Two incidents this month show the stakes. On October 16, Palo Alto’s Unit 42 disclosed that attackers who compromised FortiManager instances got an inventory of more than 500 downstream FortiGate firewalls, including serial numbers and public IPs, and used it to gain root on those firewalls. In the Reuters case, when the target application had no flaw, the agents moved to adjacent infrastructure and found an exposed control panel nobody was watching.
AI now finds the bug, writes the exploit and maps your estate faster than your team can. The defender’s one lasting advantage is knowing the estate better than the attacker: every device, version, exposure and owner. That knowledge has to drive action in hours, not quarters.
Network and infrastructure is the front line
The hardest systems to see are the ones getting hit hardest. Google reports that edge and security appliances accounted for 14 percent of exploited vulnerabilities this year, and two-thirds of those were high or critical. Mandiant notes these devices usually lack standard EDR telemetry. In October, actively exploited flaws hit Ivanti Connect Secure, Cisco Secure Email Gateway, Palo Alto PAN-OS, Fortinet FortiMail and FortiOS, SonicWall SMA and Citrix NetScaler. Then PHP2Shell exposed the management plane of nearly every major network vendor at once.
——————————————————-
Click Here For The Original Source.
