Dark Web Intelligence (@DailyDarkWeb) on X

What it is

CVE-2026-102764 is an unauthenticated remote code execution flaw in BeyondTrust Remote Support, tracked by the vendor as BT26-05 (CVSS 4.0 9.3). It was exploited in the wild before this post and is listed in CISA's KEV catalog. On 30 October 2026 Rapid7 published an analysis and opened a Metasploit pull request (17:48 UTC). The pull request was still open and unmerged when the post was written. The post's point is that this is a new public exploit, not a new zero-day.

How it works

The code runs as the site's OS user. The entry point is the public customer session start, so no credentials or user interaction are needed.

1. The attacker forges a "local" message origin.
2. That reaches the native file-transfer service.
3. The service writes a PHP file into the web root.
4. Requesting that file gives code execution.

Preconditions / Affected

All versions up to 26.2.3 are affected unless patched. Rapid7 demonstrated the exploit on Remote Support 24.1.2. SaaS instances were patched by 9 October 2026, so the risk is to self-hosted deployments.

What to do

• Self-hosted: apply patch BT26-05-RS. Versions older than 24.3.1 must be upgraded first.
• Patching does not rule out earlier compromise. Look in the public web directory for PHP files you do not recognise.
• Look in web logs for extensionless requests to new endpoints.

The page gives no commands or detection queries. The sources are a Rapid7 blog post and the BeyondTrust trust center advisory.

Caveats

• Rapid7 tested one build, not the full affected and fixed version matrix.
• The Rapid7 blog and the Metasploit module come from the same team.
• The post reports no malicious use of the new module, no patch bypass and no widespread exploitation.
• The page is a secondary summary on X by @DailyDarkWeb, and the technical detail comes from the linked Rapid7 post.