// day
Oct 8, 2026
1 new incident, 3 with updates.
## started
## updated
- criticallivepartial fixsince Aug 29, 2026
BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)
› BeyondTrust Remote Support (formerly Bomgar)
China-nexus actor ARMORY CASTLE (ex-UNC5221) exploited CVE-2026-102764, a critical unauthenticated file-operations flaw in BeyondTrust Remote Support, as a zero-day from late August 2026. BeyondTrust issued BT26-05-RS; SaaS was auto-patched by Oct 9; CISA added the CVE to KEV on Oct 16. Self-hosted appliances need the patch plus forensics — patching alone does not clear existing footholds (SAWFLY / BARECLAW).
CVE-2026-102764 - highclosedpatchedclosed Sep 16, 2026
Telegram Desktop one-click account takeover via tg:// IPC (CVE-2026-107181)
› Telegram Desktop
CVE-2026-107181 (CVSS 8.1) in Telegram Desktop before 7.2.9 lets a crafted tg:// link inject IPC commands and exfiltrate tdata session files, enabling account takeover without the password/2FA. Fixed in 7.2.9 (mid-September); continued discussion into early October.
CVE-2026-107181 - criticallivepartial fixsince Oct 7, 2026
tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token
› tensorlake (npm)
On Oct 8 2026, tensorlake@0.5.144 was published from the real GitHub repo (with npm provenance) carrying a preinstall hook that installs a Shai-Hulud-style credential-stealing worm. It harvests npm/GitHub/cloud/SSH/AI-tool secrets, spreads to other packages, and installs a “gh-token-monitor” that wipes the home directory if the stolen GitHub token is revoked. Pin 0.5.143; remove the monitor before rotating tokens.
GHSA-8g63-53c9-65j2
