# MSP Threat Briefing: November 2, 2026

_November 2, 2026 · LNX Inc._

BeyondTrust Remote Support exploit code is public and probes have begun, Entra memberOf rules freeze November 3, and DreamHost users must reset passwords.

CISA has added nothing to its exploited list since October 30. The urgent item today is a remote support appliance. Exploit code for the BeyondTrust Remote Support flaw is now public, and sensors logged the first probes on November 1. Microsoft also stops processing Entra `memberOf` group rules tomorrow, and DreamHost has published the scope of its October breach.

1. Confirm every self-hosted BeyondTrust Remote Support appliance has the BT26-05-RS patch. If it was internet-facing and unpatched at any point since late August, investigate it as compromised.
2. Before November 3, find Entra dynamic groups, dynamic administrative units and access package policies that use `memberOf`, and replace them.
3. For clients on DreamHost, reset FTP, SFTP and mailbox passwords used since August, and check sites and forwarding rules.
4. Move self-managed GitLab to the October 21 releases. The October 12 fixes miss a second CVSS 10 flaw.

## 1. BeyondTrust Remote Support: exploit code is public and probes have started

CVE-2026-102764 lets an unauthenticated attacker perform file operations on a self-hosted BeyondTrust Remote Support appliance (formerly Bomgar). Rapid7 rates it 9.3 under CVSS 4.0. BeyondTrust disclosed it on October 15. CISA added it to its [exploited catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764) on October 16.

Exploitation started well before disclosure. [Google Threat Intelligence](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/) attributes it to ARMORY CASTLE, a suspected China-nexus espionage group formerly tracked as UNC5221. Google dates the zero-day use to late August 2026. The attackers took root on the appliance, dumped its credential vault and used support sessions to reach internal machines. Google notes this group has a history of broad, opportunistic exploitation once a flaw is public.

That is the new part. [Rapid7 updated its analysis](https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remote-support-authentication-bypass-exploited-in-the-wild) on November 2. It notes a Rapid7 technical write-up published October 30 and a Metasploit module. The module was submitted on October 30 and had not been merged as of November 2. Previdian's [sensor page](https://previdian.com/CVE-2026-102764) recorded two attempts on November 1 from one address in Hong Kong. Previdian says this does not show any target was vulnerable or that the attempts worked.

**Who is exposed.** Clients, or MSPs themselves, that run a self-hosted Remote Support appliance reachable from the internet. Versions 26.2.3 and earlier are affected unless BT26-05-RS is applied. BeyondTrust patched all SaaS customers by October 9. A remote support appliance stores credentials and has a path into every endpoint it supports, so one compromise reaches far.

**What to do.**

- Apply BT26-05-RS from the `/appliance` interface. The patch covers 24.3.1 through 26.2.3. Older appliances must upgrade to a supported version first.
- Patching does not remove persistence, per Rapid7. If an appliance was exposed and unpatched during the window, preserve evidence first. Google recommends snapshotting virtual appliances, with memory, before any change or reboot.
- Rebuild rather than clean an appliance with confirmed or unknown status. Restore only a configuration backup from before late August, and issue a new TLS certificate.
- Rotate credentials only after patching or rebuilding. Google lists the order: `/appliance` admins, `/login` users, API secrets, directory bind accounts and SAML keys, vault credentials, then integrations such as SMTP and syslog.
- Restrict `/login` and `/appliance` to known addresses. Require SAML single sign-on with phishing-resistant MFA.
- Hunt in appliance logs for `user_changed` events that raise a Jump Item or Team role to Administrator. Also look for admin logins from unexpected addresses and gaps in syslog forwarding.
- The attackers deleted on-box logs. Pull reverse-proxy, WAF and firewall logs for the appliance's address back to August.

Host indicators published by [Google Threat Intelligence](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/):

| Indicator | Type |
|---|---|
| `mangoapi.php` (SAWFLY webshell), SHA-256 `dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb` | File |
| `ingredi_ws` (BARECLAW tunneler), SHA-256 `1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462` | File |
| `/usr/bin/dbus-authd` (root-owned SUID copy of `/bin/sh`) | File |
| `/home/bomgar/sbin/post_boot.d/zz-root-persist` | Persistence |
| `NOPASSWD` entry in `/ns/config/sudoers.template` | Persistence |
| `wswsws` ACL or `webskd3` backend in `/ns/config/haproxy.conf` | Configuration |
| `/uidchanarge` WebSocket path; listener on TCP 19800 | Network |
| Missing `bt-secrets.log` or `/ns/log/http-access.log` | Anti-forensics |

## 2. Entra stops processing memberOf group rules on November 3

The `memberOf` rule operator for Entra dynamic groups leaves preview after November 3, per [Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-rule-member-of). Microsoft sent its final reminder as [MC1529463](https://mc.merill.net/message/MC1529463) on October 28. Rules are not deleted. They stop updating and keep their last membership.

The risk is silent drift. A new hire never lands in the group that grants licenses or app access. A departed employee stays in a group that a Conditional Access policy targets. Teams and SharePoint access tied to the group goes stale too.

**Who is exposed.** Tenants with Entra ID P1 or P2 where someone built a dynamic group, dynamic administrative unit or access package auto-assignment policy with `memberOf`. Rules look like `user.memberof -any (group.objectId -in [...])`. This was a preview feature, so it is most likely in tenants where an admin built nested group logic.

**What to do.**

- Export dynamic membership groups from the Entra admin center and search the rules for `memberOf`.
- Use Microsoft Graph PowerShell to check dynamic administrative units and entitlement management auto-assignment policies, as Microsoft directs.
- Replace each rule with supported operators, or convert the group to assigned membership. Microsoft has no direct replacement yet.
- Check whether any affected group is used in Conditional Access, group-based licensing or access packages. Validate membership after the change.

## 3. DreamHost breach exposed FTP, SFTP and webmail credentials

DreamHost [disclosed](https://www.dreamhost.com/news/announcements/october-security-incident/) on October 29 that an attacker reached the server behind its browser-based File Manager. The attacker used a flaw in third-party software. They took FTP and SFTP usernames and passwords for users who logged into File Manager before October 23. They also reached some webmail systems and took a limited number of webmail logins. DreamHost puts the likely access window at about August to October 23.

DreamHost says the incident hit well under 10% of email and FTP/SFTP accounts. It found no evidence that control panel logins or billing details were accessed. Some customers may have had mailbox contents viewed, and DreamHost says it is contacting them individually.

**Who is exposed.** Clients whose websites or mail are hosted at DreamHost, especially where an agency or staff member used File Manager or webmail.

**What to do.**

- Have the account holder reset mail, FTP and SFTP passwords in the DreamHost panel. DreamHost already forced resets for affected users. Treat any File Manager-era credential as compromised regardless.
- Change those passwords anywhere else they were reused, and update saved passwords in mail and FTP clients.
- Check website files for changes nobody made, such as new PHP files or edited theme files.
- Review webmail forwarding rules and filters on every mailbox.
- Warn the client about follow-up phishing. DreamHost says it will never email asking for a password.

## 4. Update: GitLab's October 12 fix leaves servers open to a second CVSS 10 flaw

The [October 31 briefing](/news/msp-threat-briefing-2026-10-31/) covered the exploited CVE-2026-97229. Its fixed versions, 19.4.2, 19.3.5 and 19.2.8, do not fix CVE-2026-110264. That second flaw is also an integer overflow in the regular expression compiler. It lets an unauthenticated user run code on the server under certain conditions. GitLab rates it 10.0 and fixed it on October 21 in a [critical patch release](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/). It affects every version from 7.0.

Shadowserver counts more than 11,300 instances exposed to CVE-2026-110264, as [reported by Techzine](https://techzine.eu/news/security/145456/thousands-of-gitlab-servers-still-unpatched-against-critical-vulnerabilities) on November 2. More than 1,000 still lack the fix for CVE-2026-97229. No exploitation of CVE-2026-110264 has been reported.

**What to do.**

- Upgrade self-managed GitLab to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. These fix both flaws.
- The release includes database migrations. Single-node servers go down until migrations finish, so schedule a window.
- GitLab.com and GitLab Dedicated need no action, per GitLab.

## Sources

- [CISA Known Exploited Vulnerabilities catalog: CVE-2026-102764](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764)
- [Google Threat Intelligence: ARMORY CASTLE exploits BeyondTrust](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/)
- [Rapid7: CVE-2026-102764, updated November 2, 2026](https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remote-support-authentication-bypass-exploited-in-the-wild)
- [Previdian: CVE-2026-102764 sensor observations](https://previdian.com/CVE-2026-102764)
- [Microsoft Learn: dynamic membership groups with the memberOf operator](https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-rule-member-of)
- [MC1529463: final reminder to replace memberOf configurations](https://mc.merill.net/message/MC1529463)
- [DreamHost: October security incident](https://www.dreamhost.com/news/announcements/october-security-incident/)
- [GitLab critical patch release 19.5.1](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)
- [Techzine: thousands of GitLab servers still unpatched](https://techzine.eu/news/security/145456/thousands-of-gitlab-servers-still-unpatched-against-critical-vulnerabilities)