PEERSTITCH Malware and FortiOS: What UK Organisations Running Fortinet Should Do Now

The Hacker News reported on 16 October 2026 that a suspected advanced threat actor has been observed exploiting a path traversal vulnerability in Fortinet FortiOS to deploy a previously unknown malware called PEERSTITCH. The vulnerability, CVE-2025-61624, affects FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, and allows attackers to bypass checks on tagged VPN sessions. PEERSTITCH is described as an ARM64 memory-resident implant — it operates entirely in memory rather than writing files to disk, which significantly reduces its visibility to conventional file-based endpoint detection tools. The activity has the hallmarks of a deliberate and targeted campaign rather than opportunistic scanning.

Why this matters for UK organisations

Fortinet products are widely deployed across UK enterprise and public sector environments as perimeter security, VPN and network access control infrastructure. A memory-resident implant delivered through a VPN-related vulnerability is a particularly concerning combination: it targets the systems organisations rely on to manage and control remote access, and it does so in a way specifically designed to avoid leaving traces that standard security tooling would detect. The path traversal flaw in the command line interpreter also represents a less obvious attack surface than the most commonly discussed vulnerability classes, which may mean it has received less attention in patching prioritisation. For organisations that have already patched CVE-2025-61624, the memory-resident nature of PEERSTITCH means that devices exposed before patching was completed may warrant further investigation even if they now appear clean.

What to review

Confirm that CVE-2025-61624 has been patched across your entire Fortinet estate, including FortiOS, FortiPAM, FortiProxy and FortiSwitchManager deployments. Do not limit this check to internet-facing devices — internal deployments should be included in scope. Given that PEERSTITCH is memory-resident and designed to evade file-based detection, review network telemetry, VPN session logs and authentication records for anomalous activity, particularly on devices that may have been internet-exposed before patching was completed. Consider whether your current detection capabilities include behavioural or network-based monitoring that would identify unusual activity from network appliances, and ensure that Fortinet device management is included in your vulnerability management programme with appropriate prioritisation.

Source: The Hacker News