Monday’s brief: BeyondTrust intruders and a FortiOS deadline today, then NGINX and WebSphere Liberty

By George Bailey   Published: 10/19/26   2 min read
Cyber News

Good morning. Two bugs on CISA’s exploited list are due today: a BeyondTrust Remote Support flaw a China-linked group used for six weeks before a fix, and an old FortiOS bug that turns stolen admin passwords into root. NGINX has a new release with two bugs F5 calls critical, and IBM fixed a gRPC login bypass in WebSphere Liberty. Here is the order we would take them.

Lead Story

A China-linked spy group broke into BeyondTrust Remote Support appliances for six weeks before the patch. CISA’s deadline is today. Patch, then check →

Also Worth Your Attention

Attackers used a FortiOS bug to turn stolen FortiGate admin logins into root and plant a memory-only implant. Upgrade path and password reset →

NGINX 1.31.7 and 1.30.6 fix five security bugs, two that F5 rates critical. Which configs are exposed →

IBM WebSphere Liberty servers with gRPC on let anyone call protected methods. Check for grpc-1.0 →

Also on the radar: Drupal fixed a critical remote code execution flaw in the core Field UI module and warned exploits could follow quickly; update to 10.6.19, 11.3.19 or 11.4.10, or uninstall Field UI until you can (SA-CORE-2026-014). The SiteGuard Server Edition WAF bug we noted Friday is being exploited to run commands as root or SYSTEM; the fix is 8.00 Update 5 (BleepingComputer).

Source: BeyondTrust BT26-05; CISA KEV alert, October 16; Fortinet FG-IR-26-122; nginx security advisories; IBM Liberty bulletin

Go Deeper

Get this in your inbox every weekday morning: subscribe to the Daily Brief.

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].