---
title: "Two firewall vendors patch in parallel while attackers already hold the keys"
description: "Palo Alto Networks traded up 3.24% on its no-exploitation reassurance the same weekend it confirmed a second critical PAN-OS flaw, and Fortinet reports Oct 28 with patch details withheld until November. Meanwhile Group-IB researchers have the receipts: attackers already used both vendors' devices to harvest 70,000 credentials."
publisher: "The Inference"
section: "Security"
published: 2026-10-27T15:33:01.394Z
modified: 2026-10-27T15:33:01.394Z
canonical: https://theinference.org/article/two-firewall-vendors-patch-in-parallel-while-attackers-already-hold-the-keys
language: en
keywords: "Cybersecurity, Firewalls, Palo Alto Networks, Fortinet, Hacking"
---

# Two firewall vendors patch in parallel while attackers already hold the keys

> Palo Alto Networks traded up 3.24% on its no-exploitation reassurance the same weekend it confirmed a second critical PAN-OS flaw, and Fortinet reports Oct 28 with patch details withheld until November. Meanwhile Group-IB researchers have the receipts: attackers already used both vendors' devices to harvest 70,000 credentials.

The firewall patch cycle is now the firewall story. [Palo Alto Networks](https://theinference.org/markets/companies/palo-alto-networks) deployed PAN-OS hotfixes over the Oct 25-26 weekend for [the PHP2Shell flaws](https://theinference.org/article/palo-alto-networks-has-no-pan-os-fix-for-php2shell-calls-it-9-2-and-sells-a-paid-virtual-patch), and the stock [rose 3.24% on Oct 26 while the sector fell 0.26%](https://www.tradingkey.com/news/market-movers/262240016-market-movers-panw-20261026) [3]. The reassurance that did it: no malicious exploitation observed in its products [3].

The same weekend, Palo Alto confirmed a second flaw in its firewall operating system, one it says it has also not seen used [1]. [Fortinet](https://theinference.org/markets/companies/fortinet) reports third-quarter results on Oct 28 with two open patch cycles and its analyst book split almost two-to-one [4]. The customers patching both fleets are paying for the gap between those two stories.

## The second flaw landed the same weekend

The new one is CVE-2026-111497, a Brotli decoder flaw Google's own software carries, scoring 9.2 [1]. It can let an attacker corrupt memory, expose data, crash a service, or potentially run code without authentication. Exposure on PAN-OS requires two settings most administrators have off: Brotli traffic inspection, which is disabled by default, and TLS/SSL decryption. Palo Alto [published the advisory Oct 26](https://cybersecuritynews.com/brotli-vulnerability-affects-pan-os/), gave administrators a command to switch inspection off, and scheduled fixes across nine builds between Oct 27 and 30 [1].

## The record says edge devices get used

The Group-IB and NyxLab k0t campaign, published Oct 23, is not a forecast [2][5]. Attackers used CVE-2025-64446, a FortiWeb path traversal flaw, and CVE-2026-0257, a PAN-OS GlobalProtect authentication bypass, to get in, then pulled [more than 70,000 exposed device credentials and LDAP dumps](https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html) [2][5]. Several victims later appeared on Qilin and The Gentlemen leak sites, which points to initial access brokering [2][5].

Unit 42 ties [CVE-2026-0257](https://theinference.org/article/palo-alto-rose-6-5-the-same-week-its-own-unit-42-confirmed-ransomware-uses-its-globalprotect-flaw) to [ransomware intrusions since June](https://www.helpnetsecurity.com/2026/10/21/ransomware-groups-exploit-palo-alto-globalprotect-cve-2026-0257/), including one that went VPN gateway to vCenter to ESXi to a domain controller's virtual disk [6]. An attacker inside looks like a remote employee. Patching does not remove access established before it [6].

*Chart: **The k0t campaign followed exposed devices, not industries** Bars showing k0t campaign victims by region: APAC 38%, Latin America 31.9%, Europe 15.8%, Middle East and North Africa 12.7%, from Group-IB and NyxLab.*

*Share of k0t campaign victims by region, in percent, from Group-IB and NyxLab research published Oct 23, 2026; the same campaign harvested more than 70,000 device credentials. [2]*

## Fortinet's Oct 28 test

Fortinet enters earnings with the PHP2Shell question still narrow: [43 product entries cleared, FortiOS among them, four still under review](https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/) [7]. But the market picture is not calm, it is priced. The stock trades at 63 times earnings against a $132.1 billion market cap, up from a 52-week low of $73.55 [4].

The targets run from Arete's $117 sell to RBC's $205; JPMorgan raised to $140 on Oct 23 and kept an underweight [4]. Fortinet shipped five product-line fixes Oct 22 and [names the CVEs on Nov 10-11](https://theinference.org/article/fortinet-s-customers-must-patch-blind-fixes-shipped-october-22-flaws-named-november-10-earnings-october-28), a week after the quarter closes [8]. [Guidance is $2.01-2.1 billion in revenue and 35-37% operating margin](https://finance.yahoo.com/markets/stocks/articles/fortinet-stock-q3-earnings-buy-151600630.html), below Q2's 38% [8].

*Chart: **Fortinet's Q3 revenue guidance is roughly flat against Q2** Column chart of Fortinet's quarterly revenue from Q1 2024 to Q2 2026, with Q3 2026 guidance of $2.01-2.1 billion drawn as a range on the final column.*

*Quarterly revenue in billions of US dollars, from Fortinet's SEC filings. Q3 '26 is the company's guidance of $2.01-2.1 billion, drawn as a range around the midpoint. [9][8]*

*Chart: **Fortinet's targets span $88, from a $117 sell to a $205 buy** Column chart showing analyst price targets for Fortinet from Arete at $117 through JPMorgan at $140 to RBC at $205.*

*Analyst price targets on Fortinet in US dollars, late October 2026; JPMorgan raised to $140 on Oct 23 while keeping an underweight rating. [4]*

## Oct 28 for the quarter, Nov 10 for the CVEs

Oct 28 tells you what enterprises paid, Nov 10 tells you what they patched blind, and the PAN-OS hotfix window closes Oct 30. The number to watch is not the quarter's revenue. It is whether either vendor, at renewal, keeps the no-exploitation claim intact while the fix dates keep moving.

## Takeaway

Palo Alto shipped PAN-OS hotfixes over the Oct 25-26 weekend and confirmed a second critical flaw, neither seen exploited, while Group-IB has counted more than 70,000 credentials already harvested through both vendors' devices. Fortinet reports Oct 28 and names its patched CVEs only on Nov 10-11.

## Sources

1. [CyberSecurityNews, Palo Alto Confirms Brotli Vulnerability Impact on PAN-OS and Releases Workarounds, 27 October 2026](https://cybersecuritynews.com/brotli-vulnerability-affects-pan-os/)
2. [BeInsure, Global cyberattack campaign targets Fortinet and Palo Alto firewalls, 27 October 2026](https://beinsure.com/news/global-cyberattack-campaign-targets-fortinet-palo-alto-firewalls/)
3. [TradingKey, Palo Alto Networks Inc Stock (PANW) Moved Up by 3.24% on Oct 26, 26 October 2026](https://www.tradingkey.com/news/market-movers/262240016-market-movers-panw-20261026)
4. [ad-hoc-news, JPMorgan raises Fortinet target to USD 140 for Fortinet stock, 26 October 2026](https://www.ad-hoc-news.de/boerse/news/corporate-news/jpmorgan-raises-fortinet-target-to-usd-140-for-fortinet-stock/70414076)
5. [The Hacker News, Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials, 23 October 2026](https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html)
6. [Help Net Security, Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June, 21 October 2026](https://www.helpnetsecurity.com/2026/10/21/ransomware-groups-exploit-palo-alto-globalprotect-cve-2026-0257/)
7. [Help Net Security, What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers, 22 October 2026](https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/)
8. [Yahoo Finance (Zacks), Fortinet Stock Before Q3 Earnings: Buy Now or Wait for Results?, 26 October 2026](https://finance.yahoo.com/markets/stocks/articles/fortinet-stock-q3-earnings-buy-151600630.html)
9. [Fortinet, quarterly figures from its SEC filings, retrieved 27 October 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001262039)


---

Two firewall vendors patch in parallel while attackers already hold the keys — The Inference. Canonical: https://theinference.org/article/two-firewall-vendors-patch-in-parallel-while-attackers-already-hold-the-keys