Cyber

What changed

Malicious actors have taken advantage of typographical errors during the installation of AUR helpers like yay and paru. Users who inadvertently mistype these commands may unknowingly install compromised packages that grant root privileges to attackers.

Who is affected

This vulnerability primarily impacts users of Arch Linux and its derivatives who utilize the Arch User Repository (AUR) for software installation.

The following groups are particularly at risk:

• Arch Linux users who rely on AUR helpers like yay and paru.
• Developers and maintainers of packages in the AUR.
• Organizations using Arch Linux for development or production environments.
• General users who may install packages from unverified sources.

What to do

Users are advised to exercise caution when installing packages from the AUR and to verify the authenticity of the packages before installation. It is recommended to double-check command inputs to avoid typos.

Additionally, consider implementing the following measures:

• Regularly audit installed packages for any unauthorized changes.
• Utilize security tools to monitor for unusual activity on systems.
• Stay informed about updates and advisories from Arch Linux and related communities.

What changed

A serious vulnerability, identified as CVE-2026-102764, has been discovered in BeyondTrust Remote Support, previously known as Bomgar. This flaw, which has a CVSS score of 9.3, involves improper origin validation within an internal messaging component, allowing unauthorized access to remote support servers.

The exploitation of this zero-day vulnerability was reported to have occurred in late August 2026, with the cyber espionage group Armory Castle, also known as UNC5221 or Warp Panda, actively leveraging it for unauthorized access.

Who is affected

Organizations utilizing BeyondTrust Remote Support are at risk due to this vulnerability. The potential impact includes unauthorized access to sensitive systems and data.

This vulnerability could affect a wide range of sectors, particularly those relying on remote support solutions for operational continuity.

• BeyondTrust Remote Support users
• Organizations in sectors such as IT, finance, and healthcare
• Companies with remote workforce solutions
• Any entity utilizing remote access tools for support services

What to do

Immediate action is recommended for organizations using BeyondTrust Remote Support. Security teams should assess their systems for the presence of this vulnerability and apply any available patches or mitigations.

Additionally, monitoring for unusual activity on remote support servers is crucial to detect any potential exploitation attempts.

• Review and apply patches from BeyondTrust as soon as they are available.
• Implement network segmentation to limit exposure of remote support servers.
• Enhance monitoring and logging of access to remote support systems.
• Educate staff on recognizing suspicious activity related to remote access.