WAF Weekly: AI Reshapes Network Security, Gunra Hits Fortinet Flaws, Aug 10-14
AI is forcing vendors to rebuild how firewalls and SASE see traffic, Gunra ransomware exploits unpatched Fortinet gear, and the firewall makes a comeback in the agent era.
This week two threads defined where network security is heading. AI is forcing vendors to rebuild how firewalls and SASE see traffic, and a ransomware crew proved the perimeter still matters by exploiting unpatched Fortinet appliances on the internet. Both stories point the same direction: the edge is no longer a static inspection point, and patching still decides most breaches.
Gunra Ransomware Exploits Fortinet Flaws
CISA, the FBI, and South Korean agencies warned that the Gunra ransomware crew is targeting critical infrastructure worldwide. The operators gain initial access through internet-facing Fortinet FortiOS and FortiProxy appliances, exploiting CVE-2024-55591 and CVE-2025-24472. They then run a double extortion play that both exfiltrates and encrypts data. Since launching in April 2025 the group has listed 51 victims, mostly in East Asia and Europe. The Conti-derived crew now runs a formal RaaS program and ships both Windows and Linux lockers. The lesson is not new but it cuts deep. A known, patched Fortinet flaw is still the front door, and internet-facing appliances with WAF or virtual patching in front are the difference between a breach and a close call.
Fortinet Lifts 2026 Guidance on Firewall and SASE Demand
Fortinet raised its 2026 guidance on firewall and SASE demand. The company reported Q2 FY26 revenue of $2.05 billion and earnings of $606.3 million, with management pointing to broad momentum across network security, cloud, and zero-trust access. The results confirm that firewall and SASE budgets are still strong even as the broader security market tightens. Buyers keep paying for consolidated platforms that bundle network edge and WAF needs into a single contract, and Fortinet is reaping the benefit of that platform pull.
Akamai Q2: AI Growth, Cloud Gains, and Margin Risk
Akamai reported second-quarter profit of $79.4 million, or 52 cents per share, with adjusted earnings of $1.59 and revenue of $1.1 billion. Both beat Wall Street estimates. Management flagged AI-driven growth and cloud gains, while analysts highlighted margin risk as the company pivots toward AI delivery. Akamai's AI pivot reshapes its edge and WAF story. Its security platform increasingly sits in front of AI API traffic, and the open question is whether it can monetize that volume without diluting profitability as it chases AI workloads.
Check Point Adds an AI Network Firewall
Check Point released firewall software R82.20, which adds an AI Network Firewall designed to close the gap traditional firewalls were never built to see: prompts, autonomous agent actions, and sensitive business context. It runs on existing Check Point firewalls with no new infrastructure and is part of the company's AI Defense Plane. Check Point Research found up to 93% of organizations see at least one high-risk generative AI interaction per month, and one in 25 prompts now carries sensitive data. This is the firewall returning to relevance in the agent era. When a WAF and an AI-aware network firewall share an enforcement layer, defenders get inline control over AI traffic instead of another siloed tool.
Cloudflare Bets Developer-First Security Wins the Agent Race
Cloudflare is pressing its developer-focused angle in SASE and Zero Trust as enterprises secure AI agents alongside human users. Management says the shift toward agent-first security is winning deals, including a $5.2 million, three-year contract from a Fortune 100 tech company replacing legacy VPNs. Cloudflare cites rising demand as it competes with Zscaler and Palo Alto Networks. The SASE race is now an AI security race. Whoever can secure AI agents without slowing adoption wins the enterprise account, and Cloudflare is betting that its network performance and unified console give it the edge.
WAFplanet Take
The week's stories share one arc. AI is pushing security enforcement deeper into the network and edge layers, and ransomware crews are proving that unpatched perimeter gear is still the weakest door. The vendors winning attention this week are the ones folding AI visibility into infrastructure they already run instead of adding new boxes. For WAF operators the signal is clear: the edge is being rebuilt around AI-aware inspection, but the fundamentals, patching, segmentation, and immutable backups, still decide whether a breach happens at all.
