The Watch

CISA added CVE-2026-104286, a FortiMail flaw, to KEV on Oct 1. Federal agencies got three days and mandatory forensic triage under BOD 26-04. The directive orders triage on top of mitigation, which means CISA assumes some appliances are already compromised. An unauthenticated arbitrary file write on an email gateway typically becomes persistence through a dropped web shell or a tampered config. The workaround blocks new requests and leaves any existing web shell or tampered config in place.

What specifically changed

The IBE (Identity-Based Encryption) endpoint accepts a crafted request and writes a file without authentication. As of Oct 6 there is no patched build for CVE-2026-104286. The 7.2 branch gets no same-branch fix. Teams on 7.2 should stage and test the cross-branch jump to 7.4.9 now, so it can deploy the day Fortinet ships the fix. The interim control is setting IBE Service to Off. Where IBE is business-critical, FG-IR-26-175 calls for pulling webmail off the internet and WAF-blocking POST requests to /ibe.

The pattern across the stack

Of these four critical fixes, three sit directly in the communications path. FortiMail is the gateway. Exchange is the server. Kiteworks EPG is an email protection gateway.

Why it matters

The Exchange flaw is the sleeper. It requires authentication and little else. Complexity is low and no user interaction is needed. Microsoft rates exploitation 'more likely' and shipped the fix out of band over a weekend with no attacks observed. Paired with any credential phish, a single low-privilege account reads the mail of the CEO and the General Counsel. Expect attackers to diff the patch and shorten the window. Exchange 2016/2019 receive fixes only through paid ESU Period 2. Servers not enrolled have no patch at all.

Kiteworks and Atlassian share a detection problem. Most of their flaws carry no CVE, so a CVE-driven scanner reports clean on exposed systems. For Kiteworks, confirm the running version is 9.4.1 or later; the scan result cannot confirm it. Secrets stored in any Atlassian web-root config should be treated as compromised until rotated.

Any internet-facing FortiMail that had IBE enabled is compromised until forensics shows otherwise. For the rest of the mail stack, check the running build; a CVE-driven scan will report clean either way.

Mistral Large 4 scored 82% on CyberGym. Cline attributes most of that lead to refusing less, not to capability. Opus 5.5 and GPT-6 Astra block roughly 40% of cyber tasks through their own safety filters. That 40% gap measures willingness. The closed frontier models can already do much of this work. Their refusals have been an implicit dependency that security programs never owned. This beat has seen that pattern before: a control nobody bought turns out to be load-bearing. For one high-capability model, the dependency ends when its open weights ship around Oct 27-31. Mirrored weights cannot be recalled. Fine-tuned derivatives with any remaining safety behavior stripped will follow.

Who runs it first

Reproducing a flaw is the core step in turning an n-day into a working exploit. Take an advisory or a patch, produce a trigger. Two constraints temper the near term. Large 4 is ~1T parameters (49B active), too large for a laptop, so early adopters will be resourced crews and hosted inference endpoints rather than commodity actors. The open-versus-closed argument is also unsettled. Arvind Narayanan argues that weeks without GLM-class incidents should lower open-model risk estimates. Nathan Lambert counters that closed-model risk is underweighted. Both are reading a thin record. AI assistance rarely leaves forensic fingerprints, so the absence of attributed AI incidents is weak evidence.

The bounty channel stalls

Google paused its OSS Vulnerability Reward Program on Oct 1 after thousands of hallucinated AI-generated reports overwhelmed maintainers. An update is promised in early 2027. HackerOne and managed providers hit the same wall. Ed Skoudis puts the economics plainly: the cost of generating a plausible report approaches zero, and the cost of proving it real does not fall. Upstream open source has lost a paid research incentive while triage queues grow. Real bugs in dependencies may take longer to fix.

Where the clock starts

The two trends squeeze the window from both ends. Offense against known-exploited, internet-facing flaws gets faster and cheaper. The disclosure channel that would flag new dependency bugs slows down. Neither produces a CVE to patch today. Both argue for measuring the patch clock from advisory publication rather than ticket creation, since the advisory is where the attacker's clock starts. The defensible posture is a pre-authorized emergency change path, with WAF virtual patching approved in advance as the stopgap.

What holds up after Oct 27-31 is patch speed, least-privilege for agents and out-of-band verification. AI vendors' refusal filters stop applying to this model once its weights are public.

Denmark's CPR register is the target, and the breach is a textbook abuse of a legitimate relationship. Intruders used a Danish company's authorized legal search access to the national register and brute-forced CPR numbers. A CPR number is 10 digits and begins with the person's date of birth. The haul was names, addresses and CPR numbers for roughly 8.8M people. That exceeds Denmark's living population because the register's ~11M records include emigrants and the deceased. The anomalous activity ran for about a month. Someone noticed on Oct 2.

The shared mechanism

The FBI incident tied to ShinyHunters belongs in the same category. It allegedly traces to an Accenture contractor's patch-management failure. Personal data of thousands of bureau employees was stolen. The contractor link is an allegation at this stage. Both incidents started with access granted to an outside party, though the techniques differed. In Denmark it was a company account with register access. At the FBI it was an unpatched system under a contractor's control. Trusted outsiders now supply primary initial access. Most monitoring is tuned for perimeter controls, and these paths sit outside them.

Per-partner baselines, and the end of static identifiers

Every exposed partner query interface (MITRE T1199) is a possible exfiltration channel. Each one needs a per-partner baseline, rate and data-volume limits, and detection for slow low-volume pulls and sequential or enumerative identifier queries. The CPR intruders worked with legitimate access and predictable IDs. The interface had no enumeration monitoring.

Static identifiers no longer prove identity. William Hugh Murray's guidance is to operate as though PII is already public. Help desks and customer support teams that verify callers with SSN, national ID, date of birth or address are running a failed control. The replacement is out-of-band confirmation or phishing-resistant authentication.

Where the detection gap sits

Most SOCs can detect a credential-stuffing spike. Most have no baseline for what normal volume looks like on a given partner's API. A month of undetected enumeration in Denmark is the direct result. The same instrumentation covers the Accenture-style gap. Patch-compliance telemetry and anomaly alerting on third-party and service accounts turn a silent initial-access path into an alert. These detection-engineering gaps can be closed without waiting for a vendor fix.

Vendor accounts and contractor patch cycles supplied the initial access in both cases. Identity checks that rely on data an attacker can already buy are due for retirement.