Fortinet Security Hardening Release and a PHP2SHELL Follow-Up: What SecureCyber is Doing
SecureCyber Blog | October 22, 2026
Fortinet is releasing a coordinated set of security updates today, October 22, for FortiOS, FortiManager, and FortiAnalyzer, following releases earlier this week for FortiMail and FortiAuthenticator. Fortinet's announcement is here: Fortinet Releases Security Hardening Release for Multiple Products. Fortinet is asking every customer to treat this as a priority change rather than routine maintenance and to upgrade internet-facing devices first. We agree, and for SecureCyber managed customers we are handling it.
What is different about this release
These fixes come out of Fortinet's frontier AI-assisted security testing program, in which AI models analyze code paths, protocol handling, and configuration logic at a depth and speed that traditional fuzzing and manual review cannot match. Fortinet credited Anthropic, OpenAI, Google, and SpaceX for collaboration on the work. The releases include critical and high-severity fixes, but the detailed advisories will not publish until Fortinet's next Patch Tuesday on November 10.
That gap is the reason for the urgency. Fortinet is being open about the fact that the same AI capability is available to attackers, and that once a patch is public, the fix itself shows where the weakness was. Reverse-engineering a patch into a working exploit used to take weeks. It now takes hours or days. Fortinet also noted that AI can chain lower-severity issues together into something more serious, so even fixes that look minor on their own matter. Unpatched devices become easier targets the longer the update sits on the shelf. The advisories will be posted on the FortiGuard PSIRT page when they are released.
Affected and fixed versions
FortiOS: 8.0.0 through 8.0.1 fixed in 8.0.2; 7.6.0 through 7.6.7 fixed in 7.6.8; 7.4.0 through 7.4.12 fixed in 7.4.13; 7.2.0 through 7.2.13 fixed in 7.2.14.
FortiManager: 8.0.0 through 8.0.1 fixed in 8.0.2; 7.6.0 through 7.6.7 fixed in 7.6.8; 7.4.0 through 7.4.11 fixed in 7.4.12; 7.2.0 through 7.2.12 fixed in 7.2.13.
FortiAnalyzer: same version ranges and fixed versions as FortiManager.
FortiMail: 8.0.0 through 8.0.1 fixed in 8.0.2; 7.6.0 through 7.6.6 fixed in 7.6.7; 7.4.0 through 7.4.8 fixed in 7.4.9. FortiMail 7.2 has no fix and needs to move to the 7.4 branch or later.
FortiAuthenticator: 8.0.0 through 8.0.3 fixed in 8.0.4; 6.6.0 through 6.6.10 fixed in 6.6.11.
FortiSASE was updated automatically ahead of today's release. FortiManager Cloud updates are available but may need to be applied manually. Public cloud instances are being pushed through the cloud providers on their normal schedules.
What to do if you manage your own Fortinet devices
Inventory every FortiOS and FortiManager instance and sort by internet exposure. Back up configurations before you touch anything. Schedule change windows for today and tomorrow for anything internet-facing, and watch logs for unusual administrative access or unapproved configuration changes before and after patching.
If you cannot upgrade immediately, reduce exposure in the meantime. Restrict HTTPS and SSH administrative access to trusted IP addresses, or disable it on external interfaces entirely. Make sure FortiManager is not reachable from the internet. Enforce MFA on every administrator account and confirm credentials are strong and unique. Fortinet also suggests moving resources behind VPN or SASE where feasible and applying virtual patches through IPS. None of this replaces the upgrade, but it narrows the window.
A note on PHP2Shell
This release comes on the heels of yesterday's PHP2Shell vulnerabilities, which affect any web service running PHP. The two are separate events that happen to land in the same week, but both need attention now. If you are unsure whether you are impacted by PHP2Shell, we recommend reaching out to the vendors who manage any web services you provide and confirming they have applied the PHP updates. Our full writeup is here: PHP2Shell: What You Need to Know and What SecureCyber Is Doing.
What SecureCyber is doing
For managed customers, this release is squarely in our lane. We are upgrading the central FortiManager and FortiAnalyzer platforms that manage and monitor your environments first, since those are the systems with the broadest reach. From there we are inventorying every managed FortiGate against the affected version list, prioritizing internet-facing devices. Managed customers will receive a ticket today scheduling the upgrade for your next maintenance window, with the devices and versions involved. If your next window is further out than you are comfortable with given the urgency, reply to the ticket and we will find an earlier slot. Where an immediate upgrade is not practical, we are applying the interim hardening above on your behalf until it is.
If SecureCyber manages your Fortinet environment, you do not need to take action on your own beyond acknowledging the ticket. If we do not manage it and you would like help with the upgrade or want a second set of eyes on your administrative exposure, reach out to your account team or sales@secdef.com.