Attackers are abusing a Fortinet FortiOS path traversal bug, tracked as CVE-2025-61624, to drop a new memory-resident ARM64 malware called PEERSTITCH. If you run FortiOS, FortiPAM, FortiProxy, or FortiSwitchManager, you should check your current firmware against Fortinet advisories and review VPN session logging for odd tagged traffic.
A critical Linux kernel flaw nicknamed PwnEscape (CVE-2026-99999) lets code inside a VM read memory on the host, and a researcher showed it working against Vercel’s live cloud sandboxes. If you host Linux VMs, you should track vendor kernel updates, ask cloud providers about their patch status, and treat shared lab or sandbox environments as higher risk until fixed.
Citizen Lab reports that Candiru spyware hit Al Jazeera devices through ordinary online ads that ran hidden zero click exploits as soon as the ad loaded. This is a reminder to keep browser and OS patches tight, consider stricter ad and script blocking on high risk roles, and limit unmanaged browsing on work devices.
The threat actor Silent Lynx used four infection chains, including macro documents, PS2EXE downloaders, GitHub hosted PowerShell, and crafted WinRAR archives, to hit CIS government bodies according to researchers. Even if you are not a government target, it is a good time to review macro policies, tighten PowerShell logging, and push WinRAR and similar tools to current versions.
The UK Ministry of Defence has put a new SIEM and security analytics platform into service with Centerprise and Elastic at a key moment for national security. For smaller teams, the lesson is to keep tuning whatever SIEM or logging stack you have so it fits your real alerts and does not become noise.
Need IT support that just works? Email hello@icthero.co.uk or talk to us.