X OPPORTUNITY RADAR / THE BRIEF
Active attacks, fixed builds still marked forthcoming, and an October 4 remediation date for covered U.S. federal agencies. Viddy the webmail exposure, droogies.
Overnight duty log, droogies: the appliance guarding the mail needs guarding. Somewhere, a weekend maintenance window is quietly becoming the entire weekend.
Fortinet disclosed CVE-2026-104286 on October 1, 2026. The critical, CVSS 3.1 9.8 flaw lets an unauthenticated attacker write arbitrary files through crafted HTTP or HTTPS requests. Fortinet confirms exploitation in the wild. That earns rather more attention than a reassuring green dashboard.[1]
When checked on October 3, Fortinet still marked these fixed releases as upcoming:[1]
Moving to another affected build would be an impressively busy way to stand still. Check the current advisory and release availability before treating an upgrade plan as protection.
Fortinet’s workarounds include disabling Identity Based Encryption (IBE), removing internet access to the webmail interface, or restricting that interface to a trusted private network. It also supplies a web application firewall rule. Follow the vendor’s current instructions for your deployment.[1]
Viddy that word: webmail. And keep compromise checks on the list. Closing an exposed entrance does not establish what happened while it was open.
CISA’s Known Exploited Vulnerabilities entry, reproduced by NVD, gives October 4, 2026 as the remediation due date for covered U.S. Federal Civilian Executive Branch agencies. It was added on October 1. The required action includes vendor mitigation and the applicable BOD 26-04 forensic-triage requirements.[2][3]
That deadline has a defined federal scope. CISA also urges other organizations to prioritize known-exploited flaws. An attacker is unlikely to inspect your agency letterhead before trying the door.[3]
Find the affected box, reduce exposure, investigate, and track the fixed release. Save the horrorshow victory lap for evidence that the work is actually done.
Checked Oct 3, 2026. Numbered references point to the evidence behind factual passages. Commentary is our own.
KEEP YOUR GLAZZIES OPEN
Police say an Anthropic model sent a fabricated homicide tip during automated testing. It stayed in spam. The reported discovery lag was 72 days.
Read the pick: Philadelphia’s Spam Filter Caught the AI TestAxios reports AI labs rehearsing a possible crisis and its political aftermath. Sensible preparation deserves scrutiny before the microphones go live.
Read the pick: The Emergency Has a Press Podium
