Ivanti Zero-Day & FortiGate Implant UK SMB Oct 2026 | SBCSG

This is your Daily Threat Analysis for the 15th of October 2026.

Three items today. Two are about edge devices being used as doors that attackers walk through quietly and leave no trace behind. The third is a UK government data breach story that has just become considerably worse. All three have direct implications for small and medium-sized businesses, and in each case the official record leaves out something operationally significant.

Ivanti Connect Secure: A Three-Zero-Day Chain, Root Access, No Credentials Required

Ivanti has issued emergency security updates for Connect Secure VPN appliances after attackers exploited a chain of three zero-day vulnerabilities to gain root-level access without any authentication. The earliest confirmed attack targeting this chain began on the 3rd of October 2026, against an appliance running version 22.8R2.4.

The two primary vulnerabilities are both tracked under CVE-2026-104935, assessed at a CVSS score of 8.6. One involves an authentication bypass; the other enables remote code execution via CGI exploitation. The third vulnerability in the chain enables privilege escalation to root. Together, they give an unauthenticated remote attacker complete control of the appliance.

What the emergency notice does not dwell on: Ivanti Connect Secure appliances are widely deployed by managed service providers and IT resellers to provide remote access for their client base. A compromised VPN concentrator is not an isolated incident, it is a vantage point into every network behind it. If your IT provider manages your remote access and uses Ivanti Connect Secure, the question of whether they have applied the emergency update is not a question for next month’s review meeting.

Ivanti has had a difficult run with its VPN products since the authentication bypass disclosures in early 2024. The TTPs here, authentication bypass chained with privilege escalation on a perimeter appliance, are consistent with the approaches used against Ivanti products in prior campaigns. The speed of exploitation, from appliance version to confirmed attack in a matter of days, suggests this chain was not discovered and disclosed simultaneously. Someone knew about it before Ivanti did.

What to do:

If your organisation runs Ivanti Connect Secure, apply the emergency patches immediately. Do not wait for a scheduled maintenance window.
If your IT provider manages your remote access infrastructure, contact them today and ask for written confirmation that the patches have been applied and the appliance integrity has been verified.
Ivanti provides integrity checking tools for its appliances. Use them. A patched appliance that was compromised before patching is not a clean appliance.
Review VPN authentication logs for activity in the window from the 3rd of October 2026 onwards. Unusual authentication patterns, particularly from unexpected source IPs or at unusual hours, warrant investigation.

PEERSTITCH: The FortiGate Implant That Standard Logging Will Not Find

Unit 42 has published analysis of a sophisticated intrusion campaign that began in September 2024. An attacker exploited CVE-2024-47575, the FortiManager authentication bypass that generated significant coverage at the time, to access a FortiManager appliance and exfiltrate configurations and cryptographic material for more than 500 managed FortiGate firewalls.

That is the part that was reported. What happened next has taken until now to be fully documented.

Using CVE-2025-61624, the attackers then deployed PEERSTITCH: a memory-resident implant built for ARM64 architecture. It leaves no files on disk. It generates no network traffic that appears in standard firewall logs. It survives reboots through boot persistence mechanisms while simultaneously manipulating watchdog processes to avoid detection. It converts the compromised firewall into a remotely controlled proxy node.

This matters for a specific reason. When CVE-2024-47575 was disclosed, the security industry response was what it usually is: patch, check for indicators of compromise, move on. Many organisations will have done exactly that and concluded they were clean. The PEERSTITCH analysis suggests that for some of those organisations, the intrusion had already progressed to a second stage that the standard compromise checks would not have caught. The implant targets telecommunications organisations in the reporting, but the underlying technique, compromise a management appliance, pivot to every device it manages, deploy persistent memory-resident malware, is not sector-specific.

The advisory attributes the initial access to CVE-2024-47575. What it does not say in plain terms is that the combination of a management plane compromise with 500-device lateral movement represents a supply chain attack conducted entirely through legitimate network management infrastructure.

For UK SMBs, the practical concern is this: Fortinet is one of the most widely deployed firewall vendors in the UK SMB and mid-market space. Many of those deployments are managed by MSPs running FortiManager. If your MSP was running a vulnerable version of FortiManager in the September to October 2024 window and did not conduct a forensic integrity check of their managed FortiGate fleet at the time, the question of whether PEERSTITCH or a variant was deployed to your firewall is not one you can answer by looking at your firewall logs.

What to do:

Ask your IT provider or MSP whether they use FortiManager to manage your Fortinet firewall.
If they do, ask them specifically whether they conducted an integrity check of managed FortiGate appliances following the CVE-2024-47575 disclosure in late 2024.
A memory-resident implant with no disk artifacts requires memory forensics or firmware integrity verification to detect, not log review. If your provider is telling you their logs look clean, that is not the same as telling you the device is clean.
CVE-2025-61624, used to deploy PEERSTITCH in this campaign, should have been patched. Verify it has been.

Legal Aid Agency: 48 Years of Records, and the Numbers Keep Getting Worse

The Legal Aid Agency breach, which has been running as a story since earlier this year, has reached a new milestone in how bad it is. Reporting today confirms that hackers made off with records dating back to 1978, nearly 50 years of data, with probation service records also confirmed as part of the haul.

The reason this sits in a threat analysis for UK SMBs rather than in a government IT story is straightforward. Legal services firms, solicitors, barristers’ clerks, legal aid practitioners, are precisely the kind of small professional services business that this platform covers. If your firm has ever provided legal aid services, or if you process data for clients who have been through the legal aid system in any capacity in the last four-and-a-half decades, you have an interest in understanding the scope of what was taken.

What the coverage does not say in direct terms: the inclusion of probation service records means this breach touches some of the most sensitive personal data categories that exist, criminal justice records, rehabilitation information, the kind of data that creates genuine personal safety risks if it ends up in the wrong hands or is used for targeted fraud and social engineering. The people whose data was taken are not in a position to do much about it. The organisations that work with them are.

This also sits alongside a pattern in UK public sector data security that is, frankly, not improving. When a government agency holds 48 years of records in a system that can be breached and exfiltrated, the question is not just what happened. It is what the security posture of that system looked like in 1978, in 1995, in 2010, and whether data that was never designed to be held digitally in a connected environment was ever properly secured when it was migrated.

What this means for legal services SMBs:

If your firm holds data on clients who may be in the Legal Aid Agency dataset, and given the scope, that is a broad category, consider whether your own data handling practices create additional exposure points.
Be alert to social engineering approaches that may use legitimately obtained personal data from this breach to impersonate clients, officials, or legal contacts. The data held is detailed enough to make highly convincing pretexting attempts.
If you receive requests that seem unusually well-informed about client history or case details, verify identity through a known channel before acting.

A Note on the NCSC’s TLS Guidance Update

Today also saw the NCSC publish updated guidance on post-quantum cryptography in TLS, accompanied by a revised technical guidance document on using TLS to protect data. The guidance now recommends beginning migration to post-quantum cipher suites in TLS configurations.

This is not an emergency item for most SMBs today. It is a planning item. The NCSC is not publishing this because quantum computers are decrypting your traffic this afternoon. They are publishing it because the migration takes time, because some of the algorithms being deprecated are already considered at risk from harvest-now-decrypt-later attacks by well-resourced state actors, and because organisations that leave this to the last moment will find themselves in the same position as organisations that left TLS 1.0 deprecation to the last moment.

If you manage your own web services, email infrastructure, or VPN termination, it is worth reviewing the updated NCSC TLS guidance now and understanding what changes your stack will need to make.

Sources

Source	Title	URL
op-c.net	Ivanti CVE-2026-104935: Zero-Day Chain Exploited in Operation Innovate	https://op-c.net/blog/ivanti-cve-2026-104935-zero-day-rce-exploit/
Palo Alto Unit 42	PEERSTITCH, a Stealthy FortiGate Implant	https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
The Register	Legal Aid Agency hackers made off with records dating back to 1978	https://www.theregister.com/security/2026/10/15/legal-aid-agency-hackers-made-off-with-records-dating-back-to-1978/5303243
NCSC	Post-quantum updates to our TLS guidance	https://www.ncsc.gov.uk/blogs/post-quantum-updates-to-our-tls-guidance
NCSC	Using TLS to protect data	https://www.ncsc.gov.uk/guidance/using-tls-to-protect-data
PolySwarm	ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure	https://blog.polyswarm.io/clingstun-turns-vulnerable-edge-devices-into-attacker-infrastructure

If Threat Analysis is useful to you, follow the show wherever you listen, tomorrow’s briefing will land automatically. And if you know someone who manages IT for a small firm, or who runs a legal practice and hasn’t thought hard about security in a while, pass this to them. The Legal Aid Agency breach alone gives you a reason.