Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team.

But first: PHP is shipping emergency fixes today for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which public reports describe as remote code execution bugs. Cloudflare's CTO says the company is "seeing early attacks emerging." PHP isn't expected to fix end-of-life versions. Our FAQ has the details.

This week, Mandiant reported a suspected China-nexus espionage group exploiting a zero-day in BeyondTrust Remote Support, a tool support teams use to connect to the machines they manage. The brief also covers an access broker running 51 Claude Code agents, attackers warming the fridges in hundreds of French supermarkets, and Citizen Lab tying Candiru spyware on Al Jazeera devices to targeted ads.

Suspected Chinese hackers use BeyondTrust zero-day to reach endpoints →

Brief: In late August, ARMORY CASTLE, a suspected China-nexus espionage group, exploited CVE-2026-102764 as a zero-day in BeyondTrust Remote Support, Mandiant found.

Intel: The flaw lets an attacker with no login upload files to the appliance. BeyondTrust disclosed it October 15, after patching its cloud-hosted customers by October 9; self-hosted appliances need the patch, and those older than version 24.3.1 must upgrade first. CISA listed the flaw in its Known Exploited Vulnerabilities catalog on October 16. Once in, the attacker planted a hidden backdoor page and made itself root, the appliance's top-level account. It then tried several commands to pull passwords and keys from the appliance's built-in vault, and deleted logs to cover its tracks. Mandiant says patching does not undo an earlier compromise, and the attacker set up its root access to survive reboots.

Why it matters: Mandiant says the flaw can lead to "access to every credential the appliance stores or brokers." In this attack, the attacker raised a compromised admin account's remote-access roles to Administrator. That unlocked remote sessions to every system on the appliance's list, and the attacker copied documents off a user's desktop with the tool's own file transfer.

Open folder shows an access broker running 51 Claude Code agents →

Brief: SOCRadar found CyberXero, a Russian-speaking broker who sells network access to other criminals, using 51 Claude Code agents and holding data on more than 628,000 Ukrainians.

Intel: The actor left its working directory open on the internet, with AI session logs and stolen data inside. In one 61-second automated run, it scanned 4,708 targets and planted 32 web shells, hidden backdoor pages on servers. A separate, manual campaign mapped seven Ukrainian energy and utility companies, and a login saved in one of the actor's own scripts let it pull 564,073 subscriber records from a Kharkiv district heating company.

Why it matters: When the model refused a task, the actor opened a fresh session with its fake "authorized pentest on my own infrastructure" story loaded, since, as SOCRadar notes, "a refusal in one session does not carry into the next." Some refusals still held, including requests to install a backdoor and turn off a firewall.

Attackers warm the fridges in hundreds of French supermarkets →

Brief: Overnight on October 11, attackers took over the refrigeration controllers in several hundred French supermarkets and warmed their fridges and freezers, with similar reports from five other European countries.

Intel: France's CERT-FR reports many compromised Danfoss refrigeration controllers, plus units from Copeland, including its Dixell brand. CERT-FR's first fix is taking them off the internet. Researcher Kevin Beaumont said the Danfoss units carried a built-in login, username admin, whose password follows the current date and is the same on every unit; a 2025 Danfoss update removed it, but The Register reports many hit units no longer got updates and others ran outdated firmware. Pen Test Partners puts losses at tens of millions of euros and cites fires reported by the Paris prosecutor.

Why it matters: These controllers can sit entirely outside the security team's view. Pen Test Partners says a cellular modem is the quicker way to give the refrigeration contractor remote access, so the controller ends up online, "on a link the retailer often does not own, cannot see, and has no record of."

Targeted ads delivered Candiru spyware to Al Jazeera with zero clicks →

Brief: Citizen Lab links, with high confidence, zero-click attacks on at least 45 Al Jazeera devices in 2024 and 2025 to Candiru spyware delivered through ads bought by Discover-Tech.

Intel: Discover-Tech, which calls itself an ad company, won ad slots through real-time bidding, the split-second auctions that decide which ad you see, and Citizen Lab found its ads fetched code from a Discover-Tech server that sent it only to chosen targets. Al Jazeera's network logs show the order on infected devices: a Discover-Tech ad, a Candiru server checking the device, then Candiru's command servers. Discover-Tech ads also showed on NATO and European Parliament networks, which Citizen Lab says does not by itself confirm targeting or infection.

Why it matters: The NSA in 2018 and CISA in 2020 warned that malicious ads could deliver malware and recommended ad blockers. Here a targeted ad only had to load, and the auction that placed it can already hand the buyer the device's ad ID and IP address.

Stat of the week: 37%

The share of ransomware attacks that brought threats aimed at employees' friends or family members, according to Semperis, whose survey of 1,200 security and IT professionals at organizations hit by ransomware also found 41% of respondents reported facing physical or psychological intimidation.

Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.