A critical remote-code-execution flaw in BeyondTrust’s Remote Support and Privileged Remote Access products, found by security firm Hacktron using an AI research tool, was already being exploited as a zero-day as early as January 31, 2026, about a week before BeyondTrust’s public disclosure. A proof-of-concept exploit published February 10 was followed by in-the-wild attacks within 24 hours, with intruders deploying the VShell implant for persistence and lateral movement. CISA added the flaw to its Known Exploited Vulnerabilities catalog and later flagged it as used in ransomware campaigns; roughly 11,000 internet-exposed Remote Support instances were estimated to be vulnerable, about 8,500 of them on-premises deployments.