Briefing — 16 October 2026

🎧 Subscribe to the podcast feed | Download episode

Security News

ARMORY CASTLE Exploits BeyondTrust Remote Support (CVE-2026-102764) (Google Threat Intelligence / Mandiant) — Threat actor ARMORY CASTLE is actively exploiting a newly disclosed arbitrary file upload vulnerability in BeyondTrust Remote Support appliances; patch immediately and audit access logs.

Targeted Ads Delivering Zero-Click Mercenary Spyware (Citizen Lab / Ars Technica) — Researchers at the University of Toronto's Citizen Lab confirmed that mercenary hackers embedded zero-click exploits in targeted advertising networks, silently installing sophisticated spyware on iOS and Android devices when victims simply loaded a page — no interaction required.

AI-Powered Espionage Campaign Targets Government Linux Infrastructure (Unit 42 / Palo Alto Networks) — A nation-state-level threat actor used AI-assisted techniques alongside custom malware, web shells, and advanced credential theft to compromise government Linux environments.

RPKI Now Protects 70% of Internet Routes (IPInfo) — Resource Public Key Infrastructure coverage has reached 70% of global BGP routes, significantly raising the bar against BGP hijacking attacks used for traffic interception and espionage.

Small Agents, Smaller Blast Radius: Controlling What AI Can Do (SANS Internet Storm Center) — SANS argues the industry is taking the wrong approach to AI agent security by building monitoring cages rather than limiting inherent permissions by design; minimum-privilege architectures are more robust than detection-based containment.

SecTor 2026: AI-Driven Threats and Perimeterless Defence Dominate (Dark Reading) — Toronto's SecTor conference closed with 22% attendance growth; dominant themes were AI-augmented adversaries, erosion of the network perimeter, and defending environments where AI agents have direct access to internal systems.

UK & Critical National Infrastructure

No new NCSC advisories in the past 48 hours.

BeyondTrust CVE-2026-102764 — BeyondTrust Remote Support appliances are widely deployed across UK enterprise, managed service providers, and public sector supply chains. ARMORY CASTLE's active exploitation means any unpatched BeyondTrust deployment is a live intrusion risk. Patch and audit access logs immediately.

Zero-click ad spyware (Citizen Lab) — Mercenary spyware delivered via ad networks has direct implications for UK government and corporate mobile fleets. Senior personnel using personal or unmanaged devices are potentially exposed. The attack surface is broad and difficult to audit retroactively.

UK ransomware victims this window: Three UK-based organisations appear in the 48-hour dataset — Kemlows Diecasting Products Limited (manufacturing, Qilin), Camden Living (hospitality, iah6477/Cinder), and Videk (technology, Akira).

Ransomware Victims (48h)

49 victims · 10 groups