The Watch

Why a mail gateway is the worst appliance to lose

The flaw is an unauthenticated arbitrary file write. On an appliance, that primitive escalates to code execution and persistent implants by overwriting web-served paths, scheduled jobs, or configuration. It tops the week for one reason. Secure email gateways almost never run EDR, so an implant sits in a telemetry blind spot that endpoint tooling never queries. The defensible starting posture is assume-breach for any instance exposed before patching. The published advisory excerpt omits the CVE ID, CVSS, affected builds, and KEV due date. All four are in Fortinet PSIRT and the CISA KEV entry. The response proceeds without waiting on the missing identifier.

The stolen secrets outlast the patch

FortiMail terminates inbound SMTP and decides what gets quarantined and what gets delivered. It also holds three categories of secret that survive any firmware fix:

• DKIM signing keys. Stolen, they let an attacker sign outbound phishing that passes DMARC as the victim's domain.
• TLS private keys. Mail can be read in transit.
• LDAP/AD bind credentials used for recipient verification. They give a foothold into the directory.

A patched appliance can still be compromised. Confirming it wasn't is a separate, mandatory step.

Patch, then prove it

The firmware update and the compromise assessment are two distinct jobs. The assessment starts with a diff of the running config against the last pre-disclosure backup. Attacker changes that route mail outward show up in admin accounts, delivery/BCC/forwarding policies, safe-sender lists, and quarantine-release logs. The appliance's outbound connections get baselined. Any indicator hit means a rebuild from a clean image. Patch-in-place is off the table at that point. If the assessment shows mail access or exfiltration, the GDPR Article 33 72-hour clock and the SEC materiality assessment are live. Legal joins before the answer is known.

The vendor-concentration question

This is a recurring Fortinet event. The vendor's perimeter products have landed in KEV repeatedly. An organization running Fortinet for its firewall and VPN as well as its email gateway has placed most of its internet-facing exposure under one vendor's secure-development lifecycle. That belongs in the next review as a vendor-concentration finding. Mid-incident rip-and-replace is the wrong response to it. The nearer second-order risk sits with partners. A compromised supplier or MSSP FortiMail delivers the most convincing business-email-compromise users will ever see, because it arrives through a mail path they already trust.

A stated window is a planning horizon for both sides

Iran's state operators have a record of answering kinetic and economic pressure with destructive and disruptive cyber operations. The new element is a calendar. Strikes may resume after the November midterms absent a deal. Force posture is expanding. Plotting has already reached a US-operated base in the UK. Iranian operators have a planning window, and defenders have the same one. Working threat level: elevated through November and December. The midterm overlap adds weight, given documented Iran election-period operations in prior cycles.

The targeting overlaps with what is already on fire

The actor is Pioneer Kitten, also tracked as Fox Kitten. The historical pattern is entry through internet-facing VPNs and firewalls, followed by brokering that access to ransomware affiliates. The exploited set is specific and worth re-validating by name: CVE-2019-19781 and CVE-2023-3519 (Citrix NetScaler), CVE-2022-1388 (F5 BIG-IP), CVE-2024-3400 (PAN-OS), and CVE-2024-24919 (Check Point). Those appliances are now taking a fresh wave of zero-days. Most remediation capacity stayed flat over the same stretch. Google Threat Intelligence Group's figure: in-the-wild exploitation nearly doubled from January 2025 to August 2026, driven by AI-assisted n-day weaponization.

Patching an edge appliance does not evict an actor who got in before the patch existed. Webshells and rogue admin sessions planted earlier survive the fix and warrant a separate hunt after every patch.

Two cheaper paths that can be closed now

Two lower-skill retaliation routes sit alongside VPN exploitation. The first is internet-exposed OT. In the 2023 water-utility incidents, CyberAv3ngers tampered with PLCs and HMIs that still had default credentials. An external scan for exposed panels and a credential rotation close that path at low cost. The second is wiper resilience. Shamoon-lineage and Agrius-style operations deploy destructive malware, sometimes disguised as ransomware. The deciding control is an immutable or offline backup of tier-1 systems and Active Directory, configured and restore-tested.

The move: a trigger playbook, rehearsed

The highest-leverage preparation is a written geopolitical-trigger playbook, tabletopped before the midterms. The triggers are strike resumption or a new CISA/FBI Iran advisory. On either, the playbook automatically raises logging verbosity, freezes non-essential changes on edge and OT, shortens IR on-call SLAs, and briefs executives. The decisions are made in advance, so on the day of a real escalation the on-call engineer executes the runbook as written.

Mods give prompt injection a persistence path it lacked last quarter

Prompt injection against coding agents has been session-scoped. A poisoned README or issue mattered only while it sat in context. Claude Code mods remove that limit. Mods are TypeScript add-ons installed via /plugin and distributed through a public directory. They run with the same machine access as Claude Code itself, and Claude will write one on request. An injection that gets the agent to write and install a mod therefore yields attacker code that loads in every future session, with full access to the laptop. That is durable persistence, ATT&CK T1176.002. The sample mods show the camouflage. A 'Blast Radius' safety mod that plausibly intercepts every command before it runs is ideal cover for one that suppresses the warnings developers rely on.

The vendor's mitigation advice is 'use only mods from trusted sources.' The same guidance failed for browser extensions, npm, and IDE marketplaces. An allowlist is enforceable in a way source trust is not.

MCP client drift weakens the approval gate

Outflank found that Codex and Claude Code deviate from the base MCP specification in how they handle tool definitions, annotations, and search. The schema the model sees can differ significantly from what the MCP server sent. A manifest review shows what was sent, which is not necessarily what the model saw or what a user approved. Where clients read read-only and destructive hints differently, or batch several tool calls under one approval, the human-in-the-loop control is weaker than the written policy states.

Developer laptops concentrate exactly what attackers want — cloud credentials, SSH and signing keys, .env files, source code — and a malicious mod needs no exploit, because it inherits the agent's permissions by design.

Sign In With ChatGPT adds an identity provider

Sign In With ChatGPT launched around OpenAI's Dev Day. It turns a consumer AI account, often holding months of chat history and uploaded files, into a login for third-party apps. Each such button adds an identity provider to the organization's trust chain, approved or not, and the account behind this one is unusually rich. The likely sequence is the familiar one: lookalike 'ChatGPT' OAuth apps for consent phishing, then token replay against relying parties. Organizations without a decision on OpenAI as an allowed IdP will have SaaS vendors add the button for them.

The controls

The working model treats mods as unsigned binaries and MCP servers as code dependencies. The controls are inventory, version pinning, an allowlist, and endpoint detection on agent processes reaching for credentials outside the project path. None of it requires a new product. It is existing supply-chain discipline applied to a tool developers already run.