BEYONDTRUST SAYS HACKERS BREACHED REMOTE SUPPORT SAAS INSTANCES

Summary from the TLDR InfoSec newsletter

BeyondTrust identified a security incident in which an attacker obtained a Remote Support SaaS API key which it used to access some Remote Support SaaS instances and reset passwords for local application users. As part of its investigation, BeyondTrust discovered two CVEs that could allow for RCE but did not mark either as being actively exploited. BeyondTrust has patched all cloud instances against these CVEs and is working with customers to ensure that self-hosted instances are patched.