Sunday Briefing / October 18, 2026
The Help Desk Can Open the Wrong Door.
Attackers exploited software used to fix computers remotely. For buyers, the urgent question is whether their provider verified the fix and checked for earlier access.
Video Brief / October 18, 2026
The help desk risk, explained.
A trusted support connection became a way in. The question for buyers: was the fix verified, and was earlier access checked?
Watch on YouTube ↗Press play for the video brief. The music-only motion brief follows below.
The motion brief
One story. Clear consequences. A question worth asking.
Music: “Solarflares” by Christoffer Moe Ditlevsen, supplied for this update. The October 18 video brief is available above and on YouTube.
The evidence behind the brief
Mandiant documented attackers exploiting a previously unknown weakness in BeyondTrust Remote Support, with observed activity dating to late August. Canada’s Cyber Centre issued a warning on October 16, urging affected organizations to verify the fix and review earlier exposure.
Read the full October 18 brief →
- BeyondTrust · October 15, 2026BeyondTrust security advisory BT26-05 ↗
CVE-2026-102764, affected Remote Support versions, remediation and cloud-patching statement.
- Google Threat Intelligence / Mandiant · October 15, 2026ARMORY CASTLE Exploits BeyondTrust ↗
Observed exploitation in late August, investigation findings and review of earlier exposure.
- Canadian Centre for Cyber Security · October 16, 2026Alert AL26-025 ↗
Fresh national alert, affected deployments and recommended verification and review.