BeyondTrust's exploited support appliances need more than a patch Mandiant found persistent access and credential harvesting after an August intrusion. Self-hosted operators need the BT26-05 patch and a separate compromise review.