The Perimeter Week

Five of nine new exploited-vulnerability listings were gateways, firewalls or remote-access appliances, and VPN events on the decoys doubled.

SECTION 01

What the signals mean

Events recorded on the Venus decoys fell 3.8% this week, to 1,306,889 from 1,358,989, and distinct sources fell 3.9%, to 5,498 from 5,724. The Windows surface supplied 1,231,817 of the events. 3,122 sources were new and 2,376 had been seen before, against 3,484 and 2,240 in Edition 011.

Five perimeter products joined the exploited list

Between 13 and 16 October, CISA added nine vulnerabilities to its catalogue of flaws confirmed as exploited, each with remediation due within three days. Five are network edge products: Ivanti Connect Secure, Palo Alto PAN-OS, Fortinet FortiOS, the Cisco Secure Email Gateway and BeyondTrust Remote Support. The other four are two AhsayCBS backup server flaws, Atlassian Data Center and Windows Shell.

Listed late, used earlier

Reporting says BeyondTrust Remote Support was exploited as a zero-day from late August by a China-nexus group tracked as Armory Castle, more than six weeks before CISA listed it on 16 October (The Hacker News, SecurityWeek). Ivanti’s authentication bypass was only partly fixed in July (Dark Reading), and Rapid7 describes it as exploited in the wild. The Fortinet flaw was published in April with a score of 6.0, medium, and is now reported as the route for a memory-resident malware named PEERSTITCH (The Hacker News).

VPN events doubled on the decoys

VPN events rose 107.7%, to 5,016 from 2,415. Venus classified one of them as gateway fingerprinting and none as a gateway exploit attempt. Auth events rose 27.3%, to 1,973 from 1,550, and Database events 35.1%, to 912 from 675. Shell fell 38.9%, to 18,258 from 29,871.

Two requests on the day of the listing

Venus recorded two requests from two sources carrying the traversal pattern used against Atlassian Data Center. Both arrived at 22:47 IST on 15 October, the day CISA added the flaw to its catalogue. Medulus shows the CVE record, CVE-2026-21589, as rejected while CISA lists it as exploited. Both are attempts.

Environment files and Terraform state keep drawing requests

Requests for secrets and configuration files rose 28.7%, to 21,024 from 16,335, across 1,747 distinct paths against 1,201. /.env drew 641 requests, /.env.local 319 and /.env.production 273. Terraform state, the record of the servers and passwords a cloud build created, drew 76 requests for the root file against 63, and two other Terraform paths drew 45 and 22. Traversal requests rose 19.4%, to 2,079 from 1,741. The leader, /@fs/../.env, drew 92. Three paths under a log-download route ended at /proc/self/environ, the running program’s environment variables, with 46 requests each.

File sharing, consoles and script files fell

Windows file sharing probes fell 19.8%, to 146,283 events from 182,365, and file sharing credential attacks fell 23.0%, to 128,006 from 166,232. Admin console requests fell 48.4%, to 1,942 from 3,766, and requests for server-side script files, the kind an attacker plants as a web shell, fell 21.6%, to 6,618 from 8,445.

The fingerprint cluster eased

The remote desktop tool identified by fingerprint 73ede1f461b6 ran from 170 addresses this week and produced 3,431 sessions, against 262 addresses and 3,694 sessions in Edition 011. It remains above the 85 to 99 addresses of Editions 007, 009 and 010.

What to act on

Patch the five perimeter products first; their deadlines run from 16 to 19 October. AhsayCBS, Atlassian Data Center and Windows Shell follow. Check that firewall and remote-access management interfaces answer only trusted internal addresses, as Palo Alto advises for PAN-OS. Remove Terraform state, site archives and every environment-file variant from any path a web server can reach.

1,306,889 external events (−3.8%). 5,498 distinct sources (−3.9%). 13,388 sessions (−3.7%).

Against Edition 011’s published figures, events fell from 1,358,989 to 1,306,889, sources from 5,724 to 5,498 and sessions from 13,896 to 13,388. New sources fell 10.4%, to 3,122 from 3,484, and returning sources rose 6.1%, to 2,376 from 2,240. By surface, Windows fell 2.9% to 1,231,817 from 1,269,134, Web fell 11.3% to 40,743 from 45,939, Shell fell 38.9% to 18,258 from 29,871, API fell 13.1% to 4,082 from 4,697 and Portal fell 13.2% to 4,088 from 4,708. Database rose 35.1% to 912 from 675, Auth rose 27.3% to 1,973 from 1,550 and VPN rose 107.7% to 5,016 from 2,415. Active campaigns fell 11.4%, to 3,038 from 3,429, and 1,702 are flagged recurring, against 1,355.

Ranked signals

Rank	Signal	Events	Ed. 011	Change	Sources	Score
1	PHP Injection / Remote Include	133	239	−44.4%	12	0.5013
2	Webshell / RCE Script Probing	6,618	8,445	−21.6%	202	0.4028
3	Atlassian Data Center Exploit Attempts	2	not published	–	2	0.3774
4	AI Workflow Builder Exploit Attempts	75	not published	–	4	0.3660
5	Admin Console Discovery	1,942	3,766	−48.4%	118	0.3601
6	WordPress Plugin Probing	3	not published	–	1	0.3500
7	Sensitive File & Secret Exposure	21,024	16,335	+28.7%	168	0.3459
8	MySQL Credential Attack	600	384	+56.3%	87	0.3070
9	Automated Scanner / Recon Tooling	422	749	−43.7%	93	0.2982
10	SSH Invalid-User Enumeration	17,394	28,993	−40.0%	446	0.2841
11	Directory / Path Traversal	2,079	1,741	+19.4%	19	0.2460
12	SSH Access Probing	18,258	29,871	−38.9%	841	0.2093
13	SSH Campaign Targeting	1,832	1,993	−8.1%	256	0.2066
14	SQL Injection Probing	1	2	−50.0%	1	0.2024
15	SMB Credential Attack	128,006	166,232	−23.0%	53	0.1867
16	SMB Access Probing	146,283	182,365	−19.8%	2,353	0.1864
17	VPN Gateway Fingerprinting	1	not published	–	1	0.0000

Remote desktop fingerprint campaigns

Client signature	Sessions	Ed. 011	Change	Sources	Ed. 011	Change
TLS 73ede1f461b6	3,431	3,694	−7.1%	170	262	−35.1%
RDP cookie "hello"	417	576	−27.6%	137	121	+13.2%
TLS 43e25370946f	390	403	−3.2%	117	96	+21.9%
RDP cookie "anonymous"	566	364	+55.5%	56	55	+1.8%

Fingerprint 73ede1f461b6 fell from 262 addresses to 170. The "hello" signature rose from 121 to 137 and 43e25370946f from 96 to 117, while "anonymous" held near 56. An address can carry several signatures, so the four counts are not totalled.

Path families

Family	Events	Ed. 011	Change	Paths	Sources	Most requested
Sensitive File & Secret Exposure	21,024	16,335	+28.7%	1,747	168	/.env (641), /.env.local (319)
Backup & Archive Download Probing	408	589	−30.7%	99	34	/terraform.tfstate (76), /.terraform/terraform.tfstate (45)
Webshell / RCE Script Probing	6,618	8,445	−21.6%	1,773	202	/index.php (98), /info.php (79)
Admin Console Discovery	1,942	3,766	−48.4%	377	118	/admin/.env (113), /api/console/api_server (92)
Directory / Path Traversal	2,079	1,741	+19.4%	83	19	/@fs/../.env (92), /_nuxt/../.env (46)
SQL Injection Probing	1	2	−50.0%	1	1	/index.action (1)

Distinct paths in the sensitive-file family rose to 1,747 from 1,201, so that list lengthened while the admin list shortened, to 377 from 685, and the webshell list to 1,773 from 2,030. Two of the three most requested admin paths end in .env, a path also requested in the sensitive-file family. The single SQL injection request asked for /index.action.

Representative paths

Secrets and configuration	Events	Ed. 011	Backup and archive	Events	Ed. 011
/.env	641	630	/terraform.tfstate	76	63
/.env.local	319	263	/.terraform/terraform.tfstate	45	not published
/.env.production	273	212	/.terraform.tfstate	22	not published
/.git/config	232	257	/site.zip	22	not published
/.env.development	193	170	/backup.zip	21	17

Three of the five backup paths are Terraform state in different locations. /.git/config fell 9.7% while every .env variant rose.

Behaviour progression

327 sessions carried behaviour from two or more distinct stages, against 326 in Edition 011.

Ordering	Sessions	Ed. 011	Change	Sources	Ed. 011	Busiest source	Evasive
Discovery, then Exploitation	246	229	+7.4%	160	134	21 (8.54%)	5.44%
Exploitation, then Discovery	81	97	−16.5%	63	73	6 (7.41%)	25.93%

Evasive sessions rose to 5.44% of the forward ordering from 3.49%, and to 25.93% of the reverse from 18.56%. The busiest source’s share fell in both, to 8.54% from 9.17% and to 7.41% from 8.25%. A tool that issues credential attempts before enumeration produces a descending ordering without any escalation.

Vulnerability mapping

Identifier	Description	Hits	Ed. 011	Change	Sources	KEV
CWE-312	Cleartext secrets (.env)	17,430	13,345	+30.6%	113	no
CVE-2021-41773	Apache traversal	6,633	8,485	−21.8%	202	yes
CVE-2019-0232	Tomcat CGI	6,618	8,445	−21.6%	202	no
CWE-527	Exposed Git	1,967	1,413	+39.2%	113	no
CVE-2017-9841	PHPUnit eval-stdin	206	415	−50.4%	19	yes
CVE-2012-1823	PHP-CGI argument injection	133	239	−44.4%	12	yes
CVE-2023-2982	WordPress login bypass	108	140	−22.9%	29	no
CVE-2022-22963	Spring Cloud Function	50	49	+2.0%	12	yes
CVE-2021-42013	Apache traversal, second fix	15	40	−62.5%	7	yes
CVE-2022-22965	Spring4Shell	8	34	−76.5%	4	yes

20 identifiers were reached, against 14, and 9 of the 20 are on the KEV catalogue, against 6 of 14. The identifier list was extended after Edition 011, so part of the rise is additions. The Langflow identifiers CVE-2025-3248 and CVE-2026-0768 and the Flowise identifier CVE-2025-59528 drew 30 hits each from 4 sources, and CVE-2026-33017 drew 15. CVE-2026-21589 drew 2 hits and Log4Shell, CVE-2021-44228, drew 1. CVE-2017-12629 and CVE-2021-27905 each fell to 4 hits from 20.

Medulus correlation

24 vulnerabilities qualified this period, against 17 in Edition 011. Nine entered the CISA Known Exploited Vulnerabilities catalogue between 13 and 16 October.

Product	Identifier	CVSS	EPSS	Added	Due	Reported exploitation
Ivanti Connect Secure	CVE-2026-104935	8.6	0.2598	13 Oct	16 Oct	Rapid7, Dark Reading
Windows Shell	CVE-2026-96951	8.8	0.0151	13 Oct	16 Oct	–
Cisco Secure Email Gateway	CVE-2026-76519	9.8	0.0157	14 Oct	17 Oct	–
Palo Alto PAN-OS	CVE-2026-0322	7.2	0.0121	14 Oct	17 Oct	Bleeping Computer
AhsayCBS	CVE-2026-105134	10.0	0.0478	14 Oct	17 Oct	The Hacker News
AhsayCBS	CVE-2026-105133	7.3	0.0085	14 Oct	17 Oct	The Hacker News
Atlassian Data Center	CVE-2026-21589	not rated	0.1271	15 Oct	18 Oct	–
BeyondTrust Remote Support	CVE-2026-102764	9.8	0.0118	16 Oct	19 Oct	The Hacker News, SecurityWeek
Fortinet FortiOS	CVE-2025-61624	6.0	0.0108	16 Oct	19 Oct	The Hacker News

Seven of the nine have an EPSS score below 0.05. EPSS is a forecast of exploitation within 30 days. Reporting attributes the BeyondTrust zero-day to Armory Castle, formerly tracked as UNC5221 and Warp Panda, and describes custom tools and deleted logs. The Fortinet flaw requires an authenticated administrator profile with read-write permissions. The AhsayCBS flaws were used to drop web shells and XMRig miners. The Hacker News reports 105 exploit attempts against Ivanti Connect Secure on third-party honeypots, which are not Venus figures.

Reporting also describes exploitation of the Collabora Online server app for Nextcloud, CVE-2026-110447 (Bleeping Computer), and a Langflow flaw, CVE-2026-105740, that Previdian says drew 1,423 honeypot attempts (The Hacker News). Rapid7 published an advisory on unauthenticated code execution in GitLab, CVE-2026-97229. None of the three is on the catalogue. Metasploit changed four modules: Grafana CVE-2024-9264 (EPSS 0.9714, not listed), Hikvision CVE-2017-7921, Magento CVE-2024-34102 and Elasticsearch CVE-2015-5531.

Technical checks for the week

• Patch: Ivanti Connect Secure, Palo Alto PAN-OS, Fortinet FortiOS, Cisco Secure Email Gateway and BeyondTrust Remote Support. Remediation was due 16 to 19 October.
• Patch: AhsayCBS to 10.3.4, Atlassian Data Center and Windows Shell.
• Restrict: firewall and remote-access management interfaces to trusted internal addresses.
• Prioritise: GitLab CVE-2026-97229, both Check Point gateway flaws and the Nextcloud Collabora app. Each has reported exploitation, an advisory or a rising forecast.
• Remove: Terraform state, site archives, .git directories and every .env variant from web-reachable paths.
• Review: Fortinet administrator profiles with read-write permissions, and BeyondTrust appliance logs from late August.

Venus records activity reaching Elytra-operated decoy observation infrastructure. Medulus provides public vulnerability and threat-intelligence context. Every observed request is an attempt. Week-on-week comparisons are drawn from the figures published in Edition 011.