosted appliance on Aug 29, 2026. BeyondTrust’s hunt found the SaaS compromise on Sep 28 and contained it in 27 minutes. Mandiant confirmed the self-hosted case on Sep 30. The BT26-05 patch shipped Oct 8; SaaS Remote Support and Privileged Remote Access were auto-patched by Oct 9. Coordinated public disclosure was Oct 15.
What ARMORY CASTLE did after the door opened. Mandiant documents SAWFLY (mangoapi.php), an obfuscated PHP webshell with Base32/RC4 C2, and BARECLAW (ingredi_ws), a custom SOCKS5-over-WebSocket tunneler. The actor escalated via an SUID root shell, tried to dump the vault through /ns/sbin/bt-secrets, planted reboot-surviving sudoers persistence under post_boot.d, deleted appliance logs, raised Jump Item and Team roles to Administrator, and used the support console for file transfer and lateral movement. That is not a smash-and-grab. That is living on the remote-access broker.
Who must act. Remote Support SaaS: already patched; still rotate credentials and review config if you were exposed during the window. Self-hosted Remote Support ≤26.2.3: apply BT26-05-RS from /appliance (or confirm auto-update). Versions older than 24.3.1 must upgrade first, then patch. Privileged Remote Access was not confirmed exploitable in BeyondTrust’s testing, but it shares the code path — BeyondTrust released the PRA patch and recommends applying it. Any internet-reachable vulnerable appliance during the window should be treated as potentially compromised until reviewed (per Mandiant).
What we’d do tonight. Patch self-hosted RS now. Forward syslog off-box before you assume a clean bill of health — this actor deletes local logs. Hunt for unrecognized admin sessions from residential or commercial VPN space, unknown .php under the web root, Jump Item or Team permission jumps to Administrator, HAProxy path anomalies, and syslog gaps bounded by a single session. If anything looks wrong: snapshot with memory, isolate at the perimeter, rebuild from a clean patched image, and rotate every credential the appliance stored or injected — after the box is patched or rebuilt, not before. Mandiant published SAWFLY/BARECLAW hashes and YARA; BeyondTrust customers can request the BT26-05 hunt package via the trust portal.