Two firewall vendors patch in parallel while attackers already hold the keys
Palo Alto Networks traded up 3.24% on its no-exploitation reassurance the same weekend it confirmed a second critical PAN-OS flaw, and Fortinet reports Oct 28 with patch details withheld until November. Meanwhile Group-IB researchers have the receipts: attackers already used both vendors' devices to harvest 70,000 credentials.
Vincent Jiang · 3 min read
The firewall patch cycle is now the firewall story. Palo Alto Networks+3.25% — Palo Alto Networks, up 3.25 percent today deployed PAN-OS hotfixes over the Oct 25-26 weekend for the PHP2Shell flaws, and the stock rose 3.24% on Oct 26 while the sector fell 0.26% 3. The reassurance that did it: no malicious exploitation observed in its products 3.
The same weekend, Palo Alto confirmed a second flaw in its firewall operating system, one it says it has also not seen used 1. Fortinet+1.33% — Fortinet, up 1.33 percent today reports third-quarter results on Oct 28 with two open patch cycles and its analyst book split almost two-to-one 4. The customers patching both fleets are paying for the gap between those two stories.
The second flaw landed the same weekend
The new one is CVE-2026-111497, a Brotli decoder flaw Google's own software carries, scoring 9.2 1. It can let an attacker corrupt memory, expose data, crash a service, or potentially run code without authentication. Exposure on PAN-OS requires two settings most administrators have off: Brotli traffic inspection, which is disabled by default, and TLS/SSL decryption. Palo Alto published the advisory Oct 26, gave administrators a command to switch inspection off, and scheduled fixes across nine builds between Oct 27 and 30 1.
The record says edge devices get used
The Group-IB and NyxLab k0t campaign, published Oct 23, is not a forecast 25. Attackers used CVE-2025-64446, a FortiWeb path traversal flaw, and CVE-2026-0257, a PAN-OS GlobalProtect authentication bypass, to get in, then pulled more than 70,000 exposed device credentials and LDAP dumps 25. Several victims later appeared on Qilin and The Gentlemen leak sites, which points to initial access brokering 25.
Unit 42 ties CVE-2026-0257 to ransomware intrusions since June, including one that went VPN gateway to vCenter to ESXi to a domain controller's virtual disk 6. An attacker inside looks like a remote employee. Patching does not remove access established before it 6.
The k0t campaign followed exposed devices, not industries
Data
| Value | |
|---|---|
| Asia Pacific | 38% |
| Latin America | 31.9% |
| Europe | 15.8% |
| Middle East and North Africa | 12.7% |
Fortinet's Oct 28 test
Fortinet enters earnings with the PHP2Shell question still narrow: 43 product entries cleared, FortiOS among them, four still under review 7. But the market picture is not calm, it is priced. The stock trades at 63 times earnings against a $132.1 billion market cap, up from a 52-week low of $73.55 4.
The targets run from Arete's $117 sell to RBC's $205; JPMorgan raised to $140 on Oct 23 and kept an underweight 4. Fortinet shipped five product-line fixes Oct 22 and names the CVEs on Nov 10-11, a week after the quarter closes 8. Guidance is $2.01-2.1 billion in revenue and 35-37% operating margin, below Q2's 38% 8.
Fortinet's Q3 revenue guidance is roughly flat against Q2
- Revenue
- Estimate
Data
| Revenue | |
|---|---|
| Q1 '24 | $1.35B |
| Q2 '24 | $1.43B |
| Q3 '24 | $1.51B |
| Q4 '24 | $1.66B |
| Q1 '25 | $1.54B |
| Q2 '25 | $1.63B |
| Q3 '25 | $1.73B |
| Q4 '25 | $1.91B |
| Q1 '26 | $1.85B |
| Q2 '26 | $2.05B |
| Q3 '26 (estimate) | $2.06B ($2.01–2.10B) |
Fortinet's targets span $88, from a $117 sell to a $205 buy
Data
| Target, USD | |
|---|---|
| Arete (sell) | $117 |
| JPMorgan (underweight) | $140 |
| RBC | $205 |
Oct 28 for the quarter, Nov 10 for the CVEs
Oct 28 tells you what enterprises paid, Nov 10 tells you what they patched blind, and the PAN-OS hotfix window closes Oct 30. The number to watch is not the quarter's revenue. It is whether either vendor, at renewal, keeps the no-exploitation claim intact while the fix dates keep moving.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
