Security work dominated this week’s technology news. Organizations running self-hosted remote-support appliances had an actively exploited flaw to address, while Microsoft released an unusually large patch set that includes an exploited Windows issue. A reported Linux virtual-machine vulnerability added another concern for cloud operators.

Outside security, several stories offered a useful corrective to the idea that big technical progress always arrives as a finished product. Existing nuclear plants may produce more power, but not enough to cover projected demand by themselves. Pig kidneys preserved for more than a year are an encouraging research result, not a human treatment. And methane satellites have passed a meaningful real-world test.

BeyondTrust Remote Support needs immediate attention

CISA added CVE-2026-102764, a critical authentication-bypass vulnerability in BeyondTrust Remote Support, to its Known Exploited Vulnerabilities catalog. That means CISA has evidence that attackers are already using the flaw.

The issue affects self-hosted Remote Support appliances running version 26.2.3 or earlier. Supported self-hosted deployments need BeyondTrust’s BT26-05-RS patch. Organizations on versions older than 24.3.1 must upgrade before they can apply it. CISA says BeyondTrust-hosted SaaS deployments have already been patched.

This deserves priority because remote-support systems are powerful by design. They sit close to administration workflows and may hold credentials or provide a route into other systems. Separate reporting attributes exploitation in late August to the China-linked Armory Castle group. For affected teams, patching is only the first task. They should also review the appliance for signs of compromise and consider whether credentials stored or used through it need to be rotated.

Microsoft’s 1,413 fixes create a testing problem as well as a patching problem

Microsoft patched 1,413 vulnerabilities in one release, according to SecurityWeek and The Hacker News. The set includes a Windows Shell flaw under active exploitation.

That number is large enough to change how an IT team approaches the release. The exploited Windows issue should move to the front of the queue, but administrators still need to understand what the rest of the release touches in their environment. Broad patching without testing can disrupt business systems; delaying it leaves a large amount of known exposure in place.

The practical response is not exotic: identify affected Windows versions, prioritize the actively exploited issue, deploy in stages where operations require it, and watch for regressions. The uncomfortable part is capacity. A release of this size turns routine patch management into a substantial engineering and coordination job.

PwnEscape puts the VM boundary under scrutiny

Multiple reports describe a Linux kernel vulnerability called PwnEscape that can let code running in a guest virtual machine read memory belonging to the host. One researcher reportedly demonstrated the issue against Vercel cloud sandboxes.

Virtual machines are commonly used to separate workloads. That separation is central to cloud computing: one customer’s code should not be able to inspect the host system or another customer’s information. A bug that crosses that boundary is therefore more consequential than an ordinary flaw confined to a single virtual machine.

The reports differ on some secondary details. One says a particular configuration might allow guest-to-host writes as well as reads. The consistent concern is host-memory exposure. Cloud operators and organizations that run untrusted workloads in Linux VMs should determine whether their hosts and hypervisor configurations are affected, then follow applicable vendor guidance. This is also a reminder that isolation is an implementation, not a permanent guarantee.

Nuclear uprates can help, but the numbers show the limit

US nuclear operators are pursuing power uprates at existing reactors through equipment and fuel upgrades. This is an appealing route because it seeks more output from facilities that already exist, rather than waiting for new reactors to be built.

Constellation plans to spend more than $4.3 billion to add nearly one gigawatt across 11 reactors. Separately, a Department of Energy loan will support Vistra upgrades expected to add 433 megawatts. These projects could provide additional zero-emissions electricity faster than new construction.

They are useful increments, but the scale matters. Estimated nationwide uprate potential is 3 to 8 gigawatts, while PJM forecasts 30 gigawatts of additional AI-related peak demand by 2030. The comparison does not make uprates unimportant. It shows that they are part of a supply response, not a complete answer to rapidly growing electricity demand.

Pig kidneys survived more than a year in deep-freeze storage

Scientists report that pig kidneys cooled to -150°C and stored in a glass-like frozen state for months, including one for more than a year, were successfully rewarmed. After machine testing and transplantation into pigs, the kidneys regained color and produced urine.

Long-term organ preservation has an obvious potential benefit. It could make donor organs less vulnerable to tight timing constraints and reduce the number lost because transport and transplant arrangements cannot happen quickly enough.

The important qualification is that this remains animal research. The result has not been shown to work in humans, so its safety and effectiveness for human transplantation are unresolved. Still, recovering function after that length of storage is a striking technical result. It turns a goal that sounds close to science fiction into a concrete preservation experiment with measurable outcomes.

Reported ChatGPT ad tools raise a difficult privacy question

The Neuron summarized reporting by 404 Media that describes ChatGPT advertising tools able to target people using the subject of their current prompts and uploaded lists of email addresses, phone numbers, or Android advertising IDs. According to the report, advertisers can provide topical hints or keywords for contextual matching.

The report also says turning off ad personalization does not necessarily prevent advertising based on the current chat context. These are reported tests and descriptions of the tools, rather than independently verified facts from this publication.

If the description is accurate, the distinction between identity-based targeting and context-based targeting becomes especially important. A chat can include subjects that people would not discuss in a typical search query or social post. A control that stops one kind of targeting but leaves another in place may be technically precise, yet still hard for users to understand as a meaningful privacy choice.

A blind test gives methane satellites useful validation

A year-long single-blind field test compared 12 methane-detecting satellites with controlled methane releases in Arizona. Nature reports that multiple satellites accurately detected and quantified point-source emissions, while purpose-built methane instruments performed best.

This is valuable because satellite measurement is most useful when it can move from an interesting image to credible evidence. The test suggests that at least some systems can identify and quantify emissions under controlled real-world conditions.

That can help regulators, companies, and monitoring groups locate methane leaks and focus repair work where it is most needed. Better measurement does not repair a leak by itself, but it makes denial and guesswork harder.

Laptop farms expose a weak point in remote hiring

US authorities reportedly raided laptop farms used in a North Korean fake-candidate operation that funneled $3 million to the country. ITPro Daily reports that the operation targeted organizations in health care, communications, cyber support, retail, and manufacturing.

These schemes use remote-work arrangements to gain access to corporate systems. The risk is not limited to a fraudulent résumé or a payroll problem. A worker in a technical role can receive access to source code, internal systems, customer data, and credentials.

The reports characterize fake IT worker operations as expanding globally. Companies that rely heavily on remote staff and contractors should treat identity verification and onboarding controls as security controls. That means checking who is actually doing the work, not merely whether an applicant can pass an interview and complete forms.

Sources

  • CISA
  • The Hacker News
  • SecurityWeek Briefing
  • The Spark from MIT Technology Review
  • The Download from MIT Technology Review
  • The Neuron
  • Nature
  • ITPro Daily