Skip to content
Start with Identity
Join free
This Week in Identity · Issue 18 · 2026-10-20 · Covers 2026-10-14 to 2026-10-20

This Week in Identity, Issue 18

Issue 18 of This Week in Identity. Three appliances that broker access were exploited this week, and in each case the attacker wanted what the box remembered: the vault, the directory bind account, the VPN credentials.

In brief

  • CVE-2026-102764, a CVSS 9.3 flaw in self-hosted BeyondTrust Remote Support through 26.2.3, was exploited as a zero-day by the China-nexus group ARMORY CASTLE, which exported every administrative credential from the appliance vault. CISA added it to KEV on October 16; the fix is patch BT26-05-RS.
  • Attackers exploiting the Ivanti Connect Secure authentication bypass CVE-2026-104935 from October 3 extracted stored LDAP credentials and then ran Kerberoasting and password spraying against Active Directory, according to Volexity. Releases 22.8R2.5 and 25.1.3.0 and later are not affected.
  • The FIDO Alliance's Passkey Index 2026, drawn from 15 consumer services, finds 36% of successful sign-ins now use a passkey, up from 26%, with a 93% success rate against 78% for passwords and traditional MFA.

The big story

A BeyondTrust zero-day turned a privileged access broker into the attacker's credential store. BeyondTrust disclosed CVE-2026-102764, a flaw in Remote Support that lets an unauthenticated attacker perform file operations on the appliance, and Mandiant tied its zero-day use to ARMORY CASTLE, the group previously tracked as UNC5221. Mandiant says the intruder planted a web shell and a root backdoor, used the bt-secrets tool to export every administrative credential in the vault, then logged in as an administrator and raised Jump Item and Team roles from "No Access" to "Administrator" to reach downstream systems. Self-hosted versions through 26.2.3 need patch BT26-05-RS, and builds older than 24.3.1 must upgrade first. SaaS tenants were patched on October 9.

Why it matters: Remote Support is a privileged access broker. It holds the credentials it injects into sessions and decides who may open a session to which machine, so owning it gave the attacker both the vault and the policy, and the downstream access looked like routine brokered admin work. The control that failed is the assumption that the PAM tier is the most trusted thing on the network rather than the most valuable target on it. Patching does not undo exposure: rebuild any self-hosted appliance that ran a vulnerable build, rotate in dependency order (appliance admins, API secrets, SAML and directory bind accounts, then every vaulted credential), and compare role assignments against a pre-August baseline. Source: BeyondTrust Remote Support zero-day let ARMORY CASTLE dump the credential vault.

Patch this week

  • CVE-2026-102764, BeyondTrust Remote Support (self-hosted, through 26.2.3). CVSS 9.3, exploited, on KEV since October 16. Apply BT26-05-RS, upgrading to 24.3.1 first if older, then rebuild and rotate. Brief.
  • CVE-2026-104935, Ivanti Connect Secure. Authentication bypass by spoofing (CWE-290), CVSS 8.6, exploited from October 3, KEV deadline October 16. Affected: 22.8R2.4, 25.1.1.1, 25.1.2.2 and earlier. CISA says compromised appliances need a factory reset plus password, certificate and API key rotation. Brief.
  • CVE-2025-61624, FortiOS. A CLI path traversal that lets a read-write administrator write files as root, used to plant the PEERSTITCH implant. Fortinet CVSS 6.0, on KEV since October 16 with an October 19 deadline. Fixed in 7.6.5 and 7.4.10; 7.2, 7.0 and 6.4 need migration. Post.

The pattern

The week's three exploited products all broker access, and in all three the follow-on was credential theft rather than the box itself. ARMORY CASTLE exported the BeyondTrust vault. The Ivanti attackers pulled the LDAP bind account and went hunting in Active Directory with Kerberoasting and password spraying. The PEERSTITCH operators recovered administrative and SSL VPN credentials from more than 500 managed FortiGates. A patched appliance still has to be treated as a disclosed credential store, which means rotation is part of the fix, not a follow-up ticket. It is the same lesson as security tools are identity infrastructure, and this week it held across three vendors.

What else happened

  • PEERSTITCH decides which FortiOS VPN sessions get checked. Unit 42 at Palo Alto Networks found the in-memory implant attached to the IKE daemon, so sessions carrying its tag skip default security validations and the firewall's authentication logs stop being evidence of who connected. Rotate VPN and admin credentials, reissue certificates, and require phishing-resistant MFA for remote access. Post.
  • GhostAction returned with about 1,900 hijacked GitHub accounts and more than 30,000 repositories, per GitGuardian, committing workflows that dump Actions secrets and scan git history for credentials. Some victims had been hit in earlier waves and never rotated. If security-audit.yml or github_actions_security.yml appears in any branch since August 31, assume every repository secret is exposed. Post.
  • Passkeys now carry 36% of sign-ins across the Passkey Index's 15 services, and FIDO estimates 7 billion passkeys are in use, without giving a counting method. The more useful figure is the gap: 38% of accounts have a passkey, yet 8 of the 10 services reporting both still see usage trail enrollment, and two admit they offer a password or OTP first. Measure passkey share of sign-ins, not enrollments. Post.
  • India will show callers' registered names on 4G and 5G calls from November 1, under a Department of Telecommunications circular dated October 13. Calling name presentation raises the cost of vishing from unknown numbers, but it asserts who registered the SIM, not who is speaking. Keep the displayed name out of help-desk verification. Post.

New from Start with Identity

From the community

We are recruiting volunteers: news curators, country ambassadors, and jobs scouts. A few hours a week, credited by name.

That's Issue 18. Subscribe for the next one.

Free to read and share. Independent and community-driven, no sponsorship. Subscribe to get the next issue.