FIELD LOG 038

The Story

This week the gear sitting in people's own racks and closets did the attacking. A NAS, a camera recorder, a file server, a firewall, a support appliance, and a government records system, each one turned into someone else's tool. Six of them, worst for a home lab first, then the nation state and enterprise jobs, then the breach that lands in a mailbox. One thread runs through all of it, and I put it at the end.

One. Your router and your NAS are being rented out from under you. A campaign reported on 16 October is quietly installing Pawns.app, a legitimate bandwidth-sharing program, onto gear the owner never touched it on. The box becomes a residential proxy node that somebody else sells access to, so your home address is the one attached to whatever a stranger does through it. The way in is a spread of known holes: D-Link ShareCenter NAS boxes through CVE-2024-3272 and CVE-2024-3273, Ubiquiti UniFi Video NVRs through CVE-2021-44228, which is Log4Shell and is five years old, and SAP NetWeaver Visual Composer through CVE-2025-31324. Hikvision and Dahua DVRs and NVRs were hit too, though the specific flaws were not named. At least 143 devices across 34 countries, and the attackers also dropped their own SSH keys for a way back in.

Two. Rejetto HFS, CVE-2026-61500, a 9.3, under active attack. This is the small HTTP File Server a lot of home labs use to hand a file to someone quickly. At login it handed unauthenticated clients the output of its session cookie generator, and it built the key that signs those cookies from the very same generator. The generator is xorshift128+, which is not cryptographic and whose output can be run backward. Collect a handful of login responses, reconstruct the generator's internal state, recover the signing key, forge an administrator cookie, and you have remote code execution through the server_code configuration feature. It was found in June by Horizon3.ai using Anthropic's Mythos model, which reasoned that the random-looking output could be reversed. The fix is HFS 3.2.1, released 13 July. On 2 October VulnCheck reported the first attacks: small-scale reconnaissance from a China Telecom address against canary systems in Japan and the United States.

Three. FortiBleed, and your firewall's old password is still crackable after you patched it. Identified in mid June and still an open exposure. Attackers pulled configuration files off internet-facing FortiGate firewalls and cracked the administrator password hashes stored inside them. Working administrator credentials now exist for somewhere between 30,000 and 75,000 devices across 194 countries. SOCRadar validated credentials for 30,791 devices; Kevin Beaumont and Hudson Rock put it closer to 75,000, about half of every internet-facing Fortinet firewall Shodan can see. The mechanism is the part worth keeping: Fortinet moved to PBKDF2 hashing in FortiOS 7.2.11, 7.4.8 and 7.6.1, but a device upgraded from an older release keeps the weaker salted SHA-256 hash in a hidden old-password setting until each administrator logs in again. The upgrade did not remove the crackable hash. Patching was not enough on its own.

Four. BeyondTrust Remote Support, a zero day with seven weeks of a head start. CVE-2026-102764, a CVSS 4.0 score of 9.3, is improper origin validation in the appliance's internal messaging components, allowing unauthenticated remote file operations on the box. It was disclosed on 15 October as advisory BT26-05, but Mandiant and Google's Threat Intelligence Group say it had been exploited as a zero day since late August by a suspected PRC-nexus actor they call ARMORY CASTLE, formerly tracked as UNC5221 and known to CrowdStrike as Warp Panda. After getting in they ran a custom SAWFLY PHP webshell, escalated to root through a SUID binary, extracted the credential vault, persisted through modified startup templates and sudoers, deleted logs, and ran a custom BARECLAW SOCKS5 and WebSocket tunneler. Appliances 26.2.3 and below are affected. As of today it is NOT in the CISA Known Exploited Vulnerabilities catalog, which is worth saying out loud because its absence is not safety.

Five. Atlassian, CVE-2026-21589, patched and already being probed. A CVSS 4.0 score of 9.3, unauthenticated arbitrary file access by path traversal across eight Atlassian Data Center products. There is a real limit on it: the attacker must already know the exact name and path of the file they want, because there is no directory listing and no enumeration. What it reads are files inside the web application root, which in some setups includes configuration files and credential stores. Atlassian shipped fixes around 5 October, a public proof of concept appeared, and probing began within hours of it. CISA added it to the KEV catalog on 15 October with a federal due date of 18 October and forensic triage required. The affected self-hosted products are Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. Atlassian Cloud was patched before disclosure and needs nothing.

Six. The Pentagon's people database was open for nine months. Unauthorized access to the Defense Manpower Data Center ran from October 2025 through July 2026, was made public late in September, and the notification letters are going out now. The way in was a flaw in a file sharing system, and the notice says the intruders reached files on a server that was holding the personal information unencrypted. As many as 2.76 million living people may be affected, plus roughly 294,000 deceased. What was exposed: Social Security numbers, names, dates of birth, sex, race, service details, and for some people contact information and occupational specialty. Twelve months of credit monitoring is offered through IDX.

Also this week

• Eight malicious npm packages, more than 40,000 downloads between them, delivering remote access malware and infostealers. One had been sitting available for over a year.
• Fraudulent ads impersonating ChatGPT, Gemini and Claude pushed spoofed Google and Okta login pages, defeated multi-factor, and added unauthorized admins to the ad accounts they compromised.
• Nextcloud, CVE-2026-110447, a 9.2, OS command injection in the optional richdocumentscode app. It is exploitable when the local CODE server is not running, which is exactly what happens after a restart. Fixed in 26.4.303. Built-in app only, not standalone Collabora, and not in KEV.
• Researchers tested 21 connected cars. Nineteen phoned home to outside companies, and seven companion apps shared sensitive identifiers with advertising and tracking firms.
• Police seized the KillSec ransomware group's infrastructure and arrested three people. The group is linked to roughly 1,000 attacks, about 500 of them reportedly successful.