The short version
Today in 4 stories
- Suspected China-linked group exploited BeyondTrust zero-day for espionageAttackers turned a trusted remote-support platform into a route for credential theft and internal reconnaissance.
- Palo Alto Networks patches exploited PAN-OS flaw giving root accessAn actively exploited firewall flaw gives authenticated attackers root-level control.
- Australia's ASD replaces Essential Eight with broader ASD Essentials frameworkA major national cyber agency has moved from a fixed checklist to outcome-based security guidance.
- OWASP's 2026 LLM Top 10 ranks excessive AI agent permissions as third-highest riskAI tools with too much access and autonomy are now viewed as a top enterprise security risk.
Suspected China-linked group exploited BeyondTrust zero-day for espionage
A critical flaw in BeyondTrust Remote Support let attackers seize remote-access infrastructure, deploy a web shell, pursue root access and harvest stored credentials. BeyondTrust's updated disclosure identifies two affected customers and says SaaS customers were remediated by October 9, with a patch available for self-hosted versions 24.3.1 through 26.2.3.
Palo Alto Networks patches exploited PAN-OS flaw giving root access
CVE-2026-0322 lets an authenticated attacker with access to the management interface execute code with root privileges on PA-Series and VM-Series firewalls and Panorama appliances. CISA has added it to its Known Exploited Vulnerabilities catalogue with an October 17 federal remediation deadline.
Australia's ASD replaces Essential Eight with broader ASD Essentials framework
The Australian Signals Directorate introduced ASD Essentials, covering enterprise IT, cloud, operational technology, AI and executive oversight through outcome-based principles rather than fixed prescriptive controls. Existing Essential Eight work maps to the new framework but may need broader coverage or new evidence of effectiveness.
OWASP's 2026 LLM Top 10 ranks excessive AI agent permissions as third-highest risk
The updated OWASP GenAI Security Project ranking moves excessive agency from sixth to third place, reflecting AI assistants connected to email, databases and cloud services acting on manipulated or mistaken output. The report recommends narrowly scoped tools, minimum permissions and human approval for higher-impact actions.
The takeaway
What to do this week
This week's theme is privileged infrastructure — remote-support tools and firewalls — being used as entry points for deeper compromise. Patch management interfaces and support platforms promptly, and review what access AI tools and third-party software actually hold.
Where this comes from
Compiled by Cyentrix from 10 newsletters received 15 to 16 October 2026 (ISACA, "The Cyber Security Hub™ via LinkedIn", ISACA SmartBrief on Cybersecurity). Summaries are drafted with AI assistance from the newsletter text and edited for length; follow the source links for the full reporting. Cyentrix is not the original reporter of these items.