Security2 hOctober 16, 2026, 11:59

PEERSTITCH malware delivered via FortiOS flaw CVE-2025-61624

An advanced threat actor is exploiting CVE-2025-61624 (CVSS 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, to deliver a previously unreported memory-resident ARM64 malware called PEERSTITCH. The attack bypasses checks on tagged VPN sessions.

The Hacker News

Open source

PEERSTITCH malware delivered via FortiOS flaw CVE-2025-61624

CVE-2025-61624 is a path traversal flaw in the FortiOS command line interpreter
FortiOS, FortiPAM, FortiProxy and FortiSwitchManager are affected
PEERSTITCH is an ARM64 memory-resident malware that bypasses checks on tagged VPN sessions

#Fortinet#FortiOS#PEERSTITCH

Forescout finds ROMULUS server delivering malware via ClickFix

Security

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Security

Unit 42 uncovers PEERSTITCH implant: configs of 500+ FortiGate devices stolen

Security

PEERSTITCH malware delivered via FortiOS flaw CVE-2025-61624

Forescout finds ROMULUS server delivering malware via ClickFix

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Unit 42 uncovers PEERSTITCH implant: configs of 500+ FortiGate devices stolen

983,992 FortiGate Instances Found as CVE-2025-25249 Hits CISA KEV