Cyber Brief: PwnEscape, NCSC TLS, Spyware Ads, FortiOS

Today's stories reflect a broad but connected theme: the security of foundational infrastructure that UK organisations rely on every day. From the encryption protocols protecting data in transit, to the hypervisors running cloud workloads, to the network appliances guarding perimeter access, and the advertising networks that reach devices without any user interaction — each of these developments is a prompt to review whether the basics are in good shape before more complex threats arrive.

NCSC Updates TLS Guidance to Reflect Post-Quantum Cryptography Requirements

The National Cyber Security Centre has published updated guidance on configuring TLS to incorporate post-quantum cryptography, marking a significant step in the UK's preparation for the era of quantum computing. Published on 15 October 2026, the NCSC's updated recommendations set out specific TLS profiles for the most common versions and deployment scenarios, and explicitly state that now is the time to begin migration. The guidance covers how to handle older TLS versions and provides a practical framework for organisations working through the transition. This is a direct signal from the UK's national technical authority that post-quantum readiness is no longer a future consideration — it is a present one.

For UK businesses, this matters because TLS underpins the security of almost every digital interaction — from web applications and APIs to internal services and partner integrations. The concern with quantum computing is that sufficiently powerful quantum machines could, in time, break the asymmetric cryptography that current TLS implementations depend on. While that threat is not immediate, the NCSC's guidance reflects the reality that cryptographic migrations take years to complete across complex environments. Organisations that begin planning now will be far better positioned than those that wait. This is particularly relevant for sectors handling sensitive or long-lived data, including finance, healthcare, legal services and government.

Why it matters

For UK organisations, this is a prompt to review your current TLS configurations against the NCSC's updated profiles and to begin scoping what a post-quantum migration would involve across your environment. Start by identifying where TLS is in use, which versions are deployed, and who owns the cryptographic configuration decisions in your organisation.

Source: NCSC UK

PwnEscape Linux Kernel Flaw Allows Guest VMs to Read Host Memory

A newly disclosed vulnerability in the Linux kernel, tracked as CVE-2026-99999 and nicknamed PwnEscape, allows code running inside a virtual machine to read memory on the underlying host system. Reported by The Hacker News on 16 October 2026, the flaw sits in the Linux kernel's networking code rather than in any specific cloud provider's configuration, meaning it is not limited to a single platform. A researcher demonstrated the vulnerability against Vercel's live cloud sandboxes, and Vercel confirmed the finding. The flaw is described as critical and affects the shared infrastructure model that underpins a wide range of cloud and virtualised environments.

The significance of this vulnerability for UK organisations lies in the shared-tenancy model that most cloud infrastructure depends on. If a workload running in one virtual machine can read memory from the host, it could potentially access data belonging to other tenants or the host environment itself — including credentials, encryption keys, or sensitive application data. This is not a theoretical concern: the demonstration against a live cloud environment confirms the flaw is exploitable in practice. Organisations running Linux-based virtualised infrastructure, whether on public cloud, private cloud or on-premises hypervisors, should treat this as a priority review item. Cloud providers are expected to patch at the infrastructure level, but organisations running their own Linux-based virtualisation stacks will need to act directly.

Why it matters

For organisations running Linux-based virtualised or cloud infrastructure, this is a prompt to check with your cloud providers and infrastructure teams about patch status for CVE-2026-99999. If you manage your own Linux hypervisors or virtualisation hosts, prioritise kernel patching and review your exposure. Confirm with your cloud providers what mitigations are in place at the platform level.

Source: The Hacker News

Zero-Click Spyware Delivered via Online Advertising, Citizen Lab Finds

Researchers at Citizen Lab, the digital investigations unit at the University of Toronto, have published findings showing that an Israeli advertising agency, Discover-Tech, has been serving online adverts that enable zero-click spyware deployment against targets. Reported by The Guardian on 15 October 2026, the research identifies Discover-Tech's Controlium software as the tool used to mass-profile internet users before covertly compromising selected devices. Citizen Lab says it believes dozens of devices at Qatari broadcaster Al Jazeera were compromised through this method. Critically, zero-click attacks require no interaction from the target — the device is compromised simply by being shown the advert.

For UK organisations, this development is significant for several reasons. It demonstrates that the online advertising ecosystem — a channel that reaches virtually every internet-connected device — can be weaponised to deliver sophisticated spyware without any user action. While the confirmed targets in this research are high-profile media and government figures, the underlying technique is not inherently limited to those groups. Executives, legal teams, journalists, and others handling sensitive information are realistic targets. The use of commercial advertising infrastructure also makes this type of attack harder to detect and block through conventional endpoint controls, since the delivery mechanism is a routine part of normal web browsing.

Why it matters

For UK organisations, this is a prompt to review mobile device management policies for high-risk individuals, including executives and those handling sensitive or confidential information. Consider whether ad-blocking or content filtering controls are in place on managed devices, and ensure that mobile security is included in your broader device management strategy rather than treated as a lower priority than desktop endpoints.

Source: The Guardian

PEERSTITCH Malware Exploits FortiOS Path Traversal Flaw in Targeted Attacks

A suspected advanced threat actor has been observed exploiting a path traversal vulnerability in Fortinet FortiOS to deploy a previously unknown memory-resident malware called PEERSTITCH, according to reporting by The Hacker News published on 16 October 2026. The vulnerability, CVE-2025-61624, affects FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, and allows attackers to bypass checks on tagged VPN sessions. PEERSTITCH is described as an ARM64 memory-resident implant, meaning it operates in memory rather than writing files to disk, which makes it harder to detect through conventional endpoint scanning. The attack chain suggests a deliberate and targeted campaign rather than opportunistic exploitation.

Fortinet products are widely deployed across UK enterprise and public sector environments as perimeter security and VPN infrastructure. A memory-resident implant delivered through a VPN-related vulnerability is a particularly concerning combination: it targets the very systems organisations rely on to control remote access, and it does so in a way designed to avoid leaving traces on disk. The use of a path traversal flaw in the command line interpreter also suggests that attackers are probing for less obvious entry points beyond the most commonly patched vulnerability classes. Organisations that have not yet applied patches for CVE-2025-61624 across their Fortinet estate should treat this as a priority, and those that have patched should consider whether any indicators of compromise warrant investigation.

Why it matters

For organisations running Fortinet FortiOS, FortiPAM, FortiProxy or FortiSwitchManager, confirm that CVE-2025-61624 has been patched across your estate. Given the memory-resident nature of PEERSTITCH, also consider reviewing network telemetry and VPN session logs for anomalous activity, particularly on devices that may have been exposed before patching was completed.

Source: The Hacker News

Today's Key Actions

• Review your current TLS configurations against the NCSC's updated post-quantum guidance and begin scoping what a cryptographic migration would involve across your environment, starting with services handling the most sensitive data.
• Check with your cloud providers and infrastructure teams about patch status for CVE-2026-99999 (PwnEscape). If you manage your own Linux-based virtualisation hosts, prioritise kernel patching as a matter of urgency.
• Review mobile device management policies for executives and other high-risk individuals, and confirm whether ad-blocking or content filtering controls are in place on managed mobile devices.
• Confirm that CVE-2025-61624 has been patched across all Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager deployments, and review VPN session logs for any indicators of anomalous activity.
• Confirm that clear ownership exists for each of these areas — cryptographic configuration, cloud infrastructure patching, mobile device security and network appliance management — so that review actions can be assigned and tracked effectively.

Secarma Insight

Today's stories are a useful reminder that security risk does not always arrive through novel or exotic attack methods — it often accumulates quietly in the infrastructure that organisations have been running for years without revisiting. Encryption configurations, hypervisor patches, mobile device policies and network appliance updates are all areas where the gap between what is deployed and what is current can widen gradually and without obvious warning signs. The organisations that manage these risks most effectively tend to be those with clear ownership, regular review cycles and a habit of acting on guidance from trusted sources like the NCSC before an incident forces the issue. Building and maintaining that discipline is what makes the difference between a manageable situation and a difficult one.