Fortinet has shipped critical patches across five product lines and will not say what they fix until 10 November. FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14 and FortiManager and FortiAnalyzer 8.0.2, 7.6.8, 7.4.12 and 7.2.13 went out on 22 October. FortiMail on the 7.2, 7.4, 7.6 and 8.0 branches and FortiAuthenticator on 6.6 and 8.0 followed on 21 October. CVE identifiers and full advisories are scheduled for 10 November, nearly three weeks after the fixes.
Fortinet credits its AI-assisted security testing programme, which it runs with several vendors including Anthropic's Glasswing project, built on Mythos, and OpenAI's Daybreak project, built on GPT 5.5 Cyber. That makes this one of the first large vendor patch cycles where frontier models are named as the discovery mechanism rather than an acknowledgement footnote.
The gap between patch and disclosure is the contested part. Attackers can diff patched against unpatched binaries to locate a flaw without any advisory, and AI tooling has compressed the time between disclosure and working exploit. Yordan Ganchev of watchTowr expects these to be "rapidly reverse-engineered, reproduced, and exploited in the wild". Fortinet CISO Carl Windsor defends the sequencing, arguing that shipping critical fixes separately stops customers treating them as routine maintenance. Either way, the practical advice is the same: patch before 10 November, not after.
Sources
Cybernews · SecurityBrief