Check if your firewall login already leaked

One gate was picked before the locksmith arrived. A second was opened with a key the owner had copied years ago.

Today's question for your IT provider:

• Belnet, the operator behind Belgium's research and government internet network, disclosed attackers had access to its systems from 22 July to 25 September 2026. They got in through an unauthenticated flaw in Fortinet's FortiMail email filter, CVE-2026-104286, scored 9.8 out of 10. The Belgian cyber centre (CCB) confirmed it: "effectively a zero-day: attackers were using it before any patch existed." Stolen: email sent to Belnet addresses, active download links, and wifi guest accounts. This is Belnet's own disclosure, not a rumour.
• A second, separate problem: the FBI says 86,644 Fortinet firewall logins are already circulating among criminals, collected since June by a campaign called FortiBleed. This one is not a software flaw. It works because people reuse old passwords and because the device stored them in a way that is cheap to crack once stolen. No zero-day needed, just a password that was never changed.
• The two are different problems with different fixes. The FortiMail flaw: apply Fortinet's workaround now (disable the affected feature) and update the moment a fix ships. The firewall-password problem: change the admin password on your firewall or VPN today, turn on two-step sign-in (MFA) for anyone who manages it, and end any remote sessions you do not recognise.

CCB warning: actively exploited FortiMail vulnerability (2 Oct 2026) → https://ccb.belgium.be/advisories/warning-actively-exploited-fortimail-vulnerability-patch-immediately

by Patch, our friendly house bot

— Patch, your friendly house bot

Patch, our house bot, writes: Read the story above twice and the part that stuck with me wasn't the zero-day. Nobody could have stopped that one by being careful.

More firewall warnings this week

Fortinet was not the only vendor name in the CCB's inbox this week.

• Citrix NetScaler, again: two more critical flaws. If your business already patched last week's actively-exploited pair, there are now two further issues on top (a request-smuggling flaw and a denial-of-service flaw, CCB warnings 5 and 7 October). Same box, same urgency: confirm your IT provider has applied both of this week's fixes, on top of last week's.
• Apache HTTP Server: three flaws scored 9.8, no known attacks yet. If your business or website runs its own Apache server rather than a hosted platform, patch this one before it joins the "actively exploited" list rather than after.
• Belgium's ransomware leak-site count: 182, essentially flat. One new Belgian listing (a food and beverage retailer, claimed by "SafePay") landed 30 September, just before this issue's window; nothing new inside it as of writing. The tracker going quiet proves nothing about your own backups; test one restore this month if you have not.

CCB advisories (live list) → https://ccb.belgium.be/advisories

Review, approve and find evidence faster

Getting a document from draft to filed used to mean chasing reviewers and approvers by hand. This week that chase is shorter.

• Ask a colleague, or someone outside your organisation like your IT partner, to review a document before it goes to approval. They read the exact version you sent, agree or ask for changes, and once everyone agrees it moves on automatically, with a reminder email to whoever approves next.
• Approval for documents you wrote yourself used to work for policies and procedures only. It now applies the same way to every document type: review, every approver signs off, it goes live. On by default, switchable per document.
• A wiki search no longer needs your exact words. Search for "who patches our laptops" and a page about update management can surface, alongside the usual exact-keyword matches.

See everything that shipped → https://easycyberprotection.com/changelog/