Fortinet's customers must patch blind: fixes shipped October 22, flaws named November 10, earnings October 28
Fortinet shipped fixes for five product lines on October 22 and will not name the flaws until November 10, thirteen days after its earnings report. Its own chief information security officer says AI can turn a released patch into a working exploit within hours or days, and that makes the wait itself the exposure.
Richard Tang · 3 min read
Fortinet−0.38% — Fortinet, down 0.38 percent today shipped fixes for five product lines this week and will not say what they fix: no CVE identifiers, no severity scores and no attack conditions until public advisories appear on November 10 1. Customers were told to patch internet-facing devices first, on the vendor's word alone 1. Fortinet's own advisory page lists nothing newer than its October 13 batch 2, so the detail is genuinely absent rather than merely unreported. And by the company's own account of how fast attacks now move, the gap works for the attacker 1.
Six days from patch day to the earnings report, nineteen to the flaws' names
Data
| Days after the October 20 exploit release | |
|---|---|
| 20 Oct FortiSIEM exploit public | 0 days |
| 21 Oct Arete Sell, k0t report | 1 days |
| 22 Oct patch day | 2 days |
| 28 Oct earnings report | 8 days |
| 10 Nov advisories | 21 days |
AI found these flaws, and AI arms whoever exploits them
Part of this batch was found by AI models testing code paths, protocol handling and configuration logic. Fortinet thanked Anthropic$350B — Anthropic, private, latest valuation $350B, OpenAI$1.18T — OpenAI, private, latest valuation $1.18T, Google and SpaceX−8.11% — SpaceX, down 8.11 percent today for work with its security teams, and Carl Windsor, its chief information security officer, warned customers against treating the fixes as routine maintenance 1.
The same tools run the other way. Attackers can use AI to compare patched and unpatched code, a technique called patch diffing, and build working exploits within hours or days 1. A calendar that ships fixes on October 22 and explanations on November 10 assumes reverse-engineering is the slow step, and Fortinet has just said it is not 1.
Customers are asked to trust the vendor in the week their edge was the target
The ask lands in a week when the network edge was demonstrably the prize. Group-IB and NyxLab, two threat-intelligence firms, published their account on October 21 of a campaign run by an operator called k0t 3. It broke into FortiWeb, Fortinet's web-application firewall, through a flaw that let unauthenticated attackers run administrative commands from crafted web requests, then used the access to create fresh administrator accounts 4.
From FortiGate, the flagship firewall, operators downloaded configuration files and decrypted stored passwords with a known default key; the researchers counted more than 70,000 exposed credentials, and Palo Alto's GlobalProtect VPN portals were attacked too 4.
Researchers published a working exploit on October 20 for a critical flaw in FortiSIEM, Fortinet's security-monitoring product, days after its patch shipped 5. Fortinet says it has no reports of the new flaws being exploited 1. PHP2Shell, a pair of critical flaws in PHP, the web scripting language, can let an attacker run code on a web server without logging in 6. Fortinet still lists twelve products as under investigation for it, with no fixed versions 6.
The quarter is judged before the detail exists
Fortinet reports third-quarter results on October 28, thirteen days before the advisories arrive 1 7. Arete, a research firm, cut the stock two notches to Sell on October 21, calling 2026 a peak year in which a hardware refresh cycle and list-price increases of 5 to 20 percent converge once, with AI-related revenue too small to replace them 7. We covered the downgrade and the exploit code when they landed 7.
Truist+0.91% — Truist, up 0.91 percent today and UBS, two brokerages, kept their Buy and Neutral ratings while raising their targets, after a second quarter in which revenue grew 26 percent and billings 33 percent 8. What the week's breaches mean for that demand cannot be read until the flaws themselves can be, and that only becomes possible after the report.
Sell at $117 against two $200 targets, with the quarter due before the detail
Data
| Value | |
|---|---|
| Arete (Sell) | $117 |
| Truist (Buy) | $200 |
| UBS (Neutral) | $200 |
Two dates will tell whether the calendar survives
The first test is October 28: whether Fortinet's guidance reflects a week in which its customers' firewalls were the stated target of a credential-theft campaign, or whether refresh demand hides it. The second is November 10, when the advisories finally carry severity scores. If those scores justify the patch-first ask, the wait bought customers time to upgrade before attackers finished the diff. If the flaws turn out mild, the same ask will be harder to make twice. Either way, the quarter gets priced without the detail.
The fixes are public today; the details arrive in nineteen days; the exploits, by Fortinet's own account, take hours or days.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
