The Era of the Secure Perimeter Is Over

Over the past week, researchers uncovered a large-scale attack campaign targeting firewalls and VPNs, while Palo Alto Networks, Citrix, and Fortinet disclosed critical vulnerabilities affecting network management and monitoring tools. Together, these incidents show how security infrastructure itself can become an entry point for attackers.

For infrastructure and security teams, the concern goes beyond network security. These systems can be connected to infrastructure running AI workloads and mission-critical applications, raising an important question: How far could an attacker reach after compromising one of them?

Firewalls and VPNs Are Already Being Compromised

On October 21, Group-IB and NyxLab published an investigation into a large-scale attack campaign linked to a threat actor known as k0t.

The attackers targeted Fortinet FortiGate, FortiWeb, and Palo Alto GlobalProtect systems, combining vulnerability exploitation and credential attacks to gain access to corporate networks.

Researchers identified more than 70,000 exposed credentials and related records, including network-device credentials and LDAP dumps.

But gaining access was only the beginning. Investigators found evidence of credential theft, persistent remote access, internal network reconnaissance, and data exfiltration.

Critical Vulnerabilities in Palo Alto and Citrix

Around the same time, Palo Alto Networks and Citrix confirmed that certain products were affected by two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, the two vulnerabilities are known as PHP2Shell.

The vulnerabilities can allow unauthenticated attackers to execute code in vulnerable PHP environments. Affected products include Palo Alto's PAN-OS and Panorama, and Citrix's NetScaler ADC and NetScaler Gateway, although the vendors assess the product-specific impact differently.

These vulnerabilities are particularly concerning because they affect management interfaces used to administer critical network infrastructure.

As of October 25, Palo Alto was preparing fixes for affected PAN-OS versions, while Citrix planned to release NetScaler updates on October 27. Both vendors recommended restricting management access.

Even Security Monitoring Tools Aren't Safe

Fortinet faced another critical issue involving its security monitoring platform, FortiSIEM.

A critical path-traversal vulnerability, CVE-2026-106173, could allow an unauthenticated attacker to execute commands on affected FortiSIEM systems.

On October 23, Canada's Cyber Centre warned that open-source reports indicated active exploitation.

FortiSIEM is designed to help organizations detect security threats. A compromise of the monitoring system itself could not only give attackers another foothold, but also undermine the visibility defenders rely on to detect threats.

Why Fortinet Patched Before Full Disclosure

On October 22, Fortinet released security updates for FortiOS, FortiManager, and FortiAnalyzer, following earlier updates to FortiMail and FortiAuthenticator.

The vulnerabilities were identified through its AI-assisted security testing program, with collaboration from organizations including Anthropic, OpenAI, Google, and SpaceX.

The company plans to publish the full vulnerability advisories on November 10, giving customers time to patch before detailed technical information becomes public.

Fortinet warned that AI tools could help attackers analyze patches and develop working exploits faster, giving customers less time to respond.

What This Means for Infrastructure and Security Teams

A compromised firewall, VPN, or management interface can have implications far beyond the affected device.

These systems may be connected to servers, storage, networking fabrics, and management networks that control critical infrastructure.

Consider a compromised network device with access to the management network. Depending on its privileges and connectivity, an attacker could potentially use that foothold to reach server management interfaces or other sensitive systems.

The risk depends on how these components are connected and what access exists between them.

That's why patching individual vulnerabilities, while essential, isn't enough on its own. Operators also need visibility into potential attack paths and the blast radius of a compromise across their infrastructure.

At Lava, we focus on connecting compute, network, storage, and management infrastructure into an end-to-end security graph. This helps operators understand how systems are connected, identify potential attack paths, and prioritize risks based on what a compromise could expose.

The real challenge isn't just securing individual systems, but understanding how a compromise could spread across the infrastructure.