We put a 30% chance on two public FCEB cases proving post-deadline edge exploitation by year-end.

A firewall, VPN, or secure-access gateway can hold much more than vulnerable code. It can mediate trusted sessions, store service-account credentials, expose configuration secrets, and connect external identities to internal systems. Once those artifacts leave the appliance, remediation becomes a trust-recovery problem—not only a software-maintenance task.

China-linked operators are turning compromised routers into relay logistics. The defender move is behavior over bad IPs.

A malicious package can be removed. A credential harvested from the build path can keep creating risk long after the incident looks closed. That is why “cleanup” and “containment” are not the same word, even if a dashboard would very much like them to be.

Attackers do not need one specific proxy brand to survive. They need residential egress that still works: clean-looking IPs, geographic routing, rotation, and enough reliability to keep credential stuffing, scraping, fake account creation, ad fraud, and account takeover moving.

Legacy access paths have a nasty habit of surviving architecture updates, migration plans, and confident diagrams. The Check Point IKEv1 case is useful because it points at a larger defender problem: attackers are not only chasing fresh bugs. They are testing whether yesterday’s compatibility debt still works today.

The fake remote IT worker story gets talked about like hiring fraud, sanctions exposure, or payroll diversion.