BeyondTrust Zero-Day, Four New KEV Entries, and a Billion-Message Phishing Takedown

Security leaders should prioritize two things today: CISA's urgent push to patch a critical, actively exploited BeyondTrust Remote Support authentication bypass, and a fresh batch of four Known Exploited Vulnerabilities additions spanning Palo Alto Networks, Cisco, Ahsay and Atlassian products. Beyond patching, Microsoft's takedown of a billion-message phishing network, an FBI warning on AI-cloned candidate voices ahead of the midterms, and new CISO/CIO appointments at LexisNexis and Houston round out the week's leadership and threat picture.

CISA urges emergency patching of critical BeyondTrust Remote Support flaw

CISA issued an alert on October 16, 2026 urging organizations to patch CVE-2026-102764, a critical authentication bypass affecting BeyondTrust Remote Support versions 26.2.3 and earlier. The agency added the flaw to its Known Exploited Vulnerabilities catalog the same day after confirming threat actors are using it for initial access before establishing persistence, escalating privileges and moving laterally. Patches are available for version 24.3.1 and later via the BT26-05-RS update; BeyondTrust-hosted SaaS deployments are already patched. CISA recommends isolating suspected appliances, rotating stored credentials and reviewing new MFA registrations on privileged accounts. (CISA)

CISA KEV catalog grows with exploited Palo Alto, Cisco and Ahsay flaws

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog covering Palo Alto Networks PAN-OS, Cisco Secure Email Gateway and Ahsay AhsayCBS, citing evidence of active exploitation. The PAN-OS flaw allows authenticated root-level code execution on firewalls and Panorama; the Cisco bug lets attackers write files and run commands as root via crafted email attachments; the two Ahsay flaws are being chained to deploy webshells and cryptominers on backup servers even after an earlier incomplete patch. CISA gave federal civilian agencies until October 17, 2026 to remediate. (Help Net Security)

Atlassian Data Center products added to CISA's exploited vulnerabilities list

On October 15, 2026, CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog, a files-or-directories-accessible-to-external-parties flaw affecting multiple Atlassian Data Center products including Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye. The vulnerability could let an unauthenticated attacker access specific files within the web application root directory of affected versions. CISA's Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of KEV-listed flaws on publicly exposed assets that grant full post-exploitation control, and the agency urges all organizations to adopt the same risk-based approach. (CISA)

Microsoft dismantles YAM Store phishing network behind a billion scam messages

Microsoft disclosed it disrupted a criminal marketplace called YAM Store that sold phishing kits and compromised Microsoft and Google cloud accounts to attackers targeting healthcare, financial services, wholesale distribution and IT organizations in Japan, the US, Australia and India. Working with Resecurity and Health-ISAC, Microsoft said the operators behind kits CoGUI, Haozi and Iron Man System helped send over one billion phishing emails and texts to more than 75,000 organizations since January 2026. Under a US District Court order, Microsoft disabled more than 20,000 accounts and blocked over 100,000 fraudulent domains. (Help Net Security)

FBI warns of AI-cloned candidate voices ahead of 2026 midterms

The FBI issued a public service announcement warning that scammers are exploiting the 2026 US midterm election to run financial fraud schemes, three weeks before voting. The bureau said fraudsters use AI tools to clone candidates' voices, images and messages to solicit fake campaign contributions, sell undelivered merchandise or steal personally identifiable information. Separately, X said it suspended more than 13,000 accounts tied to suspected foreign influence operations linked to Iran, Russia and China that targeted US political conversation. CISA and the FBI also issued a related PSA on phishing and smishing threats to election officials. (Help Net Security)

LexisNexis names Swatantr Pal as Chief Information Security Officer

Swatantr Pal announced he has joined LexisNexis, the global legal information, data and analytics provider, as Chief Information Security Officer. The appointment comes as AI continues to reshape how legal professionals access information and conduct research, putting information security in focus for protecting data and supporting responsible technology use. Details on Pal's prior experience and his specific LexisNexis responsibilities were not disclosed in the announcement. (CXO Digital Pulse)

Houston elevates Kevin Berry to Chief Information Officer

The City of Houston named Kevin Berry as chief information officer, confirmed by City Council on October 7, 2026, elevating him from Houston Public Works chief technology officer. Berry succeeds Lisa Kent, who retired in June after a decade in the role. He brings more than 20 years of enterprise technology, cybersecurity and defense technology experience and will oversee Houston Information Technology Services, which supports nearly 22,000 city employees across 23 departments. (Industry Insider Texas (Govtech))