--- title: "Fortinet's customers must patch blind: fixes shipped October 22, flaws named November 10, earnings October 28" description: "Fortinet shipped fixes for five product lines on October 22 and will not name the flaws until November 10, thirteen days after its earnings report. Its own chief information security officer says AI can turn a released patch into a working exploit within hours or days, and that makes the wait itself the exposure." publisher: "The Inference" section: "Security" published: 2026-10-22T16:09:48.618Z modified: 2026-10-22T16:09:48.618Z canonical: https://theinference.org/article/fortinet-s-customers-must-patch-blind-fixes-shipped-october-22-flaws-named-november-10-earnings-october-28 language: en keywords: "Cybersecurity, Vulnerabilities, Enterprise Security, Earnings, Fortinet" --- # Fortinet's customers must patch blind: fixes shipped October 22, flaws named November 10, earnings October 28 > Fortinet shipped fixes for five product lines on October 22 and will not name the flaws until November 10, thirteen days after its earnings report. Its own chief information security officer says AI can turn a released patch into a working exploit within hours or days, and that makes the wait itself the exposure. [Fortinet](https://theinference.org/markets/companies/fortinet) shipped fixes for five product lines this week and will not say what they fix: [no CVE identifiers, no severity scores and no attack conditions](https://cybersecuritynews.com/fortinet-urges-to-patch-critical-flaws/) until public advisories appear on November 10 [1]. Customers were told to patch internet-facing devices first, on the vendor's word alone [1]. Fortinet's own advisory page lists nothing newer than its October 13 batch [2], so the detail is genuinely absent rather than merely unreported. And by the company's own account of how fast attacks now move, the gap works for the attacker [1]. *Chart: **Six days from patch day to the earnings report, nineteen to the flaws' names** Column chart of the week's events counted in days after the October 20 release of the FortiSIEM exploit: the Arete Sell call and the k0t report one day later, patch day two days later, the earnings report at day eight, and the full advisories at day twenty-one.* *Events of October 20 to November 10, 2026, in days after the October 20 release of the FortiSIEM exploit. Sources: The Hacker News; Group-IB; CyberSecurityNews; Yahoo Finance/Investing.com. [1][3][5][7]* ## AI found these flaws, and AI arms whoever exploits them Part of this batch was found by AI models testing code paths, protocol handling and configuration logic. Fortinet thanked [Anthropic](https://theinference.org/markets/companies/anthropic), [OpenAI](https://theinference.org/markets/companies/openai), Google and [SpaceX](https://theinference.org/markets/companies/spacex) for work with its security teams, and Carl Windsor, its chief information security officer, warned customers against treating the fixes as routine maintenance [1]. The same tools run the other way. Attackers can use AI to compare patched and unpatched code, a technique called patch diffing, and build working exploits within hours or days [1]. A calendar that ships fixes on October 22 and explanations on November 10 assumes reverse-engineering is the slow step, and Fortinet has just said it is not [1]. ## Customers are asked to trust the vendor in the week their edge was the target The ask lands in a week when the network edge was demonstrably the prize. Group-IB and NyxLab, two threat-intelligence firms, [published their account on October 21 of a campaign run by an operator called k0t](https://www.group-ib.com/blog/) [3]. It broke into FortiWeb, Fortinet's web-application firewall, through a flaw that let unauthenticated attackers run administrative commands from crafted web requests, then used the access to create fresh administrator accounts [4]. From FortiGate, the flagship firewall, operators downloaded configuration files and decrypted stored passwords with a known default key; the researchers counted more than 70,000 exposed credentials, and Palo Alto's GlobalProtect VPN portals were attacked too [4]. [Researchers published a working exploit on October 20 for a critical flaw in FortiSIEM](https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html), Fortinet's security-monitoring product, days after its patch shipped [5]. Fortinet says it has no reports of the new flaws being exploited [1]. [PHP2Shell, a pair of critical flaws in PHP](https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/), the web scripting language, can let an attacker run code on a web server without logging in [6]. Fortinet still lists twelve products as under investigation for it, with no fixed versions [6]. ## The quarter is judged before the detail exists Fortinet reports third-quarter results on October 28, thirteen days before the advisories arrive [1] [7]. Arete, a research firm, [cut the stock two notches to Sell on October 21](https://finance.yahoo.com/markets/stocks/articles/fortinet-stock-falls-arete-delivers-123936188.html), calling 2026 a peak year in which a hardware refresh cycle and list-price increases of 5 to 20 percent converge once, with AI-related revenue too small to replace them [7]. We [covered the downgrade and the exploit code](https://theinference.org/article/exploit-code-went-public-five-days-before-fortinet-s-earnings-call-and-arete-says-sell-at-117) when they landed [7]. [Truist](https://theinference.org/markets/companies/truist-financial) and UBS, two brokerages, kept their Buy and Neutral ratings while [raising their targets, after a second quarter in which revenue grew 26 percent and billings 33 percent](https://www.ad-hoc-news.de/boerse/news/corporate-news/truist-raises-target-to-usd-200-for-fortinet-stock/70382412) [8]. What the week's breaches mean for that demand cannot be read until the flaws themselves can be, and that only becomes possible after the report. *Chart: **Sell at $117 against two $200 targets, with the quarter due before the detail** Bar chart of Fortinet price targets: Arete at $117 with a Sell rating, Truist at $200 with a Buy rating, UBS at $200 with a Neutral rating, measured against a reference line at the October 20 closing price of $170.93.* *Price targets for Fortinet (FTNT) issued October 15 to 21, 2026, against the October 20 closing price. Sources: Yahoo Finance/Investing.com; ad-hoc-news (Markets Insider). [7][8]* ## Two dates will tell whether the calendar survives The first test is October 28: whether Fortinet's guidance reflects a week in which its customers' firewalls were the stated target of a credential-theft campaign, or whether refresh demand hides it. The second is November 10, when the advisories finally carry severity scores. If those scores justify the patch-first ask, the wait bought customers time to upgrade before attackers finished the diff. If the flaws turn out mild, the same ask will be harder to make twice. Either way, the quarter gets priced without the detail. The fixes are public today; the details arrive in nineteen days; the exploits, by Fortinet's own account, take hours or days. ## Takeaway Fortinet shipped fixes on October 22 but will not name the flaws until November 10, after its October 28 earnings; with AI-assisted patch diffing taking hours to days, the disclosure gap itself is the risk, and the quarter gets priced without the detail. ## Sources 1. [CyberSecurityNews, Fortinet Urges Customers to Patch Critical Flaws Affecting FortiOS, FortiManager, and FortiAnalyzer, 22 October 2026](https://cybersecuritynews.com/fortinet-urges-to-patch-critical-flaws/) 2. [FortiGuard (Fortinet), PSIRT Advisories index, accessed 22 October 2026](https://fortiguard.com/psirt) 3. [Group-IB blog, Stray Cat, Open Doors: How k0t Wanders Through the Network Edge (report listing), 21 October 2026](https://www.group-ib.com/blog/) 4. [CyberSecurityNews, Hackers Are Breaking Into FortiGate, FortiWeb and Palo Alto GlobalProtect Systems to Steal Passwords, 22 October 2026](https://cybersecuritynews.com/breaking-into-fortigate-fortiweb/) 5. [The Hacker News, Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution, 20 October 2026](https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html) 6. [Help Net Security, What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers, 22 October 2026](https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/) 7. [Yahoo Finance/Investing.com, Fortinet stock falls as Arete delivers rare double downgrade to sell, 21 October 2026](https://finance.yahoo.com/markets/stocks/articles/fortinet-stock-falls-arete-delivers-123936188.html) 8. [ad-hoc-news (Markets Insider), Truist raises target to USD 200 for Fortinet stock, 22 October 2026](https://www.ad-hoc-news.de/boerse/news/corporate-news/truist-raises-target-to-usd-200-for-fortinet-stock/70382412) --- Fortinet's customers must patch blind: fixes shipped October 22, flaws named November 10, earnings October 28 — The Inference. Canonical: https://theinference.org/article/fortinet-s-customers-must-patch-blind-fixes-shipped-october-22-flaws-named-november-10-earnings-october-28