Front Page

Edge Device Intrusion

Clean Integrity Check, Compromised Appliance: Chained Ivanti Zero-Days Left Almost Nothing on Disk to Find

Volexity published its analysis on October 13 of a chain against Ivanti Connect Secure that produces unauthenticated root-level command execution. CVE-2026-104935 covers an authentication bypass — a request to the public welcome.cgi naming a protected script in the X-DSCGI-PATH header reaches it without credentials — together with a race-condition file write in wu.cgi, where an upload lands on disk before validation and is executed in the window before deletion. A third flaw, privilege escalation through the dsinvoked broker trusting DSCache configuration data, has no CVE and no fix yet. Exploitation began October 3 against a fully patched appliance; Ivanti patched on October 13, the day CISA added the CVE to KEV. Volexity attributes the activity to a previously unknown actor, UTA0576.

No web shell, backdoor or first-stage binary was deployed: commands and their output travelled inside the exploit's own HTTPS requests. The payload truncates /home/runtime/dlogs/debuglog and /var/log/audit/audit.log across the targeted window, deletes its own scripts, restores the modified DSCache entry and keeps the library patch in memory only, so Ivanti's Integrity Checker Tool reports no modification at all. Forensic priority: treat a clean integrity check as no evidence. Memory acquisition from the live appliance recovered the operator tooling, output and packet captures; look for /data/.icscap/ holding cap* files and a renamed tcpdump running as dsstatmond, and web logs where the request path and the X-DSCGI-PATH header disagree. Post-exploitation took LDAP credentials, LAPS passwords and BitLocker recovery keys, so scope the domain, not the box.

Forensic Capability

Keeping Pace With the Evidence: Europol and the Commission Publish a Gap Analysis of EU Digital Forensics

On October 16 the European Commission, working with Europol, published Digital Forensics: Gap Analysis, an assessment of digital forensic capability across the member states mandated under the June 2025 Road Map on lawful access to data. Its central finding is that authorities are short of both resources and skills and are struggling to keep pace with new technologies, that capability varies widely between member states, and that commercial tooling is expensive and ages quickly. The priority areas it names are standardisation and interoperability of tooling, cloud, IoT and vehicle forensics, AI within legal limits, and training gaps reaching beyond examiners to first responders and legal professionals.

The report asks for sustained investment and closer cooperation between law enforcement, researchers, tool developers and manufacturers — and it lands in a week that demonstrates the gap in practice. An intrusion that leaves no file on disk, no listening port and a truncated audit log is provable only by someone equipped and trained to acquire volatile memory from a vendor appliance before it is rebuilt. Forensic priority: read the gap analysis as a procurement and training argument you can cite. The capability it calls unevenly distributed — memory forensics, appliance acquisition, tool validation — is exactly what this week's two intrusion stories demand, and its absence is the difference between a finding and an assumption.

Threat Bulletin

Active Exploit

CVE-2026-21589 — Atlassian Data Center. Files accessible to external parties (CWE-552) lets an unauthenticated attacker read files from the web root, though only at a known exact path. CVSS 9.3, across eight self-hosted products including Confluence, Jira, Bitbucket and Crowd; Cloud tenants are unaffected. Honeypots saw exploitation within hours of watchTowr's write-up, and in Crowd SSO deployments the read can be leveraged into administrator takeover. CISA KEV October 15. Forensic Note: A file read raises no application audit event, so the web and proxy access logs are the only record — and they must be pulled from every cluster node, Bitbucket mirrors included.

Critical

CVE-2026-102764 — BeyondTrust Remote Support. Improper origin validation (CWE-290) in an internal messaging component allows a remote attacker to perform file operations on the appliance; CVSS 9.3, advisory BT26-05 of October 15, KEV October 16. CISA reports actors using it for initial access and then persisting, escalating and moving laterally, and Mandiant ties the activity to a suspected PRC-nexus group with compromises dating to August 29. Forensic Note: Disclosure trails first exploitation by about seven weeks, longer than many appliances retain logs — collect appliance logs and session recordings before patching, then rotate every credential it could reach.

Malware Spotlight

PEERSTITCH — The Firewall Implant With No File, No Port and No Callback

Unit 42 research this week details a memory-resident ARM64 implant on FortiGate firewalls, used by the cluster it tracks as CL-STA-0954 against a telecom managed service provider, from which more than 500 firewall configurations were exfiltrated. The actor reached FortiManager first through FortiJump (CVE-2024-47575), then deployed the implant using CVE-2025-61624, a FortiOS auto-script path traversal fixed in April 2026 and added to KEV on October 16. PEERSTITCH leaves no persistent binary, opens no listening port and makes no outbound connection, running instead inside the miglogd and iked daemons by manipulating their memory via ptrace. Forensic Note: A disk image of the appliance will show nothing, so capture process memory before any reboot, and hunt auto-script object names containing ../ sequences.