A state-linked espionage group reached self-hosted Remote Support servers before a patch existed.
The Hacker News reports that a China-nexus espionage group tracked as Armory Castle, previously known as UNC5221 or Warp Panda, exploited a zero-day flaw in BeyondTrust Remote Support, CVE-2026-102764, caused by improper origin validation in an internal messaging component. Mandiant found that a successful compromise leads to a custom PHP web shell called SAWFLY, used for remote access and command-and-control on affected servers.
BeyondTrust has pushed patches to all Remote Support SaaS customers as of October 9, 2026, and is telling self-hosted customers on versions 24.3.1 through 26.2.3 to manually apply patch BT26-05-RS. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, giving federal civilian agencies until October 19, 2026 to apply fixes.
Why it matters: remote-support tools carry deep, often standing privileged access into enterprise networks, which is exactly what makes them attractive as a zero-day entry point for state-linked actors. Enterprises running self-hosted BeyondTrust Remote Support should patch now, review logs for the SAWFLY web shell, and treat third-party remote-access tooling as part of the governed, monitored security perimeter rather than an exception to it.