Daily Cybersecurity News – October 17, 2026

What happened

Security firm Calif published a full proof-of-concept local privilege-escalation exploit that gains root on OpenBSD 7.9 by chaining an integer overflow in the shmat(4) shared-memory attach function with a kernel reference-counting use-after-free.

The integer overflow stems from a signed 16-bit short counter (shm_nattch, max 32,767) inherited from 1988 BSD sources that OpenBSD never widened. The exploit maps many segments and forks processes to wrap the counter, races to free still-in-use memory, then uses an out-of-bounds write on multicast counters to corrupt page-table entries. This bypasses KARL kernel-address randomization plus SMAP and SMEP, letting the attacker overwrite a predictable function pointer.

No CVEs were assigned. OpenBSD shipped fixes as errata 018 (Sept 14, reliability) and errata 026 (Sept 30, security); both are in syspatch and cover all architectures. OpenBSD 7.8 also received the integer-overflow fix. There is no evidence of in-the-wild exploitation.

Who is affected

OpenBSD 7.9 systems (and 7.8 for the integer overflow) prior to the September 2026 errata. Any local unprivileged user on an unpatched system can attempt the chain.

OpenBSD is used in firewalls, servers, and security-focused deployments; the issue is local-only so internet-facing remote exposure is limited, but multi-user or compromised-account scenarios are at risk.

Why it matters

A decades-old type choice enabled a full root chain that defeats modern hardware and software mitigations without needing an info-leak. PoC code is public on GitHub, raising the chance of opportunistic local attacks or further research.

Operators who treat OpenBSD as a hardened base should still apply the errata promptly; the case also highlights residual risks from legacy kernel data structures and deterministic allocators.

How it could have been prevented

Apply the available syspatch errata (018 and 026) immediately on all OpenBSD 7.8/7.9 systems. Rebuild or reboot as required by the patches.

Limit local unprivileged access, monitor for unusual shared-memory and process-fork activity, and consider the additional hardenings proposed by the researchers (safe-unlinking, allocator/page-table randomization, bounds checking) where feasible.

What happened

Suspected Chinese state-sponsored group Armory Castle (UNC5221) actively exploited a zero-day in BeyondTrust Remote Support appliances, tracked as CVE-2026-102764 (CVSS 9.8), for long-term espionage.

The flaw lies in internal components that failed to adequately validate message origins, allowing attackers under the right conditions to perform file operations on the appliance. Exploitation began at least as early as August 29; BeyondTrust was alerted in late September. Attackers escalated privileges, moved laterally, stole every stored credential, deployed custom malware (Sawfly and Bareclaw), and modified persistent files that survive reboots and resets.

The vulnerability is confirmed in CISA KEV as actively exploited. A patch has been released. The group has a history of zero-day abuse against edge devices including prior Ivanti and Citrix flaws.

Who is affected

Organizations running internet-reachable BeyondTrust Remote Support appliances that were unpatched at the time of exploitation. Targets have included legal services, SaaS providers, BPOs, technology companies, and government entities across multiple countries.

Any appliance that was exposed should be treated as potentially compromised until thoroughly reviewed.

Why it matters

A critical, actively exploited zero-day in widely used remote-support software gives sophisticated actors deep, persistent access and full credential theft. The group’s pattern of selective zero-day use followed by mass exploitation after disclosure raises the risk of broader scanning and attacks now that details are public.

Builders and operators of identity and remote-access infrastructure must assume high-value appliances are prime targets and prepare for rapid patching plus compromise assessment.

How it could have been prevented

Apply the BeyondTrust patch for CVE-2026-102764 immediately. Take any previously internet-exposed appliances offline for forensic review; assume compromise until proven otherwise.

Rotate all credentials stored on or accessible via the appliance, enforce network segmentation and least-privilege access to management interfaces, monitor for the reported malware families, and review logs for anomalous file operations or lateral movement.

What happened

Attackers typosquatted popular Arch User Repository (AUR) helpers by uploading malicious packages with names such as “yyay” that closely mimic yay and paru. An AUR account (marchos1as) mass-uploaded the fakes.

The packages appeared to repackage the legitimate helpers (same upstream URL and tarball) but contained a malicious install scriptlet that downloaded and executed arbitrary code (linux.sh from gitflic.ru) as root during pacman install or upgrade. Empty standard install functions were used to evade casual review and scanners. Community members flagged the packages; maintainers banned the user and deleted the packages within about an hour of the public report. No evidence of widespread successful infections was detailed, though the technique grants full root on any machine that installed a fake.

Who is affected

Arch Linux and derivative users who install software from the AUR and who mistype common helper names (yay, paru) or who fail to carefully review PKGBUILDs and install scripts before building.

AUR is community-driven and widely used for packages outside official repos; the risk is highest for users who automate helper installs without verification.

Why it matters

A simple typosquat plus root-level install script turns a routine package installation into instant full system compromise. This continues a pattern of AUR abuse (earlier abandoned-package takeovers and malware waves) that has already forced temporary upload freezes.

Linux desktop and server operators who rely on AUR helpers must treat every community package as untrusted code executed with elevated privileges.

How it could have been prevented

Never install AUR packages whose names are close misspellings of popular tools. Always manually review the PKGBUILD and any install/upgrade scriptlets before building.

Prefer official repositories or well-known, audited helpers installed from trusted sources; use package-name allow-lists or AUR helpers configured for strict verification; monitor pacman logs for unexpected root script execution; and consider blocking untrusted domains used in build scripts.

What happened

Microsoft released patches for more than 30 new vulnerabilities, the majority in the Office suite. Two dozen are high-severity remote code execution flaws; roughly half a dozen can be triggered via the Preview Pane.

Most RCEs require a victim to open a specially crafted file (document, etc.). Root causes include buffer overflows, off-by-one errors, use-after-free, path traversal, and numeric truncation. Word received the bulk of the fixes, with additional patches for Excel, Outlook, PowerPoint, and SharePoint. Microsoft also fixed information-disclosure bugs, a security-bypass issue in Office, a DoS in ASP.NET Core, an elevation-of-privilege in Identity Web, and an information disclosure in MSAL for Node.js.

None of the newly addressed issues were known to be exploited in the wild as zero-days. Microsoft also updated advisories for Office LTSC for Mac 2021/2024 and Office 365 for Mac.

Who is affected

Users and organizations running unpatched Microsoft Office (Windows and Mac variants, including LTSC and Microsoft 365) and related components such as SharePoint, ASP.NET Core, Identity Web, and MSAL for Node.js.

Enterprise environments that open untrusted documents or rely on Preview Pane functionality face the highest practical risk.

Why it matters

A large batch of RCE bugs in the world’s most widely used productivity suite creates a broad attack surface for phishing and document-based malware delivery. Preview Pane vectors lower the bar because they can execute without fully opening the file in some configurations.

Even without current in-the-wild exploitation, rapid weaponization after patch release is common; timely deployment reduces the window for attackers.

How it could have been prevented

Apply the latest Microsoft Office and related security updates immediately via Windows Update, Microsoft Update, or your enterprise patch-management system. Prioritize systems that handle external email and documents.

Disable or restrict Preview Pane where feasible, enforce Protected View and Attack Surface Reduction rules for Office, block unnecessary macros, and educate users not to open unexpected attachments.

What happened

Moscow police detained three suspected members of the financially motivated DataSuckers group after a breach of Russian pizza chain Dodo Pizza that allegedly exposed records tied to hundreds of millions of orders spanning 15 years. A fourth member remains at large.

19-year-old Denis Fridman was placed under house arrest until December 8 and faces charges related to illegal handling of computer information containing personal data. Police reportedly traced him after he exposed his IP while accessing the stolen data. The group allegedly obtained corporate credentials left on GitHub, then moved into cloud storage, databases, and password stores. The stolen archive was sold on the dark web for about $100,000 in cryptocurrency.

DataSuckers has also claimed attacks on Russian tour operator Tez Tour and Ukrainian grocery chain ATB.

Who is affected

Dodo Pizza (approx. 1,500 restaurants in 28 countries) and its customers whose names, addresses, phones, emails, birth dates, and order history may have been accessed. Additional claimed victims include Tez Tour and ATB customers and operations in Russia and Ukraine.

Suspects include citizens of Russia, Kazakhstan, and Belarus.

Why it matters

The case shows both the impact of simple credential exposure (GitHub secrets) leading to massive personal-data theft and the ability of local law enforcement to act when operational security fails (IP leak). It also illustrates the rising tempo of financially motivated attacks on retail and hospitality across the region.

Operators should note that even “local” groups can monetize large customer databases quickly on underground markets.

What happened

In a Help Net Security interview, intcube CTO David Fuhr described a 12-week security cohort in which 27 municipalities (far more than the planned 10-15) jointly hardened Windows Server and Active Directory.

The program used weekly sessions, homework, start- and end-point measurements, lab testing of potentially breaking changes (SMB signing, LDAP signing, Kerberos hardening), and rollback plans. Fuhr argued that the root cause of long-lived AD weaknesses in one- or two-person admin teams is not lack of awareness or pure funding but missing structured motivation and bandwidth: large audit reports go unread, and isolated admins juggle too many competing tasks to finish hardening.

Cohorts create shared rhythm, peer pressure, and focused energy that classic one-on-one consulting often fails to sustain.

Who is affected

Small IT teams (especially one- or two-admin shops) in municipalities, public administration, and similar resource-constrained organizations that run long-lived Active Directory environments with accumulated technical and process debt.

The pattern applies broadly to any under-staffed enterprise still dependent on decades-old Microsoft identity infrastructure.

Why it matters

Known, fixable AD misconfigurations remain open for years and continue to enable ransomware and lateral movement. Audit reports alone do not produce remediation when teams lack time, energy, and a clear execution path.

The cohort model offers a practical way for defenders to convert awareness into completed hardening without requiring large new headcount, making it relevant to CISOs and public-sector IT leaders facing the same constraints.