THE SHORT ANSWER
● What shipped — Patches for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator on 21-22 October
● What did not — CVE identifiers and advisories - those land 10 November
● Who found them — Fortinet's AI-assisted testing programme, with Anthropic's Glasswing and OpenAI's Daybreak
● What to do — Patch before 10 November, not after
Convention is that a vendor publishes the advisory and the fix together, so defenders can judge urgency and attackers gain nothing they did not already have. Fortinet has done the opposite: fixes on 21 and 22 October, CVE identifiers and full advisories on 10 November.
The two positions
| Patch first, disclose later | Coordinated disclosure |
|---|
| Urgency signal | High - an unexplained critical patch gets attention | Mixed - advisories arrive with routine updates |
| Defender information | None until disclosure | Full at patch time |
| Attacker information | The patch itself, via diffing | The patch itself, via diffing |
| Change-window justification | Hard - no CVE to cite to a change board | Straightforward |
| Compliance and scanning | Tooling keys off CVE IDs that do not exist yet | Works immediately |
| Net effect on the race | Favours the attacker | Neutral |
What shipped, exactly
FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14, plus FortiManager and FortiAnalyzer 8.0.2, 7.6.8, 7.4.12 and 7.2.13, all released 22 October. FortiMail across the 7.2, 7.4, 7.6 and 8.0 branches and FortiAuthenticator on 6.6 and 8.0 went out 21 October. Five product lines, all rated critical.
The AI angle is not decoration
Fortinet credits its AI-assisted security testing programme, run with several vendors including Anthropic's Glasswing project, built on Mythos, and OpenAI's Daybreak project, built on GPT 5.5 Cyber. This is one of the first large vendor patch cycles where frontier models are named as the discovery mechanism rather than thanked in a footnote - and it cuts both ways, because the same class of tooling compresses the time from patch to working exploit.
Why the delay favours attackers
Patch diffing is the whole problem. Comparing a patched binary against an unpatched one locates the changed code, and the changed code is the vulnerability. No advisory required. Yordan Ganchev of watchTowr expects these to be "rapidly reverse-engineered, reproduced, and exploited in the wild". Meanwhile defenders have no CVE to take to a change board, no entry in their scanner, and no severity rating to prioritise against the other forty things in the queue.
So the asymmetry is clean: attackers get what they need on day one, defenders get it on day twenty.
Fortinet's argument, fairly stated
CISO Carl Windsor's position is that bundling critical fixes into a normal advisory cycle teaches customers to treat them as routine maintenance, and that releasing them separately and conspicuously breaks that habit. Anyone who has watched a critical patch sit unapplied for a quarter because it arrived alongside eleven low-severity items will recognise the problem he is describing. The disagreement is about whether the cure costs more than the disease.