BTCPay Server links hot-wallet thefts to older releases

BTCPay Server said early on 2 November that attacks on Sunday night targeted instances running version 2.4.1 or older, released on July 23.cybersixt The project reported no credible hot-wallet drain reports for version 2.4.7, released on October 29, and said anyone running a version above 2.4.2 was not affected.cybersixt Lead developer Nicolas Dorier said traces showed attackers used vulnerabilities fixed in 2.4.2 and logged in as admin on affected servers.cybersixt Some hosting providers shut down older instances after the project's warning, while the project said it was investigating and promised a blog post with more detail.cybersixt

Rapid7 published an analysis and Metasploit module for CVE-2026-102764, a BeyondTrust Remote Support flaw that lets unauthenticated attackers write files to an appliance and execute code as its operating-system user.SecurityOnline BeyondTrust confirmed two compromises on 29 August 2026, one on a hosted instance and one on a self-hosted appliance, before disclosing the flaw on 15 October.SecurityOnline Mandiant attributed the activity to ARMORY CASTLE, a suspected PRC-linked espionage actor previously tracked as UNC5221, and CISA added the vulnerability to its KEV catalogue on 16 October.SecurityOnline Self-hosted Remote Support versions 26.2.3 and earlier are affected unless patched; BeyondTrust said its SaaS service was patched on 9 October 2026.SecurityOnline Rapid7 tested version 24.1.2 but said it had not established the full affected range or fixed builds through testing, and BeyondTrust had not identified an exploit path in Privileged Remote Access.SecurityOnline

SecurityOnline reported that a ransomware campaign encrypted storage volumes on Synology network-attached storage devices, primarily affecting internet-exposed appliances running outdated software.SecurityOnline The outlet attributed the attacks to known vulnerabilities rather than zero-days and cited Synology advisory SA-24:20 for CVE-2024-10441, a flaw in internal plugin services rated 9.8 on the CVSS scale.SecurityOnline The listed minimum fixed versions are DSM 7.4-90075, DSM 7.3.2-86009-4, DSM 7.2.2-72806-9 and DSM 7.2.1-69057.12.SecurityOnline SecurityOnline also cited Qihoo 360 analysts on exploitation of other flaws patched in September 2026, but did not identify those vulnerabilities or provide details about specific victims.SecurityOnline The outlet said DSM 6.x has reached end of life and will not receive security fixes.SecurityOnline