Patched Months Ago, Exploited Today: This Week’s KEV Listings and the Malware Behind Them

This week of October was dominated by attacks on internet-facing infrastructure, with edge appliances, remote access tools and core web technologies all targeted. Public proof-of-concept exploits turned disclosures into active attacks within hours, and several flaws that had been patched weeks or months earlier were only now confirmed as exploited. CISA added nine vulnerabilities to its KEV catalog, including all four flaws in the Plex Media Server Plex2Shell chain It also added one each for EG Secure Solutions SiteGuard Server, Siemens Software Center, BeyondTrust Remote Support Atlassian Data Center products and multiple Fortinet products. Several of these were patched long before the listing, notably the Fortinet flaw in April and the Plex flaws in August, and the listings followed public technical details or confirmed exploitation.  

Active exploitation was detected against two further flaws. Amazon recorded the first attempt against the PHP core flaws on October 17, four days before disclosure, and public PoCs followed on October 21, while Defused’s honeypots caught attackers exploiting the Redis RESTORE flaw on October 16-17.  

The malware activity centered on proxyware, webshells and stealth implants. Attackers exploiting the Plex2Shell chain dropped the myawesomeproxy proxyware alongside an XMRig miner, and ARMORY CASTLE used the SAWFLY webshell and the BARECLAW SOCKS5 tunneler after exploiting BeyondTrust Remote Support as a zero-day. CL-STA-0954 exploited FortiManager and FortiOS flaws to deploy PEERSTITCH, a memory-resident ARM64 implant injected into the miglogd and iked daemons, while multiple ransomware groups exploited the PAN-OS GlobalProtect authentication bypass to break into corporate networks.

Key highlights of the week:

• CISA added 9 vulnerabilities to the KEV catalog
• Redis RESTORE flaw exploited in the wild
• PHP2Shell flaws exploited four days before disclosure  
• Ransomware groups Qilin, Inc and Settra-linked actors exploited the PAN-OS GlobalProtect vulnerability
• CL-STA-0954 exploited Fortinet flaws to deploy the memory-resident PEERSTITCH implant
• ARMORY CASTLE exploited BeyondTrust Remote Support vulnerability as zero-day

Several high-impact vulnerabilities are currently trending across the cybersecurity community, demanding immediate attention and patch prioritization. Monitoring these emerging and widely discussed threats provides valuable insights, enabling organizations to make informed security decisions and strengthen their overall defense posture.

CVE-2026-21589 - Files or Directories Accessible to External Parties vulnerability in Atlassian Multiple Products

A Files or Directories Accessible to External Parties vulnerability in multiple Atlassian Data Center products, including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, and Crucible and Fisheye, could allow an unauthenticated attacker to access specific files within the web application root directory, and all versions of each product are affected. According to watchTowr, the flaw stems from the shared atlassian-plugins-webresource library, where the unescapeSlashes() function in Router.java converts double colons (::) into forward slashes and the sanitization routine splitLastPathPart() fails to stop traversal sequences written as “..::”, letting a single unauthenticated request to the /resources/ or /sources/ routes, such as one targeting Jira’s color-picker-popup resource, return protected files like WEB-INF/web.xml. In deployments integrated with Atlassian Crowd, the file read can be escalated to full administrative takeover by retrieving the plaintext application password from WEB-INF/classes/crowd.properties, using it to call the Crowd REST API, and adding a new account to the jira-administrators group. watchTowr released a Python proof-of-concept for the full chain, and Previdian detected exploitation attempts on its honeypot network just hours after the technical report was published. Atlassian has released fixes in Bitbucket Data Center 9.4.26, 10.2.8 and 10.5.1; Confluence Data Center 9.2.26 and 10.2.19; Jira Service Management Data Center 5.12.40, 10.3.26 and 11.3.12; Jira Software Data Center 9.12.40, 10.3.26 and 11.3.12; Bamboo Data Center 10.2.24 and 12.1.12; Crowd Data Center 6.3.7, 7.0.3, 7.1.7 and 7.2.4; and Crucible and Fisheye 4.9.15, and the flaw was recently added to the CISA KEV catalog following the release of the technical details.

CVE-2026-25243 - Invalid Memory Access vulnerability in Redis RESTORE

An Invalid Memory Access vulnerability in the Redis RESTORE command, affecting all Redis versions before 8.6.3, could allow an authenticated attacker with permission to run RESTORE to achieve remote code execution in the context of the Redis server. The flaw arose because RESTORE, which rebuilds a key from serialized data, did not fully validate the values in that data, so a crafted payload triggered invalid memory access. Redis disclosed the flaw in May 2026, and Wiz Research’s Emil Lerner and researcher Joseph Surin reported it. Defused’s honeypots recorded active exploitation on October 16-17, 2026, with repeated scripted attempts, including one attacker that hit a decoy five times on a timer with the same payload and ended each run by wiping the keyspace, destroying data and its own traces. Redis fixed the flaw in version 8.6.3, and blocking RESTORE via an ACL rule was the interim mitigation for unpatched servers.

CVE-2026-96656 - External Control of File Name or Path vulnerability in Plex Media Server

An External Control of File Name or Path vulnerability in Plex Media Server, affecting versions prior to 1.43.3.10861, lets an admin user write arbitrary files that may be executed on load, and it can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. Plex Media Server is software that users run on home servers or cloud hosts to stream personal media libraries, and it listens on port 32400, which is frequently exposed directly to the internet. In the Plex2Shell chain published by researcher code-zm on October 16, 2026, the stolen owner token was used to set the owner-writable TranscoderH264Options preference, abusing the x264 dump-yuv option to write an attacker-embedded shared object into the Codecs directory, which the bundled libavutil then loaded on the next transcode and executed as the plex user, with the PoC spawning a reverse shell. Exploitation in the wild was first recorded by a honeypot on October 17, 2026, one day after disclosure, and the vulnerabilities were used to deliver the “myawesomeproxy” backdoor and reverse proxy along with the “mylovelyminer” XMRig miner. Plex addressed the flaw in Plex Media Server version 1.43.3.10861, released on August 3, 2026, and urged users to update immediately; despite the fix being available for more than two months, the flaw was only recently added to the CISA KEV catalog, following public disclosure of the Plex2Shell exploit chain and confirmed in-the-wild exploitation.

CVE-2026-96655 - Server-Side Request Forgery vulnerability in Plex Media Server

A Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-96655) in Plex Media Server, affecting versions prior to 1.43.3.10861, lets an authenticated user request arbitrary internal or external addresses via the ‘/video/:/transcode/universal’ path parameter, and it can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656. In the Plex2Shell chain published by researcher code-zm on October 16, 2026, it was one of the four chained flaws used to achieve unauthenticated remote code execution, and in-the-wild exploitation was first recorded on October 17, 2026, one day after disclosure. Plex addressed the flaw in Plex Media Server version 1.43.3.10861, released on August 3, 2026, and urged users to update immediately; despite the fix being available for more than two months, the flaw was only recently added to the CISA KEV catalog, following public disclosure of the Plex2Shell exploit chain and confirmed in-the-wild exploitation.

CVE-2026-96654 - Improper Neutralization of Encoded URI Schemes in a Web Page vulnerability in Plex Media Server

An Improper Neutralization of Encoded URI Schemes in a Web Page vulnerability in Plex Media Server, affecting versions prior to 1.43.3.10861, could allow an attacker to call other plugins’ functions and supply their own parameters, and it can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. In the Plex2Shell chain published by researcher code-zm on October 16, 2026, the agent API’s identifier guard failed to halt execution, and the unsanitized identifier was spliced into an internal URL, where a “?” character opened a query string and a “#” character truncated the trailing path, enabling forged loopback calls to any plugin function. This primitive was used to invoke the GetResultFromNetwork function in the bundled TheTVDB metadata agent, which leaked the owner’s admin token and granted full administrative control without valid credentials. Following the public release of the technical details and a proof-of-concept exploit, a honeypot recorded in-the-wild exploitation on October 17, 2026, with the logged request matching this token theft stage, and the flaw was subsequently added to the CISA KEV catalog.

CVE-2026-96652 - Server-Side Request Forgery vulnerability in Plex Media Server

A Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-96652) in Plex Media Server, affecting versions prior to 1.43.3.10861, could allow an attacker using any X-Plex-Token value to include a full URL in the ‘protocol’ parameter and force the Plex server to POST to the attacker’s chosen destination, and it can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. In the Plex2Shell chain, this flaw served as the unauthenticated entry point: the /player/timeline endpoint only checked that an X-Plex-Token header was present without validating its value, so a junk token passed, and the callback URL for player subscriptions was built from attacker-supplied protocol, host, and port parameters. By registering a player, subscribing with a loopback URL injected into the protocol parameter, and then unsubscribing, an attacker forced the server to send a blind POST request to itself from a genuine 127.0.0.1 origin, which unlocked the trusted loopback-only agent API for the later stages. A honeypot recorded the first in-the-wild attempt on October 17, 2026, targeting the /player/timeline/subscribe endpoint with a loopback URL, and the activity came from several IP addresses, including 45(.)194.92.222, 91.92.40[.]202, and 176.65.139[.]228. Plex patched the flaw in Plex Media Server version 1.43.3.10861 on August 3, 2026 and urged users to update immediately, yet the fix had been available for more than two months before the flaw was recently added to the CISA KEV catalog.

CVE-2026-102764 - Authentication Bypass by Spoofing vulnerability in BeyondTrust Remote Support

An Authentication Bypass by Spoofing vulnerability in BeyondTrust Remote Support, affecting versions up to and including 26.2.3, stems from internal components failing to validate the origin of received messages, which could allow an unauthenticated remote attacker to perform file operations on the appliance. According to GTIG and Mandiant, exploitation resulted in arbitrary file upload via POST requests to /app_84304470%2Ephp, followed about 11 minutes later by the SAWFLY webshell (mangoapi.php), an obfuscated PHP webshell using a custom Base32 transport layer and RC4 encryption for C2, which executed supplied PHP code via @eval(). The attackers then copied /bin/sh to /usr/bin/dbus-authd with root ownership and SUID permissions for a persistent root backdoor, abused the bt-secrets utility to dump the appliance credential vault, and tunneled traffic through BARECLAW, a custom SOCKS5 tunneler exposed via a modified HAProxy configuration, before deleting logs to cover their tracks. A proof-of-concept (PoC) is available, and BeyondTrust released the BT26-05-RS patch on October 15, 2026 (applied to SaaS customers as of October 9, 2026, with self-hosted customers on versions older than 24.3.1 needing to upgrade first), while the flaw was recently added to the CISA KEV catalog.

CVE-2026-106931 - OS Command Injection vulnerability in EG Secure Solutions SiteGuard Server

An OS Command Injection vulnerability in the statistics feature of EG Secure Solutions SiteGuard Server Edition, a host-based WAF component enabled by default, allowed attackers to execute arbitrary OS commands with root or SYSTEM privileges on the affected server (versions 2.20 and later). SiteGuard is a WAF product line from Japanese vendor EG Secure Solutions, which claims protection for more than 1.5 million websites, while its WordPress plugin is active on more than 500,000 sites. Threat actors exploited the flaw in the wild, though neither the vendor nor the JVN advisory disclosed the attacker’s identity, the victims, the scale of the attacks, or the methods used. The vendor warned that patching could erase traces of compromise and advised administrators to download diagnostic information from the web management interface before updating. EG Secure Solutions has released fixes in SiteGuard Server Edition Ver8.00 Update 5 for Apache httpd, Nginx, and IIS, and Ver7.00 Update 6 for Apache httpd and Nginx on FreeBSD, and the flaw was recently added to the CISA KEV catalog.

CVE-2026-109618 - Out-of-Memory Memory Corruption vulnerability in PHP Core

An Out-of-Memory Memory Corruption vulnerability in PHP core affected PHP 8.2 to 8.5 releases before the fixed versions, and allowed an unauthenticated remote attacker to execute code as the web worker account. PHP used longjmp() to exit the current context and abort request handling on OOM errors, and a chain of weaknesses around this path left PHP’s memory in a corrupted state when a request ended abnormally, which the attacker turned into code execution. The flaw shared a root cause with CVE-2026-109619 but was reached through an OOM condition rather than stale global state, so unlike that flaw it was not a use-after-free. Amazon’s MadPot honeypots recorded the first exploitation attempt on October 17, four days before disclosure, multiple public PoC exploits appeared on October 21, and Cloudflare reported attack volumes rising from thousands to millions of attempts. PHP fixed the flaw in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and admins were told to restart all workers after upgrading.

CVE-2026-109619 - Heap Use-After-Free vulnerability in PHP Core

A Heap Use-After-Free vulnerability in PHP Core affected PHP 8.2 to 8.5 releases before the fixed versions, and allowed an unauthenticated remote attacker to achieve memory disclosure and remote code execution across PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The flaw stemmed from PHP global state that temporarily pointed into request memory and was not cleared in some scenarios, which left stale references after an abnormal request end and enabled a heap use-after-free, with the disclosed memory used to support code execution. The PHP team rated mod_php the highest risk, since an unauthenticated request could trigger the attack before any application code ran. Amazon’s MadPot honeypots recorded the first exploitation attempt on October 17, four days before disclosure, multiple public PoC exploits appeared on October 21, and Cloudflare reported attack volumes rising from thousands to millions of attempts. PHP fixed the flaw in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with minimal source backports for PHP 7.4, 8.0 and 8.1.

CVE-2026-110936 - Uncontrolled Search Path Element Vulnerability in Siemens Software Center

An Uncontrolled Search Path Element vulnerability in Siemens Software Center, affecting versions prior to V4.0.9.8, could allow an authenticated local attacker to place a specially crafted DLL in a directory the application searches, leading to arbitrary code execution with the privileges of the affected application. Siemens Software Center is used to download, install, and activate purchased Siemens software, and its Siemens-signed Windows executable makes it a trusted carrier for DLL sideloading. Siemens reported in-the-wild abuse in which threat actors placed a crafted “archive.dll” alongside a genuine, signed copy of the executable, after a ClickFix lure tricked victims into running a PowerShell command that dropped an MSI installer (“AllMyBasic.msi”) via “msiexec.exe”, which launched “SiemensSoftwareCenter.exe” and sideloaded the DLL to deploy a remote access trojan (RAT). The activity was attributed to Romulus, a ClickFix delivery platform previously documented by Forescout delivering Legion Loader and other malware through DLL sideloading. Siemens has remediated the flaw in version 4.0.9.8, and the flaw was recently added to the CISA KEV catalog.  

CVE-2025-61624 - Path Traversal vulnerability in Fortinet Multiple Products

A Path Traversal vulnerability in multiple Fortinet products, including FortiOS 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2, 7.0 and 6.4, FortiPAM, FortiProxy and FortiSwitchManager, could allow an authenticated attacker with an admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. According to Unit 42, attackers exploited the flaw in the FortiOS CLI system.auto-script engine, where an unsanitized auto-script object name containing traversal sequences placed the script body at any file system location and executed it as root, allowing escalation from administrative access to root after the attackers had gained access by brute-forcing administrative and SSL/VPN passwords recovered from stolen FortiGate configurations. The attackers created an auto-script object named “../../../../setup” to drop the loader for PEERSTITCH, a memory-resident ARM64 malware injected into the miglogd and iked daemons via ptrace, and a second object, “../../tmp/apache2/conf/md-acme.conf”, to abuse the Apache mod_md ACME handler, which executed /bin/node and initiated a persistent SSH-based reverse shell. The attackers terminated miglogd and syslogd to halt logging and deleted the rogue accounts and auto-script objects after execution to cover their tracks. A proof-of-concept is available, and Fortinet addressed the flaw in FortiOS 7.4.10 and 7.6.5, FortiPAM 1.7.1, FortiProxy 7.4.12 and 7.6.5, and FortiSwitchManager 7.0.7 and 7.2.8 on April 14, 2026, with older branches requiring migration to a fixed release, yet the flaw was only now added to the CISA KEV catalog.

Cytellite telemetry captured active exploit attempts and mass scanning campaigns against exposed services globally. The data highlights which vulnerabilities are under attack and provides source IPs and payloads to authorized teams for detailed threat analysis and validation.

Active malware campaigns exploited specific vulnerabilities to deliver payloads and carry out post-exploitation actions. Each targeted vulnerability is proactively monitored, manually analysed, and mapped to MITRE ATT&CK tactics and techniques. Insights are derived from the LOVI vulnerability intelligence platform, which aggregates and curates data from multiple sources, OSINT groups, blogs, and data leak sites.

Multiple Ransomware Groups Exploit PAN-OS GlobalProtect Authentication Bypass vulnerability

According to Unit 42, ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) exploited CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway components of vulnerable PAN-OS versions, while public reporting attributed further exploitation to actors using Settra ransomware. The flaw was added to the CISA KEV catalog on May 13, 2026, and a public proof-of-concept (PoC) was released on May 29, 2026, with hard-coded client values such as “Microsoft Windows 10 Pro 64-bit” and an empty source user domain that defenders could hunt for in GlobalProtect logs. The attackers used the flaw for initial access, bypassed MFA to establish VPN sessions, performed reconnaissance with dual-use RMM tools, moved laterally via RDP and SMB, and staged tooling for credential harvesting, data exfiltration and ransomware deployment.  Unit 42’s investigations, ongoing since early June 2026, spanned industries including education, financial services, healthcare, manufacturing, government and energy, and the team advised organizations to apply the fixed PAN-OS version or available mitigations and to restrict management interfaces exposed on ports 4443 and 3879.

Myawesomeproxy: Proxyware Dropped via Plex2Shell Exploitation Alongside XMRig Miner

According to BoredHackerBlog, myawesomeproxy was a proxy malware dropped on a Plex Media Server honeypot on October 17, 2026, after exploitation attempts from 45[.]194[.]92[.]222, 91[.]92[.]40[.]202 and 176[.]65[.]139[.]228, and it was identified by the SHA-256 hash e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9. The malware was deployed alongside an XMRig cryptominer, with the follow-on payloads downloaded from 217[.]60[.]194[.]116. On execution, it printed a notice stating that running the software meant agreeing to the potential external use of the device’s internet traffic, which points to proxyware that relays third-party traffic through the infected host. The researcher noted that Plex servers are often hosted on residential IP addresses, which makes them valuable as proxy nodes for reaching corporate VPNs and email. The malware’s network activity was tied to proxystream[.]st, a domain the researcher linked to a Bitsight report on the AISURU botnet. The researcher did not fully analyze the sample but published it on GitHub, along with ANY.RUN and Triage sandbox reports.

ARMORY CASTLE Zero-Day Exploitation of BeyondTrust Remote Support

According to Google Threat Intelligence Group (GTIG) and Mandiant, ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221, exploited CVE-2026-102764 in BeyondTrust Remote Support appliances as a zero-day in late August 2026, well before the October 15, 2026 disclosure. After exploitation, the actor staged the SAWFLY webshell (mangoapi.php) in the Laravel web root, then copied /bin/sh to /usr/bin/dbus-authd with root ownership and the SUID bit to gain root, and dumped the credential vault with the native bt-secrets utility. For persistence, the actor placed a zz-root-persist script in the post_boot.d startup directory that appended a passwordless sudo entry to sudoers.template and rebuilt /etc/sudoers with bt-sysconfig, so access survived reboots and configuration resets. The actor then tunneled traffic through BARECLAW, a custom C-based SOCKS5 tunneler that listened on TCP port 19800 with token authentication and XOR obfuscation, and exposed it through a HAProxy ACL matching the /uidchanarge path while the listener stayed hidden from external scans. The actor also raised a compromised administrator account’s Jump Item and Team permissions to Administrator, used file transfer to exfiltrate internal documents such as software inventories, and deleted logs throughout the intrusion, and GTIG warned of possible widespread exploitation following disclosure, consistent with the group’s past behavior.

CL-STA-0954 Exploited FortiManager and FortiOS Flaws to Deploy Stealthy PEERSTITCH Implant

According to Unit 42, a threat cluster tracked as CL-STA-0954 (also known as UNC5820) exploited CVE-2024-47575, a missing authentication flaw in FortiManager, to breach a telecommunications managed service provider in September 2024, registering a rogue FortiGate device and exfiltrating configurations, credentials and cryptographic material for more than 500 managed firewalls. Using the stolen credentials, the attackers later exploited CVE-2025-61624, a path traversal flaw in the FortiOS CLI auto-script engine, to escalate to root and deploy PEERSTITCH, a novel memory-resident ARM64 implant that injected code into the miglogd and iked daemons through ptrace. PEERSTITCH left no persistent binary on disk, opened no listening ports and made no outbound connections, instead building a covert inter-process communication bridge between the two daemons and hiding in traffic generated by legitimate processes to evade endpoint and network detection. The same auto-script flaw also let the attackers abuse the Apache mod_md module to establish a persistent SSH reverse shell, while log tampering and configuration rollbacks erased traces of the activity.

Open-Source Software (OSS) vulnerabilities are security weaknesses discovered in publicly available codebases that can be exploited across widely used libraries, frameworks, and tools, often impacting thousands of downstream applications.

PRE-NVD vulnerabilities refer to security flaws that are discovered, discussed, or even exploited in the wild before their official inclusion in the National Vulnerability Database (NVD). These early-stage vulnerabilities often emerge through threat actor chatter, exploit proof-of-concepts, and technical disclosures shared across social media platforms and underground forums, signaling potential exploitation risks before public awareness.

This week showed how quickly the gap between disclosure and exploitation is closing. Attackers moved within hours of public PoCs, and in the PHP2Shell case days before disclosure, while older flaws such as the Fortinet and Plex vulnerabilities were still being used against unpatched systems. Edge appliances, remote access tools and core web technologies remained the favored entry points, and attackers followed them with stealthy implants, webshells, proxyware and ransomware. Organizations should prioritize patching the newly listed KEV vulnerabilities, restrict exposure of internet-facing services, and hunt for post-exploitation activity rather than relying on the patch alone. Stay ahead of the next wave with Loginsoft Vulnerability Intelligence (LOVI), which tracks exploited vulnerabilities and gives security teams the context they need to prioritize and respond.

FAQs

Q1. What is PEERSTITCH malware?

PEERSTITCH is a stealthy, memory-resident implant that targets FortiGate firewalls by injecting code into the miglogd and iked daemons. It leaves no persistent file on disk, opens no listening ports and makes no outbound connections. Instead, it hides commands inside traffic handled by legitimate processes, which makes it extremely difficult to detect.

Q2. What should organizations do when a vulnerability has no patch available?

When no patch exists, organizations should reduce exposure by restricting access to affected management interfaces through trusted IP allowlists or VPN connections. Security teams should actively hunt for signs of compromise, such as unexpected files, suspicious processes or unusual outbound traffic. Once the vendor releases a fix, it should be applied immediately and its effectiveness verified.

Q3. Does inclusion in the CISA KEV catalog mean exploitation is widespread?

Not necessarily widespread - but confirmed. KEV inclusion indicates verified in-the-wild exploitation. While the scale may vary, the operational reality is that threat actors possess working exploits, making patch prioritization urgent regardless of observed targeting volume.

Q4. How does LOVI help organizations manage vulnerabilities effectively?

Loginsoft Vulnerability Intelligence empowers you to efficiently prioritize and respond to potential vulnerabilities by focusing on those actively exploited in the wild. LOVI correlates vulnerability data with real-world threat activity to reduce noise and improve decision-making. This approach enables faster remediation and stronger security posture.

Q5. What is Cytellite?

Cytellite is a Loginsoft security intelligence platform that provides real-time visibility into emerging threats through a global sensor network. It delivers actionable IP intelligence to help organizations detect, analyze, and respond to attacks quickly. By correlating threat data with live activity, Cytellite strengthens resilience across dynamic threat landscapes.