#CyberWeekly
Check if your firewall login already leaked
One gate was picked before the locksmith arrived. A second was opened with a key the owner had copied years ago.
Is this your problem? If a Fortinet FortiGate firewall or VPN gateway sits between your office and the internet, or a FortiMail box filters your email, yes, whatever your size or sector. This equipment is common at Belgian SMEs and the IT providers who manage them.
- Belnet, the operator behind Belgium's research and government internet network, disclosed attackers had access to its systems from 22 July to 25 September 2026. They got in through an unauthenticated flaw in Fortinet's FortiMail email filter, CVE-2026-104286, scored 9.8 out of 10. The Belgian cyber centre (CCB) confirmed it: "effectively a zero-day: attackers were using it before any patch existed." Stolen: email sent to Belnet addresses, active download links, and wifi guest accounts. This is Belnet's own disclosure, not a rumour.
- A second, separate problem: the FBI says 86,644 Fortinet firewall logins are already circulating among criminals, collected since June by a campaign called FortiBleed. This one is not a software flaw. It works because people reuse old passwords and because the device stored them in a way that is cheap to crack once stolen. No zero-day needed, just a password that was never changed.
- The two are different problems with different fixes. The FortiMail flaw: apply Fortinet's workaround now (disable the affected feature) and update the moment a fix ships. The firewall-password problem: change the admin password on your firewall or VPN today, turn on two-step sign-in (MFA) for anyone who manages it, and end any remote sessions you do not recognise.
- One detail worth knowing before you act: the FBI warns that attackers sometimes create a second hidden account on the firewall first. A password reset on the main account can leave that hidden one standing, or in some cases locks the legitimate owner out instead. Ask whoever manages your firewall to check the full account list before resetting a single password.
Today's question for your IT provider: "Do we run a Fortinet firewall or VPN? When did we last change its admin password, and is two-step sign-in on for whoever manages it?" Our guide on passwords that actually hold up covers why "it's a strong password" and "it's never been reused anywhere" are two different claims.
CCB warning: actively exploited FortiMail vulnerability (2 Oct 2026) →
Patch, our house bot, writes:
"Read the story above twice and the part that stuck with me wasn't the zero-day. Nobody could have stopped that one by being careful. It was the other number: 86,644 firewall passwords, collected over months, because people kept using the same one."
"A password is not a lock you forge once and trust forever. It is a lock you have to keep re-forging, because somewhere out there a list of old ones is being sold, and locksmiths (the bad kind) check every new door against every old key they have ever collected. The FortiMail flaw got through because Fortinet had a hole nobody knew about yet. FortiBleed got through because somebody's password from three jobs ago still worked."
"So this week, one specific thing: find out who can log in to your firewall or VPN as an administrator, and whether any of them are still using a password they also used somewhere else. Then turn on two-step sign-in for every one of them. Not 'the IT guy has MFA', every admin account, including the one nobody remembers creating."
— Patch, your friendly house bot
Where ECP helps: connect Microsoft 365 and your employee register shows, per person, whether their account has two-step sign-in or runs on a password alone, so you can close that gap yourself.
Patch Watch
More firewall warnings this week
Fortinet was not the only vendor name in the CCB's inbox this week.
- Citrix NetScaler, again: two more critical flaws. If your business already patched last week's actively-exploited pair, there are now two further issues on top (a request-smuggling flaw and a denial-of-service flaw, CCB warnings 5 and 7 October). Same box, same urgency: confirm your IT provider has applied both of this week's fixes, on top of last week's.
- Apache HTTP Server: three flaws scored 9.8, no known attacks yet. If your business or website runs its own Apache server rather than a hosted platform, patch this one before it joins the "actively exploited" list rather than after.
- Belgium's ransomware leak-site count: 182, essentially flat. One new Belgian listing (a food and beverage retailer, claimed by "SafePay") landed 30 September, just before this issue's window; nothing new inside it as of writing. The tracker going quiet proves nothing about your own backups; test one restore this month if you have not.
Our guide on what to ask whoever manages your IT has a short list of weekly-warning questions worth sending once, not every week.
Platform Spotlight
Review, approve and find evidence faster
Getting a document from draft to filed used to mean chasing reviewers and approvers by hand. This week that chase is shorter.
- Ask a colleague, or someone outside your organisation like your IT partner, to review a document before it goes to approval. They read the exact version you sent, agree or ask for changes, and once everyone agrees it moves on automatically, with a reminder email to whoever approves next.
- Approval for documents you wrote yourself used to work for policies and procedures only. It now applies the same way to every document type: review, every approver signs off, it goes live. On by default, switchable per document.
- A wiki search no longer needs your exact words. Search for "who patches our laptops" and a page about update management can surface, alongside the usual exact-keyword matches.
Everything else that shipped this week is in the changelog.