[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-config":3,"i-flag:ph-4x3":14,"i-flag:us-4x3":19,"i-flag:de-4x3":21,"i-flag:hk-4x3":23,"i-tabler:lifebuoy":25,"i-tabler:timeline":28,"i-tabler:apps":30,"i-tabler:package":32,"i-tabler:circle-half-2":34,"i-tabler:sun":36,"i-tabler:moon":38,"i-tabler:menu-2":40,"i-tabler:user":42,"i-tabler:notebook":44,"i-simple-icons:forgejo":46,"i-tabler:shield-lock":48,"i-tabler:tools":50,"i-tabler:calendar":52,"i-tabler:x":54,"$f7nef5geb9m5p":56,"i-tabler:arrow-left":121,"i-tabler:tag":123},{"matomo":4,"booking":7,"site":9,"blog":11,"newsletter":12},{"enabled":5,"siteId":6},true,"7",{"enabled":5,"url":8},"https:\u002F\u002Fcal.com\u002Fjdbungart",{"url":10},"https:\u002F\u002Fjdneer.com",{"enabled":5},{"enabled":13},false,{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":18},0,640,480,"\u003Cpath fill=\"#0038a8\" d=\"M0 0h640v240H0z\"\u002F>\u003Cpath fill=\"#ce1126\" d=\"M0 240h640v240H0z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M415.7 240L0 480V0\"\u002F>\u003Cpath fill=\"#fcd116\" d=\"M26.7 42.4L41 55l16.6-9.2l-7.4 17.5l14 13l-19-1.6l-8.1 17.2l-4.3-18.5L14 71l16.3-10zm323.8 172.3l.4 19l18 6.3l-18 6.2l-.4 19l-11.5-15.1l-18.2 5.5l10.8-15.6l-10.8-15.6l18.2 5.5zM37.2 388.1l8 17.2l19-1.6l-13.9 13l7.4 17.5l-16.6-9.1l-14.4 12.4l3.6-18.7L14 409l18.9-2.4zm114.2-249l-6.2 6.2l3.1 47l-3 .3l-5.7-42.9l-5.1 5l7.6 38.4a48 48 0 0 0-17.2 7.1l-21.7-32.4H96l26.4 34.3l-2.4 2l-31.1-35.5h-8.8v8.8l35.4 31l-2 2.5l-34.3-26.3v7.1l32.5 21.7q-5.2 7.8-7.1 17.2L66.3 223l-5.1 5l42.9 5.7q-.3 1.6-.3 3.1l-47-3l-6.2 6.2l6.2 6.2l47-3.1l.3 3.1l-42.9 5.7l5 5l38.4-7.6a48 48 0 0 0 7.1 17.2l-32.5 21.7v7.2l34.3-26.3l2 2.4l-35.4 31v8.8H89l31-35.4l2.5 2L96 312.2h7.2l21.7-32.5q7.8 5.2 17.2 7.1l-7.6 38.4l5 5l5.7-42.9q1.5.3 3.1.3l-3 47l6.1 6.2l6.3-6.2l-3.1-47l3-.3l5.7 43l5.1-5.1l-7.6-38.4a48 48 0 0 0 17.2-7.1l21.7 32.5h7.2l-26.4-34.3l2.4-2l31.1 35.4h8.8v-8.8l-35.4-31l2-2.4l34.3 26.3v-7.2l-32.5-21.7q5.2-7.8 7.1-17.2l38.3 7.6l5.1-5l-42.9-5.7q.3-1.5.3-3.1l47 3l6.2-6.1l-6.2-6.2l-47 3l-.3-3l42.9-5.7l-5-5l-38.4 7.5a48 48 0 0 0-7.1-17.2l32.5-21.7v-7.1l-34.3 26.3l-2-2.4l35.4-31v-8.9H214l-31 35.5l-2.5-2l26.4-34.3h-7.2L178 200.2q-7.8-5.2-17.2-7.1l7.6-38.3l-5-5l-5.7 42.8l-3.1-.3l3-47z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":20},"\u003Cpath fill=\"#bd3d44\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath stroke=\"#fff\" stroke-width=\"37\" d=\"M0 55.3h640M0 129h640M0 203h640M0 277h640M0 351h640M0 425h640\"\u002F>\u003Cpath fill=\"#192f5d\" d=\"M0 0h364.8v258.5H0\"\u002F>\u003Cmarker id=\"SVGEq3dreKJ\" markerHeight=\"30\" markerWidth=\"30\">\u003Cpath fill=\"#fff\" d=\"m14 0l9 27L0 10h28L5 27z\"\u002F>\u003C\u002Fmarker>\u003Cpath fill=\"none\" marker-mid=\"url(#SVGEq3dreKJ)\" d=\"m0 0l16 11h61h61h61h61h60L47 37h61h61h60h61L16 63h61h61h61h61h60L47 89h61h61h60h61L16 115h61h61h61h61h60L47 141h61h61h60h61L16 166h61h61h61h61h60L47 192h61h61h60h61L16 218h61h61h61h61h60z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":22},"\u003Cpath fill=\"#fc0\" d=\"M0 320h640v160H0z\"\u002F>\u003Cpath fill=\"#000001\" d=\"M0 0h640v160H0z\"\u002F>\u003Cpath fill=\"red\" d=\"M0 160h640v160H0z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":24},"\u003Cpath fill=\"#ec1b2e\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath id=\"SVG5tfvBPpj\" fill=\"#fff\" d=\"M346.3 103.1C267 98 230.6 201.9 305.6 240.3c-26-22.4-20.6-55.3-10.1-72.4l1.9 1.1c-13.8 23.5-11.2 52.7 11.1 71c-12.7-12.3-9.5-39 12.1-48.9s23.6-39.3 16.4-49.1q-14.7-25.6 9.3-38.9M307.9 164l-4.7 7.4l-1.8-8.6l-8.6-2.3l7.8-4.3l-.6-8.9l6.5 6.1l8.3-3.3l-3.7 8.1l5.6 6.8z\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(72 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(144 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(216 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(288 312.5 243.5)\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":27},24,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0\"\u002F>\u003Cpath d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m12 3l3.35 3.35M9 15l-3.35 3.35m0-12.7L9 9m9.35-3.35L15 9\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":29},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m4 16l6-7l5 5l5-6\"\u002F>\u003Cpath d=\"M14 14a1 1 0 1 0 2 0a1 1 0 1 0-2 0M9 9a1 1 0 1 0 2 0a1 1 0 1 0-2 0m-6 7a1 1 0 1 0 2 0a1 1 0 1 0-2 0m16-8a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm0 10a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm10 0a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-4a1 1 0 0 1-1-1zm0-8h6m-3-3v6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 3l8 4.5v9L12 21l-8-4.5v-9zm0 9l8-4.5M12 12v9m0-9L4 7.5m12-2.25l-8 4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m9-9v18m0-7l7-7m-7 12l8.5-8.5M12 9l4.5-4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":37},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":39},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":41},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":43},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 7a4 4 0 1 0 8 0a4 4 0 0 0-8 0M6 21v-2a4 4 0 0 1 4-4h4a4 4 0 0 1 4 4v2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":45},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M6 4h11a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1m3 0v18m4-14h2m-2 4h2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":47},"\u003Cpath fill=\"currentColor\" d=\"M16.777 0a2.9 2.9 0 1 1-2.529 4.322H12.91a4.266 4.266 0 0 0-4.265 4.195v2.118a7.08 7.08 0 0 1 4.147-1.42l.118-.002h1.338a2.9 2.9 0 0 1 5.43 1.422a2.9 2.9 0 0 1-5.43 1.422H12.91a4.266 4.266 0 0 0-4.265 4.195v2.319A2.9 2.9 0 0 1 7.222 24A2.9 2.9 0 0 1 5.8 18.57V8.589a7.11 7.11 0 0 1 6.991-7.108l.118-.001h1.338A2.9 2.9 0 0 1 16.778 0M7.223 19.905a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389m9.554-10.464a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.39m0-7.735a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":49},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12 3a12 12 0 0 0 8.5 3A12 12 0 0 1 12 21A12 12 0 0 1 3.5 6A12 12 0 0 0 12 3\"\u002F>\u003Cpath d=\"M11 11a1 1 0 1 0 2 0a1 1 0 1 0-2 0m1 1v2.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":51},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M3 21h4L20 8a1.5 1.5 0 0 0-4-4L3 17zM14.5 5.5l4 4\"\u002F>\u003Cpath d=\"M12 8L7 3L3 7l5 5M7 8L5.5 9.5M16 12l5 5l-4 4l-5-5m4 1l-1.5 1.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":53},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 7a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2zm12-4v4M8 3v4m-4 4h16m-9 4h1m0 0v3\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":55},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"slug":57,"title":58,"excerpt":59,"image":60,"publishedAt":61,"topics":62,"readMinutes":69,"html":70,"metaTitle":58,"metaDescription":71,"shareImage":72,"updatedAt":61,"author":76,"related":79},"peerstitch-how-one-hacked-fortimanager-exposed-500-firewalls-at-a-telco-msp","PEERSTITCH: How One Hacked FortiManager Exposed 500 Firewalls at a Telco MSP","Attackers broke into a telco MSP's FortiManager through CVE-2024-47575, stole configs and keys for 500+ FortiGates, then used a FortiOS path traversal flaw to plant PEERSTITCH, a memory-only implant. Here is what happened, what to patch, and how to hunt for it.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fpeerstitch_fortinet_advisory.png","2026-10-20T12:00:00.000+08:00",[63,66],{"key":64,"label":65},"advisories","Advisories",{"key":67,"label":68},"security","Security",6,"\u003Cp>If you manage firewalls for other people, the box that manages them is the most valuable thing on your network. A new investigation from Palo Alto Networks' Unit 42 shows exactly why. Attackers broke into a single FortiManager appliance at a telecommunications managed service provider and walked away with the configurations, credentials, and cryptographic keys for more than 500 FortiGate firewalls, including ones protecting the provider's clients. Later they planted a new, memory-only implant that Unit 42 calls PEERSTITCH (\u003Ca href=\"https:\u002F\u002Funit42.paloaltonetworks.com\u002Ffortimanager-cve-2024-47575-peerstitch-malware\u002F?ref=ghost.jdneer.com\">Unit 42\u003C\u002Fa>).\u003C\u002Fp>\u003Cp>The lesson for MSPs comes first, because it is the part that will still matter after the headlines fade. Patch FortiManager. Keep its management interface off the internet. And if there is any chance it was compromised, rotate every credential, key, and certificate it held, because patching alone does not take back what already left the building. As Unit 42 puts it, a compromise of the management platform \"does not end when the platform is patched.\"\u003C\u002Fp>\u003Ch2 id=\"one-appliance-500-firewalls\">One appliance, 500 firewalls\u003C\u002Fh2>\u003Cp>Unit 42 says the intrusion happened in September 2024 and tracks the activity as CL-STA-0954, which it says is also known as UNC5820. Mandiant \u003Ca href=\"https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Ffortimanager-zero-day-exploitation-cve-2024-47575?ref=ghost.jdneer.com\">tracked UNC5820\u003C\u002Fa> exploiting FortiJump from as early as June 27, 2024, and investigated more than 50 potentially compromised FortiManager devices. The attackers got in through \u003Ca href=\"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2024-47575&ref=ghost.jdneer.com\">CVE-2024-47575\u003C\u002Fa>, the FortiManager flaw widely called FortiJump. Fortinet's \u003Ca href=\"https:\u002F\u002Ffortiguard.fortinet.com\u002Fpsirt\u002FFG-IR-24-423?ref=ghost.jdneer.com\">advisory\u003C\u002Fa> describes it as a missing authentication bug in FortiManager's fgfmd daemon that lets a remote, unauthenticated attacker run code or commands with crafted requests. Fortinet's CVE record scores it 9.8 out of 10.\u003C\u002Fp>\u003Cp>The attackers registered a rogue virtual FortiGate named \"localhost\" with the provider's FortiManager, then created and stole an archive. According to \u003Ca href=\"https:\u002F\u002Funit42.paloaltonetworks.com\u002Ffortimanager-cve-2024-47575-peerstitch-malware\u002F?ref=ghost.jdneer.com\">Unit 42\u003C\u002Fa>, it held full running configurations for more than 500 managed FortiGates, the central management databases, a list of firewall serial numbers with their public IP addresses, network topology and routing details, encrypted admin and SSL VPN credentials, and certificates and private keys. Unit 42 says it examined only the provider's own environment and did not investigate the client networks, so what is confirmed is exposure of configuration and credential material, not intrusions into those clients.\u003C\u002Fp>\u003Cp>That material was enough to do real damage. Unit 42 says it was able to recover administrative and SSL VPN passwords from the stolen configs by brute force, and the attackers later logged into perimeter firewalls over SSL VPN with legitimate credentials. Before that, they used the compromised FortiManager to push packet capture rules to downstream firewalls, aimed at cleartext traffic and, in a later round, at TFTP, RADIUS, and LDAP.\u003C\u002Fp>\u003Ch2 id=\"from-admin-to-root-and-an-implant-that-lives-in-memory\">From admin to root, and an implant that lives in memory\u003C\u002Fh2>\u003Cp>Even a FortiOS super admin normally works inside a restricted command line with no shell. To get past that, the attackers used \u003Ca href=\"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2025-61624&ref=ghost.jdneer.com\">CVE-2025-61624\u003C\u002Fa>, a path traversal flaw in the FortiOS command line's \u003Ccode>system.auto-script\u003C\u002Fcode> engine. It is not a remote or unauthenticated bug: it requires an authenticated administrator with read-write rights, and it turns that admin access into root. By giving an auto-script a name like \u003Ccode>..\u002F..\u002F..\u002F..\u002Fsetup\u003C\u002Fcode>, they could write files anywhere on the system and have them run as root (\u003Ca href=\"https:\u002F\u002Funit42.paloaltonetworks.com\u002Ffortimanager-cve-2024-47575-peerstitch-malware\u002F?ref=ghost.jdneer.com\">Unit 42\u003C\u002Fa>). Fortinet's \u003Ca href=\"https:\u002F\u002Ffortiguard.fortinet.com\u002Fpsirt\u002FFG-IR-26-122?ref=ghost.jdneer.com\">advisory for CVE-2025-61624\u003C\u002Fa>, first published April 14, 2026, rates it Medium, with a score of 6.0, while \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-61624?ref=ghost.jdneer.com\">NVD\u003C\u002Fa> scores it 6.5. Fortinet also says it has been exploited in the wild. In a chain like this one, where stolen configs hand attackers admin passwords, a Medium rating undersells the risk.\u003C\u002Fp>\u003Cp>The script pulled down a small kit from attacker servers, including a native ARM64 binary saved as \u003Ccode>lldprx\u003C\u002Fcode>, which is PEERSTITCH itself. Unit 42 describes it as a one-shot injector that patches the memory of two core FortiOS daemons, the logging daemon \u003Ccode>miglogd\u003C\u002Fcode> and the IPsec VPN daemon \u003Ccode>iked\u003C\u002Fcode>, then deletes itself from disk. It leaves no file behind, opens no listening port, and makes no outbound connections of its own. Instead it rides on traffic the legitimate daemons already generate and builds a hidden channel between them inside process memory, which Unit 42 says lets VPN sessions skip normal FortiOS checks.\u003C\u002Fp>\u003Cp>The attackers also turned FortiOS's own Apache certificate module, mod_md, into a reverse shell by pointing it at an attacker-run certificate authority and hiding commands in the challenge requests. They covered their tracks by killing logging daemons, clearing crash logs, and deleting rogue accounts and scripts soon after using them. Unit 42 also assesses with medium confidence that the attackers impersonated FortiManager itself to pull configurations from other firewalls, possibly by reusing the stolen trust material. Unit 42 names CVE-2024-26009 as another possible route and CVE-2024-26008 as a possible way the attackers cut the real FortiManager's session, both at medium confidence, and says the evidence does not settle it. \u003Ca href=\"https:\u002F\u002Fsecurityonline.info\u002Ffortios-peerstitch-malware-fortimanager\u002F?ref=ghost.jdneer.com\">SecurityOnline\u003C\u002Fa> has a shorter summary of the chain.\u003C\u002Fp>\u003Ch2 id=\"which-versions-are-affected-and-what-fixes-them\">Which versions are affected, and what fixes them\u003C\u002Fh2>\u003Cp>For CVE-2024-47575, Fortinet's \u003Ca href=\"https:\u002F\u002Ffortiguard.fortinet.com\u002Fpsirt\u002FFG-IR-24-423?ref=ghost.jdneer.com\">FG-IR-24-423\u003C\u002Fa> lists these FortiManager fixes: 7.6.1 or above for 7.6.0, 7.4.5 or above for 7.4.0 through 7.4.4, 7.2.8 or above for 7.2.0 through 7.2.7, 7.0.13 or above for 7.0.0 through 7.0.12, 6.4.15 or above for 6.4.0 through 6.4.14, and 6.2.13 or above for 6.2.0 through 6.2.12. FortiManager Cloud 7.6 is not affected. Cloud 7.4, 7.2, and 7.0 have matching fixes, and Cloud 6.4 users should migrate to a fixed release. Some older FortiAnalyzer models running with the FortiManager feature turned on are affected too. The advisory also lists workarounds, including refusing registration from unknown devices with \u003Ccode>set fgfm-deny-unknown enable\u003C\u002Fcode> under \u003Ccode>config system global\u003C\u002Fcode>, and allowing only known FortiGate IP addresses to reach port 541.\u003C\u002Fp>\u003Cp>For CVE-2025-61624, Fortinet's \u003Ca href=\"https:\u002F\u002Ffortiguard.fortinet.com\u002Fpsirt\u002FFG-IR-26-122?ref=ghost.jdneer.com\">FG-IR-26-122\u003C\u002Fa> says FortiOS 7.6.0 through 7.6.4 should move to 7.6.5 or above, and 7.4.0 through 7.4.9 to 7.4.10 or above. FortiOS 7.2, 7.0, and 6.4 are affected in all versions, and Fortinet's advice there is to migrate to a fixed release. FortiProxy, FortiPAM, and FortiSwitchManager are affected as well, with their own fixed versions in the advisory.\u003C\u002Fp>\u003Cp>CISA added CVE-2024-47575 to its \u003Ca href=\"https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog?ref=ghost.jdneer.com\">Known Exploited Vulnerabilities catalog\u003C\u002Fa> on October 23, 2024. CISA added CVE-2025-61624 to the catalog on October 16, 2026, with a remediation due date of October 19 for U.S. federal agencies and a flag requiring forensic triage, according to the \u003Ca href=\"https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog?ref=ghost.jdneer.com\">KEV catalog\u003C\u002Fa>.\u003C\u002Fp>\u003Ch2 id=\"are-you-affected\">Are you affected?\u003C\u002Fh2>\u003Cp>Start with versions. On each FortiGate and on FortiManager, \u003Ccode>get system status\u003C\u002Fcode> shows the running firmware; compare it with the fixed releases above. Then check the FortiGate configuration for the auto-script trick and for crash evidence:\u003C\u002Fp>\u003Cpre>\u003Ccode>get system status\nshow system auto-script\ndiagnose debug crashlog read\nshow system admin\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>Any auto-script whose name contains \u003Ccode>..\u002F\u003C\u002Fcode>, segmentation faults in \u003Ccode>miglogd\u003C\u002Fcode>, \u003Ccode>iked\u003C\u002Fcode> or \u003Ccode>syslogd\u003C\u002Fcode>, or an unexpected \u003Ccode>FortiGateCloud\u003C\u002Fcode> admin account deserve a closer look. If your FortiManager was ever exposed while unpatched, treat every credential, key and certificate it managed as compromised and rotate them, even if nothing shows up.\u003C\u002Fp>\u003Ch3 id=\"deeper-hunting\">Deeper hunting\u003C\u002Fh3>\u003Cp>Because PEERSTITCH lives only in memory, ordinary file scans will not find it. \u003Ca href=\"https:\u002F\u002Funit42.paloaltonetworks.com\u002Ffortimanager-cve-2024-47575-peerstitch-malware\u002F?ref=ghost.jdneer.com\">Unit 42\u003C\u002Fa> suggests hunting in a few places:\u003C\u002Fp>\u003Cul>\u003Cli>Memory maps of \u003Ccode>\u002Fbin\u002Fmiglogd\u003C\u002Fcode> and \u003Ccode>\u002Fbin\u002Fiked\u003C\u002Fcode> showing anonymous 16 KB regions that are readable, writable, and executable.\u003C\u002Fli>\u003Cli>Patched code in those daemons at the offsets Unit 42 lists, and any process writing into another process's memory through \u003Ccode>\u002Fproc\u002F<pid>\u002Fmem\u003C\u002Fcode>.\u003C\u002Fli>\u003Cli>Segmentation fault crashes involving \u003Ccode>miglogd\u003C\u002Fcode>, \u003Ccode>iked\u003C\u002Fcode>, or \u003Ccode>syslogd\u003C\u002Fcode> in \u003Ccode>diagnose debug crashlog read\u003C\u002Fcode>.\u003C\u002Fli>\u003Cli>Configuration revisions with \u003Ccode>system.auto-script\u003C\u002Fcode> objects whose names contain \u003Ccode>..\u002F\u003C\u002Fcode>.\u003C\u002Fli>\u003Cli>An unexpected administrator account named \u003Ccode>FortiGateCloud\u003C\u002Fcode>. Unit 42 says an account by that name pulled full configurations from managed firewalls even though the victim had no FortiManager Cloud tenant.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>On the FortiManager side, Fortinet's \u003Ca href=\"https:\u002F\u002Ffortiguard.fortinet.com\u002Fpsirt\u002FFG-IR-24-423?ref=ghost.jdneer.com\">advisory\u003C\u002Fa> lists these indicators for FortiJump:\u003C\u002Fp>\u003Cul>\u003Cli>Log entries with \u003Ccode>msg=\"Unregistered device localhost add succeeded\"\u003C\u002Fcode>. Fortinet notes that on an already patched FortiManager, this may only mean a failed attempt.\u003C\u002Fli>\u003Cli>The rogue device serial numbers FMG-VMTM23017412, FMG-VMTM19008093, and FGVMEVWG8YMT3R63. Unit 42 says the device in this case used FMG-VMTM23017412.\u003C\u002Fli>\u003Cli>The files \u003Ccode>\u002Ftmp\u002F.tm\u003C\u002Fcode> and \u003Ccode>\u002Fvar\u002Ftmp\u002F.tm\u003C\u002Fcode>, though Fortinet says file indicators may not appear in every case.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>Unit 42 has published file hashes, network indicators, and a YARA rule. The network indicators include 23.240.77[.]233 and 47.18.167[.]159, which hosted the installer and malware, and 45.32.41[.]202 and 198.199.122[.]22, tied to the rogue FortiGate registration. Payloads were served on ports 8084 and 8085. The SHA-256 hash for the core PEERSTITCH injector is \u003Ccode>b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70\u003C\u002Fcode>. The full list and the YARA rule are in the \u003Ca href=\"https:\u002F\u002Funit42.paloaltonetworks.com\u002Ffortimanager-cve-2024-47575-peerstitch-malware\u002F?ref=ghost.jdneer.com\">Unit 42 report\u003C\u002Fa>.\u003C\u002Fp>\u003Cp>Unit 42's closing advice is blunt, and it applies far beyond Fortinet shops. Treat edge management interfaces with the strictest isolation you can, and treat every credential and certificate they hold as compromised the moment the platform is. For an MSP, the management server is not just one more box. It holds the keys to everyone you look after.\u003C\u002Fp>","Attackers broke into a telco MSP's FortiManager through CVE-2024-47575, stole configs and keys for 500+ FortiGates, then used a FortiOS path traversal...",{"src":60,"width":73,"height":74,"type":75},1600,900,"image\u002Fpng",{"name":77,"url":78,"owner":13},"Aiko Tanaka",null,[80,90,101,112],{"slug":81,"title":82,"excerpt":83,"image":84,"publishedAt":85,"topics":86,"readMinutes":89},"http2shell-cve-2026-111497-brotli-decoder","HTTP2Shell (CVE-2026-111497): What the Brotli Decoder Bug Really Hits, and How to Patch","CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1 and 1.2.1, plus Node.js, Bun, Python, Envoy and .NET updates. You are exposed if you decode untrusted Brotli data. Not in CISA KEV.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fhttp2shell_cve_2026_111497_v2.png","2026-10-26T20:51:27.000+08:00",[87,88],{"key":64,"label":65},{"key":67,"label":68},1,{"slug":91,"title":92,"excerpt":93,"image":94,"publishedAt":95,"topics":96,"readMinutes":89},"package-cooldowns-github-package-firewall-npm-pnpm-bun-pip-uv-poetry","Package Cooldowns Compared: GitHub Package Firewall vs. What npm, pnpm, Yarn, Bun, pip, uv and Poetry Already Do","GitHub now offers an install-time firewall for npm, free in preview and metered later. Most package managers already ship a free cooldown. Here is what each tool does, the copy-paste config, and where cooldowns stop helping.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fpkg-cooldowns-conveyor-alberto-rodriguez-unsplash.jpg","2026-10-26T14:00:00.000+08:00",[97,100],{"key":98,"label":99},"guides","Guides",{"key":67,"label":68},{"slug":102,"title":103,"excerpt":104,"image":105,"publishedAt":106,"topics":107,"readMinutes":89},"tailscale-ssh-tailworm-mesh-vpn-agent-risk","Your Mesh VPN Agent Is Root on Every Box. Tailworm Is the Reminder.","A researcher showed one hacked Tailscale node reaching root on other servers through Tailscale SSH forwarding. No patch yet. Here is why mesh VPN agents deserve the same suspicion as any privileged daemon.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Ftailworm-padlock-light-trails-flyd-unsplash.jpg","2026-10-26T12:00:00.000+08:00",[108,111],{"key":109,"label":110},"opinion","Opinion",{"key":67,"label":68},{"slug":113,"title":114,"excerpt":115,"image":116,"publishedAt":117,"topics":118,"readMinutes":89},"emudhra-ca-weak-keys-chain-of-trust","eMudhra Broke Almost Nothing, and Still Dented the Chain of Trust","Eight eMudhra intermediate CA keys turned out to be numbers under 256. Browsers blocked them within hours, almost no site broke, and eMudhra is leaving the TLS business. The service impact was tiny. The lesson for the chain of trust is not.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Femudhra-keys-iolandino-baiano-unsplash.jpg","2026-10-25T16:00:00.000+08:00",[119,120],{"key":109,"label":110},{"key":67,"label":68},{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":122},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14M5 12l6 6m-6-6l6-6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":124},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M6.5 7.5a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003Cpath d=\"M3 6v5.172a2 2 0 0 0 .586 1.414l7.71 7.71a2.41 2.41 0 0 0 3.408 0l5.592-5.592a2.41 2.41 0 0 0 0-3.408l-7.71-7.71A2 2 0 0 0 11.172 3H6a3 3 0 0 0-3 3\"\u002F>\u003C\u002Fg>"]