Cyber Tech Cafe

10/19/2026

A Chinese state-sponsored hacking group has been exploiting a zero-day vulnerability in BeyondTrust Remote Support appliances since August, giving them root access to harvest credentials, delete logs, and exfiltrate sensitive internal documents.

The flaw — CVE-2026-102764, scored 9.3 out of 10 — affects all Remote Support versions up to 26.2.3. BeyondTrust shipped a patch on October 8, but self-hosted customers have to apply it manually.

Here's why this matters for regular businesses: remote support tools are often overlooked in patch cycles because they're not on a user's desktop. They're edge appliances — out of sight, out of mind — which is exactly why attackers love them.

For MyIT Professional and Enterprise clients, this is the kind of thing we catch before it becomes a headline. Our software install monitoring watches for suspicious payloads in near-real-time, and our patch management covers these edge cases, not just the laptops on your desks.

If you're managing IT yourself, ask yourself: when was the last time your remote support appliance was patched? If you're not sure, that's a conversation worth having.

Sources:
- SecurityWeek: https://www.securityweek.com/chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day/
- Mandiant / Google Threat Intelligence: https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust
- BeyondTrust Advisory: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05

BeyondTrust has remediated a critical vulnerability in Remote Support (RS) that could allow a remote attacker to perform file operations on an affected appliance.

10/16/2026

Microsoft's October Patch Tuesday fixed 1,400+ vulnerabilities. That's not a patch cycle — that's a manifesto.

In the same week, Windows 11 version 24H2 reached end-of-life. Yes, the version most businesses just finished deploying. No, we are not making this up.

Your IT person is not having a stroke. They're just staring at the update console wondering if scrolling counts as cardio. (It doesn't. But the emotional damage is real.)

This is the eternal cycle: you finally get everyone standardized, documented, and trained. Then Microsoft sends your OS to a farm upstate and hands you 1,400 new reasons to start over.

Pro tip: If your IT admin laughed out loud at "1,400 vulnerabilities" and then went very quiet, do not ask if they're okay. Just bring coffee. ☕

Happy Friday. May your patches be few, your restarts be scheduled, and your printers remain offline for reasons science cannot explain.

10/15/2026

Microsoft shipped fixes for 1,413 vulnerabilities this week — a new Patch Tuesday record. One of them, a Windows Shell flaw, is already being exploited in the wild on Windows 10 and 11.

Here's why that number matters more than the headline: someone on your team has to review, test, and deploy every relevant patch. At 1,413 flaws, that's not a Tuesday task. It's a full-time job. And the one zero-day in the bunch? It doesn't care if you're behind schedule.

This is the gap between "we have updates" and "we're actually protected." MyIT exists to close it — we validate, schedule, and deploy patches so your team isn't scrambling to sort through a record-breaking list.

If you're still handling updates manually, this week is a good reminder of what you're up against.

Sources:
- The Hacker News: https://thehackernews.com/2026/10/microsoft-patches-record-1413-flaws.html
- Krebs on Security: https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws/

Microsoft patched a record 1,413 flaws, including an exploited Windows Shell bug that can bypass Mark of the Web defenses.

10/12/2026

GitLab released an emergency security patch today fixing a CVSS 10.0 vulnerability — unauthenticated remote code ex*****on on self-managed GitLab servers. If your development team runs GitLab internally, versions 18.1 through 19.4.1 are affected.

An attacker doesn't need credentials, insider access, or social engineering. Just network reach to your GitLab instance. That's what a 10.0 severity looks like in practice.

Also making headlines: the FBI just removed an Accenture contractor after a missed PeopleSoft patch exposed sensitive employee data. Two stories, same lesson. Unpatched systems have real consequences.

For MyIT clients, this is the kind of thing we catch and remediate before it becomes a Monday morning crisis. Self-managed infrastructure is powerful, but it comes with a responsibility to monitor vendor security releases and move fast when they land. If your team is still handling that manually, let's talk about closing that gap.

Sources:
- GitLab Security Release, October 12, 2026
- TechJack Solutions Security Briefing (Oct 12)
- CyberSecurityNews / Reuters on FBI-Accenture incident

10/09/2026

Friday status update:

Microsoft's September Patch Tuesday broke Remote Desktop, USB audio, and Excel copy-paste.

So they shipped an emergency patch to fix the patch.

That patch broke audio again and started frying AMD GPUs.

Now there's a patch for the patch that patched the patch coming next Tuesday.

Oh, and Windows 11 24H2 hits end-of-life in 4 days.

If your IT strategy is "close your eyes and click Check for updates," your conference room PC is absolutely going to blue-screen itself into another dimension at 8:47 AM on a Monday.

We test this chaos in a lab so your 9 AM client call doesn't start with "sorry, Windows decided to update."

Happy Friday. Turn it off and on again — it won't fix Microsoft's QA department, but it'll lower your blood pressure for 30 seconds.

Sources:
https://9to5windows.com/microsoft-windows-11-emergency-update-audio-fix-october
https://deniz.in/microsoft-s-september-patches-break-remote-desktop-usb-audio-and-excel-paste
https://windowslatest.com/2026/10/09/microsoft-admits-one-bad-driver-can-crash-all-of-windows-and-intels-windows-11-26h2-ready-gpu-drivers-are-next-to-get-its-fix

Intel has confirmed itsGPU drivers are now fully compatible with Windows 11 26H2, and now it could get Microsoft's DQI upgrade.

10/07/2026

Scammers are getting smarter — and they're targeting the AI tools your team already uses.

Cybersecurity researchers just uncovered a human-operated phishing campaign built around fake AI ad portals. The sites impersonate tools like ChatGPT, Google Gemini, and Anthropic Claude, offering "campaign optimization" and "business account connections."

Click "Connect" and a fake browser window opens inside your real browser, complete with a spoofed address bar showing trusted domains like accounts.google.com or your company login page. Behind the scenes, attackers capture your password, fingerprint your device, and even relay your MFA codes in real time.

This isn't theoretical — it's a live platform targeting businesses that use the same AI tools your team probably logs into daily.

The best defense isn't to stop using AI. It's to layer in proactive security: email filtering that catches the lure, endpoint monitoring that spots the payload, and user awareness that makes your team pause before clicking. That's exactly what MyIT is built for. We see suspicious activity in near real-time — often before a user even realizes something went wrong.

Source: The Hacker News — https://thehackernews.com/2026/10/fake-chatgpt-gemini-and-claude-ad.html

A human-operated phishing platform impersonates AI ad tools to capture credentials and MFA codes through browser-in-the-browser login windows.

10/06/2026

Citrix administrators have had a rough two weeks.

On September 27, Citrix patched eight vulnerabilities in NetScaler ADC and Gateway — two of them zero-days already being exploited in the wild (CVE-2026-88771 and CVE-2026-88772). CISA added both to its Known Exploited Vulnerabilities catalog the same day.

Then on October 3, Citrix disclosed another actively exploited flaw — CVE-2026-88779, a memory overflow in SAML authentication handling. CISA gave federal agencies until October 7 to patch.

NetScaler appliances are the front door for remote access at thousands of organizations. When that front door has pre-authentication remote code ex*****on flaws, there's no margin for error.

Here's the shift: threat actors are moving back to the perimeter. After years of focusing on phishing and endpoint compromise, they're returning to direct exploitation of firewalls, VPN concentrators, and edge appliances. Why? Because one unpatched appliance gives them the keys to the entire network without ever touching a user inbox.

Here's what this means for business owners: these patches require downtime, validation, and often vendor coordination. They're not the kind that auto-install overnight. If your IT is managed reactively — "patch when something breaks" — this is exactly the kind of gap attackers count on.

For MyIT clients, this is the kind of situation we monitor continuously. We track CISA KEV additions, vendor security bulletins, and patch availability so you're not scrambling to read CVE numbers on a Tuesday morning.

If you're responsible for a NetScaler deployment and haven't patched yet, the time to act is now. Not because the sky is falling — because the door is unlocked.

Sources:
- CISA Alert (Sept 27): https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway
- CISA KEV Addition (Oct 4): https://www.cisa.gov/news-events/alerts/2026/10/04/cisa-adds-one-known-exploited-vulnerability-catalog
- Citrix Security Bulletin (CTX697096): https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
- watchTowr Analysis: https://watchtowr.com/intelligence/citrix-netscaler-zero-day-vulnerabilities-faq/

Two Citrix NetScaler RCE zero-days, exploited in the wild and now fixed. What is affected, how to fix and check for compromise, and how watchTowr Rapid Reaction flagged exposure before the CVEs existed.

10/05/2026

Citrix confirmed another NetScaler zero-day over the weekend — CVE-2026-88779 — and this one is hitting appliances that were already patched for prior zero-days just days before.

Administrators reported reboots caused by authentication requests carrying hidden shell commands. Attackers are trying to plant web shells, survive reboots, and exfiltrate appliance configurations. CISA added it to the Known Exploited Vulnerabilities catalog on October 4 with a federal patching deadline of October 7.

This is the sixth exploited NetScaler vulnerability CISA has cataloged in 2026.

Here's the reality: even when patches exist, the gap between "patch available" and "patch verified, tested, and applied" is where exposure happens. If your IT person is manually tracking CISA alerts, vendor bulletins, and weekend emergency disclosures — that's a lot of ground to cover before Monday.

MyIT exists for exactly this. We monitor threat intelligence, validate patches, and deploy them so your team isn't parsing auth logs on a Sunday night.

Sources:
- SecurityWeek: https://www.securityweek.com/exploitation-of-citrix-netscaler-zero-day-hits-appliances-patched-days-earlier/
- CISA KEV: https://www.cisa.gov/news-events/alerts/2026/10/04/cisa-adds-one-known-exploited-vulnerability-catalog
- Citrix Advisory: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174

10/02/2026

Microsoft is currently testing new Windows Update fixes because, apparently, the system that updates your system needed its own update.

Here's how it works: you set your "active hours" to 8 AM – 5 PM so your machine restarts after work. Windows interprets this as a challenge. 4:47 PM on a Friday? "Getting Windows ready. Don't turn off your PC." You have a client demo in 8 minutes.

Two months post-CrowdStrike, we all still do the little flinch when our laptops hiccup. But let's be honest — most Fridays, it's not a global security incident. It's just Windows being Windows, scheduling its mid-presentation reboot with the confidence of someone who's never had to explain a blue screen to a waiting conference room.

The real kicker? Microsoft says the fix is "being tested." So we get to do this dance a little longer. Keep your coffee hot, your save button handy, and may your printer actually print the thing on the first try.

10/01/2026

The Pentagon just disclosed that its Defense Manpower Data Center was breached between October 2025 and July 2026 — a nine-month window during which unauthorized users accessed the unencrypted personal records of more than 3 million current and former military personnel, including Social Security numbers, dates of birth, and in some cases, occupational specialties.

Two things stand out here.

First: the data was unencrypted at rest. In 2026, sensitive PII sitting on an internet-facing system without encryption is a foundational failure, not a sophisticated attack.

Second: the intruders were in the system for roughly nine months before anyone noticed. That "dwell time" is where the real damage happens. By the time the breach is discovered, the data has already been extracted, sold, or correlated with other datasets.

For businesses, the takeaway isn't to panic — it's to audit the basics. Are your critical files encrypted? Is someone actually monitoring file access logs for anomalies? Is your patch process fast enough that a known vulnerability doesn't stay open for three quarters?

This is exactly the gap MyIT is designed to close. Our Professional and Enterprise tiers monitor software installations and suspicious activity in near-real-time. Even if something bypasses email filters or endpoint protection, we see it and act on it — not nine months later.

Sources:
- BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-breach-pentagon-human-resources-management-system-steal-data-of-nearly-3-million-people/
- CNN: https://cnn.com/2026/09/25/politics/pentagon-data-personnel-breach
- Federal News Network: https://federalnewsnetwork.com/defense-main/2026/09/more-than-3-million-people-affected-by-military-data-breach

It revealed the names, dates of birth, Social Security numbers, job specialties and other records of nearly 2.8 million living and 294,000 deceased individuals.