Fortinet Says Its October 22 FortiOS, FortiManager and FortiAnalyzer Updates Carry Critical Fixes From AI-Assisted Testing, With Advisories Held Until November 10
Fortinet said it would release FortiOS, FortiManager and FortiAnalyzer updates on Oct. 22 that include critical and high-severity fixes found through its frontier AI-assisted security testing program, and urged customers to upgrade immediately. It says public advisories will follow on November 10, arguing that AI lets attackers turn patches into exploits in hours or days. SANS notes the release names no CVEs.
Fortinet is asking customers to install critical fixes before it says what they fix, arguing that AI has cut the time attackers need to turn a patch into an exploit. In a blog post dated Wednesday, October 21, the company said it would release a coordinated set of security updates for FortiOS, FortiManager and FortiAnalyzer on Thursday, October 22, following recent releases for FortiMail and FortiAuthenticator. It says the updates fix vulnerabilities identified through its "frontier AI-assisted security testing program," and thanks Anthropic, OpenAI, Google and SpaceX "for their collaboration throughout this process."
What Fortinet is releasing
Fortinet says the releases "include critical and high-severity fixes." The fixed versions are FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14, and FortiManager and FortiAnalyzer 8.0.2, 7.6.8, 7.4.12 and 7.2.13, each listed as available on October 22. The company says "public advisories will be made available at the next Patch Tuesday on November 10" on its Product Security Incident Response Team page.
Why Fortinet says it cannot wait
Fortinet says it has built frontier AI models into its product security testing and that the same class of capability is becoming available to attackers, "particularly as open weight models improve." It argues that "AI tools can now help adversaries reverse-engineer patches and build working exploits in hours or days, rather than weeks," that published fixes reveal where code changed, and that AI can chain lower-severity flaws into a more severe one. It recommends prioritising change windows for October 22–23 for internet-facing systems. Customers who cannot upgrade at once should restrict administrative interfaces to trusted IP addresses, keep FortiManager administration off the internet and enforce multi-factor authentication for administrators, it says.
The SANS Internet Storm Center said Fortinet announced the updates after a security review using AI tools, "crediting a number of AI vendors but naming no CVEs and providing few details." The PHP2Shell flaws in PHP, which we covered on October 21, were also found with the help of frontier AI, according to Wiz and OpenAI.
Limits
- In the post we read, Fortinet gives no CVE numbers, severity scores or descriptions of the flaws. The severity and the role of AI in finding them are Fortinet's account.
- Fortinet does not say what each of the four companies it thanks contributed, or which flaws, if any, each helped find.
- We did not review FortiGuard's PSIRT listings or confirm that each release was available on October 22.