Zero Radar
← feed
CriticalSecurity incidentupdated 25 Oct 2026, 13:32 UTC

Attackers breach company firewalls and VPNs, stealing over 70,000 logins

Attackers got into company network gateways that let staff connect from home, and took tens of thousands of usernames and passwords. Those stolen logins could let attackers move deeper into company networks.

Attacks reported (The Hacker News)1 source, unconfirmed
SeverityCriticalSecurity incident
Being exploited?ReportedBy The Hacker News, not officially confirmed yet
What to doCheck exposureReset credentials and review access logs on any internet-facing FortiGate or GlobalProtect device you manage.
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Attacker scansFinds exposed edge devices on the internet
  2. 2Device breachedGains access to firewall or VPN
  3. 3Credentials stolenOver 70,000 logins obtained
  4. 4Internal accessAttempts to move into victim networks
  5. ResultAttackers gain entry to victim networks

What happened

A campaign has targeted internet-exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls/VPNs, leading to exposure of over 70,000 credentials.

Why it is dangerous: Attackers with valid credentials and access to firewalls or VPNs can enter internal networks, and they have reportedly attempted to further compromise some victims. Organizations worldwide using these devices are at risk.

Are you affected?

You are affected if you run internet-exposed Fortinet FortiGate firewalls or Palo Alto Networks GlobalProtect VPN/firewalls in your organization.

Fortinet FortiGate firewalls; Palo Alto Networks GlobalProtect firewalls/VPNs (specific versions unknown)

What to do

  1. Check whether your FortiGate or GlobalProtect devices are exposed to the internet and restrict management and VPN access where possible
  2. Reset passwords and review VPN and firewall logins, especially for accounts that may have been exposed
  3. Apply the latest vendor security updates and check vendor advisories for this campaign
  4. Review logs for unusual logins or access from unfamiliar sources

Timeline

  1. 23 Oct 2026, 13:50 UTC
    Publicly disclosed
  2. 23 Oct 2026, 13:50 UTC
    Reported by The Hacker News · The Hacker News

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-f059789b
Disclosed
23 Oct 2026, 13:50 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Attackers breach company firewalls and VPNs, stealing over 70,000 logins · Zero Radar