Morning Threat Brief: BeyondTrust probes widen, Trigger.dev secrets exposed, BTCPay hot wallets drained, and the Amadeus breach widens

Good morning. A known exploited BeyondTrust flaw is now being probed more widely, a background jobs platform exposed customer secrets, older BTCPay servers lost hot wallet funds, and the Amadeus travel breach now touches a third major airline. Patch the remote support appliance, rotate the secrets, and check any travel booking data that passed through Amadeus.

1. BeyondTrust Remote Support probes widen for a known exploited flaw (CVE-2026-102764). Decoy systems recorded probes on November 1 against Remote Support, targeting the session start endpoint, with no successful exploitation reported from those decoy attempts. This is an early warning, not proof of mass compromise. The flaw itself is confirmed exploited: BeyondTrust disclosed it on October 15, CISA added it to its Known Exploited Vulnerabilities catalog on October 16, and Mandiant-linked reporting says the suspected China-linked actor ARMORY CASTLE, tracked as UNC5221, exploited it in late August 2026. It affects Remote Support 26.2.3 and earlier unless patched, and Canada's Cyber Centre warns exploitation needs neither credentials nor user interaction and can allow arbitrary file uploads and appliance compromise. Patch to a fixed release, restrict who can reach the appliance, and audit it for unauthorized file operations.

2. Trigger.dev: attacker accessed environment variables for a subset of organizations. Trigger.dev said on November 1 that an attacker gained unauthorized access to environment variables belonging to a subset of customer organizations, and that it has blocked the exploit used in the attack and emailed impacted owners. It has not said how many organizations were affected. Trigger.dev runs production background jobs and AI agents, so those variables can expose the API keys and credentials those workloads depend on. If you use Trigger.dev, rotate every environment variable and API key that lived in an affected organization, audit job runs and downstream API usage for activity you did not authorize, and do not assume the block alone closes the exposure.

3. BTCPay Server: older versions lost hot wallet funds, update to 2.4.7 and take servers offline. Attackers targeting older BTCPay versions emptied merchants' Bitcoin hot wallets, and on November 1 the project urged operators to install release 2.4.7 and take affected servers offline during the investigation. No total loss amount and no number of compromised servers have been disclosed, so do not quote either. If you run BTCPay, take the server offline, update to 2.4.7, rotate wallet and Lightning credentials, and audit withdrawals before bringing it back.

4. Amadeus breach widens: Malaysia Airlines joins Cathay Pacific and Japan Airlines. Malaysia Airlines said on November 1 that some customer information may have been affected by a cybersecurity incident involving Amadeus, its reservation technology provider, covering information processed between August 2023 and September 2026. It joins Cathay Pacific and Japan Airlines, which reported data involving 53,000 bookings and 92,000 customers respectively in recent days. Amadeus said it became aware of a vulnerability affecting a travel booking display environment. Malaysia Airlines said its own IT systems were not breached and there was no evidence financial information was accessed. If you booked through an affected airline in that window, watch for phishing that uses real booking details, and verify any message claiming to be from the airline through another channel.

Warning: the Ivanti privilege escalation flaw CVE-2026-111357 has a KEV deadline today, Monday, November 2. Patch it today, not later this week.

Full writeups: kevinthecyberguy.com/vuln-watch
Indicators to hunt: kevinthecyberguy.com/ioc-library

New CISA KEV additions today: none. The catalog stands at 1,766 entries, last updated October 30.

← kevintswaney.com