Learn / Attack archive / Lesson 27

Edge devices and mass exploitation

Why firewalls, VPNs and file-transfer servers are now the most attacked machines on the internet, why patching them is not the end, and how to shrink what faces the world.

Last updated: 2026-09-23

What it is

An edge device sits between a company and the internet: a VPN gateway, a firewall, a remote-access portal, a file-transfer server. It has to accept connections from anyone, so it is always reachable. Its whole job is to be trusted.

Mass exploitation is what happens when one of those products has a hole. Attackers do not pick a victim. They scan the entire internet, which takes minutes, and hit every unpatched box at once. The victims are whoever had not patched yet.

Why it is a rule

• MOVEit Transfer, May 2023. A file-transfer product used by banks, governments and payroll firms had a SQL injection flaw. The Cl0p gang used it against thousands of organisations over a holiday weekend, before a patch existed, and stole files from all of them at once. Tens of millions of people's records leaked.
• Citrix Bleed, October 2023. A flaw in Citrix NetScaler gateways leaked memory that contained live session tokens. Attackers took the tokens and walked in as signed-in users. Boeing and the US arm of ICBC, the world's largest bank, were hit. Patching did not throw the attackers out: the stolen sessions kept working until someone ended them.
• Citrix Bleed 2, June 2025. A very similar memory leak in the same product family, exploited again before most customers had patched.
• SharePoint "ToolShell", July 2025. A chain of flaws in on-premises SharePoint servers let attackers run code and steal the server's signing keys, so they could keep forging access after the patch. Hundreds of organisations, including government agencies, were compromised in days.
• Palo Alto PAN-OS, April and May 2026. CVE-2026-0300, a buffer overflow in the firewall's captive portal, let an attacker with no login run code as root. Palo Alto said a likely state-sponsored group exploited it for nearly a month before a patch was ready, cleaning crash logs to hide its tracks.
• Oracle PeopleSoft, 2026. CVE-2026-35273, an unauthenticated flaw scored 9.8, was exploited by the ShinyHunters extortion group against universities and other PeopleSoft users before a fix was available.

Why it keeps working

• They must face the internet. You cannot hide a VPN from the people who need to reach it.
• They are old code in unsafe languages. Many are decades-old C, where one missing length check is a memory leak or remote control.
• Nobody watches them. Security software runs on laptops and servers, not on firewalls, so an attacker inside one is often invisible.
• Patching them hurts. A VPN reboot cuts everyone off, so updates wait for a maintenance window. Eclypsium reported that the median time from disclosure to exploitation for these devices is now zero days.
• Patches do not remove what was stolen. Session tokens, keys and backdoors planted before the patch survive it.

How to do it

1. Shrink what faces the internet

List every service reachable from outside. For each one, ask whether it has to be public. Admin panels, databases and management portals should not be. Put them behind a private network or an identity-aware proxy.

# what the internet can see on your address
nmap -Pn --top-ports 1000 your.public.ip

2. Patch on a clock, not a calendar

When a flaw in an internet-facing product is on CISA's Known Exploited Vulnerabilities list, it is being used right now. Treat that as an incident: patch in hours or days, or turn the feature off until you can.

3. After patching, assume you were already hit

• End every session the device issued before the patch.
• Rotate the device's keys and any credentials it stores.
• Look for new admin accounts, new files and changed configs.

The Citrix Bleed and ToolShell victims who only patched were still compromised.

4. Retire what is no longer supported

A device past its end of life will never get a patch. CISA now tells US agencies to find and remove unsupported edge devices, and the same advice fits everyone.

5. Prefer fewer, simpler doors

One well-maintained entry point, kept current, is safer than five appliances from five vendors.

How we do it here

The site is one small web server behind a CDN. We do not run VPN gateways, file-transfer servers or other appliances of our own; the hosting platform patches the machines under us, and our own dependencies are kept current.

Benefits

• Every service you take off the internet is one fewer thing to patch in a panic.
• Watching the Known Exploited list tells you what to patch first, out of thousands of flaws.
• Ending sessions after a patch closes the gap that turned Citrix Bleed into a breach.

Disadvantages

• Moving things behind a private network adds a step for staff and can break integrations.
• Emergency patching means unplanned downtime.
• For a zero-day there is no patch to apply. Only a smaller exposure helps.
• Relying on a hosting platform means trusting its patching, which you cannot see.

Checklist

• You have a list of every internet-facing service.
• Admin and management interfaces are not public.
• Known-exploited flaws are patched within days.
• Sessions and keys are rotated after an edge device is patched.
• Unsupported devices are replaced.

Sources

• CISA — Known Exploited Vulnerabilities Catalog
• BleepingComputer — Palo Alto Networks firewall zero-day exploited for nearly a month
• Rapid7 — Active exploitation of Oracle PeopleSoft zero-day (CVE-2026-35273)
• Eclypsium — Firewall vulnerability exploitation: why the edge is fraying
• CISA — #StopRansomware: CL0P exploits MOVEit vulnerability
• Microsoft Security Response Center, guidance on SharePoint CVE-2025-53770, July 2025.

Read this lesson as Markdown