Get an email when a new major security incident drops. No spam, unsubscribe any time.
Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.
// day
1 new incident, 0 with updates.
› BeyondTrust Remote Support (formerly Bomgar)
China-nexus actor ARMORY CASTLE (ex-UNC5221) exploited CVE-2026-102764, a critical unauthenticated file-operations flaw in BeyondTrust Remote Support, as a zero-day from late August 2026. BeyondTrust issued BT26-05-RS; SaaS was auto-patched by Oct 9; CISA added the CVE to KEV on Oct 16. Self-hosted appliances need the patch plus forensics — patching alone does not clear existing footholds (SAWFLY / BARECLAW).
