BeyondTrust zero-day exploited since August and PEERSTITCH malware on FortiOS: what to check today in the remote access and VPN of your Mexico operation

On October 16, 2026, two security notices landed right on the door your IT support uses to get in. According to BleepingComputer, BeyondTrust patched a zero-day that had been exploited since August. The Hacker News reports that China-linked hackers used it to take over Remote Support servers.

The same day, PEERSTITCH showed up: malware that gets in through a FortiOS flaw, the operating system of Fortinet firewalls. If headquarters supports your Mexico site remotely, or your local team connects through a Fortinet VPN, this is a today problem.

What happened and why it matters for a Mexico site

A zero-day is a flaw attackers use before a patch exists. The uncomfortable part here: it stayed open for roughly two months.

BeyondTrust Remote Support is the tool a technician uses to connect to a PC and fix it. Whoever controls that server can reach every machine it supports. You do not lose a key, you lose the whole key ring.

FortiOS is a similar story. The VPN, the encrypted tunnel your plant manager uses from home, is the hallway into your network. According to The Hacker News, PEERSTITCH bypasses checks on tagged VPN sessions. In plain terms: someone walks that hallway looking like an employee.

How to tell if BeyondTrust touches your operation

• Ask global IT and any local vendor which tool they use to reach your devices. Get the answer in writing.
• Check installed programs on a couple of PCs at the site. Look for BeyondTrust or Bomgar, its former name.
• Ask whether the server is self-hosted or in the vendor cloud. In our experience the vendor usually updates cloud instances and you update your own, but confirm it in the official advisory.

It is common for headquarters to patch the central server and forget that the Mexico site has its own appliance or an old client nobody tracks.

Patching is not enough if you were hit since August

The patch closes the door. It does not remove whoever already came in. After updating, check:

What to check	Where	Red flag
Version and patch	BeyondTrust console	Missing the October update
User accounts	Admin console	New accounts nobody requested
Session history	Session logs	Late-night sessions or odd target machines
Server logs	System and firewall	Traffic to unknown addresses
Supported devices	PCs and servers	New programs or scheduled tasks

FortiOS and PEERSTITCH: what to check on the VPN

1. Log in to the firewall and note the FortiOS version. Compare it with Fortinet’s security advisory.
2. Apply the right patch in a short maintenance window, with a heads-up to local users.
3. Review active and past VPN sessions: odd hours, or countries where you have nobody.
4. Rotate credentials, meaning new VPN and firewall admin passwords.
5. If the VPN has no multi-factor authentication yet, now is the time.

Also this week: Collabora on Nextcloud and NGINX

If the site keeps files on a self-hosted Nextcloud with Collabora for document editing, BleepingComputer reports an exploited flaw being used to plant backdoors. NGINX, the web server behind many sites and internal tools, also fixed five flaws, including one in client certificate checks. Update both this week.

How ProcessBi handles it on the ground

We have seen this pattern before with ScreenConnect and TeamViewer. Our take: the brand is rarely the problem. Not knowing what is installed is.

Within an IT support plan we run the urgent review of remote access and firewall at your Mexico site, inventory the RMM tools (remote management software) and monitor for odd sessions. Your global team keeps control; we are the local hands and eyes, in English or Spanish.

Let’s talk

What about your Mexico operation?

If nobody can tell you which tool reaches your local devices or which FortiOS version runs at the site, start there. We can help you check it today.

Request a remote access and VPN review — we reply the same business day.