WAF Weekly: Fortinet Earnings, VMware Critical Flaws, Verizon DBIR Shift, July 27-31, 2026
Fortinet posts record Q2 with 26% revenue growth, VMware patches three critical vulnerabilities, and the 2026 Verizon DBIR reveals a historic shift as vulnerability exploitation overtakes credential theft.
Fortinet Q2 Revenue Surges 26% as SASE Firewall Strategy Gains Traction
Fortinet reported second quarter revenue of $2.05 billion, up 26% year over year and above the high end of guidance. Product revenue jumped 52% to $773 million. Billings rose 33% to $2.37 billion. The company raised its full year revenue guidance to 19% growth.
CEO Ken Xie credited the company's "SASE Firewall" approach, which integrates firewall, SD-WAN, and SASE on a single FortiOS operating system with purpose-built FortiASIC hardware. The company also launched FortiSOC, a cloud-delivered SOC platform, and partnered with Anthropic, OpenAI, and NVIDIA on AI security initiatives. Moody's upgraded Fortinet's credit rating to A3, the highest of any public cybersecurity company.
For WAFplanet readers, FortiWeb remains Fortinet's dedicated web application firewall, and the company's strong momentum suggests continued investment in the WAF and API security space.
Original source: Business Insider
Cloudflare Makes Internal DNS Generally Available
Cloudflare announced general availability of Internal DNS, a cloud-native authoritative and recursive DNS service for private networks. The service consolidates private and public DNS onto a single control plane with a unified API, audit trail, and policy registry. It comprises two components: Gateway Resolver for DNS security enforcement, and Internal Authoritative DNS for zone management.
The move expands Cloudflare's platform deeper into enterprise networking, competing with traditional DNS infrastructure and extending the company's reach beyond CDN and WAF into core network services. Some users have pushed back, noting the feature is enterprise-only despite Cloudflare's earlier promise of not shipping enterprise-exclusive features.
VMware Patches Three Critical Flaws Including Auth Bypass and VM Escape
Broadcom released patches for five VMware vulnerabilities, three rated critical. CVE-2026-59309 (CVSS 9.8) is an authentication bypass in the VMware Directory Service allowing unauthenticated attackers to gain full access to vCenter. CVE-2026-59310 (CVSS 9.8) is a directory traversal in the vCenter Syslog server enabling remote code execution. CVE-2026-47876 (CVSS 9.3) is an out-of-bounds write in the VMXNET3 virtual network adapter that allows a VM escape to the ESX host.
There are no workarounds. Organizations running affected versions should assume compromise. The vCenter issues are fixed in versions 9.1.0.0300, 9.0.2.0100, and 8.0 Update 3k. While a WAF cannot block a VM escape, it can help detect and block the reconnaissance and lateral movement that follows initial compromise.
Original source: BleepingComputer
Verizon DBIR 2026: Exploitation Overtakes Credential Theft for First Time
The 2026 Verizon Data Breach Investigations Report marks a historic shift: for the first time in its 19-year history, exploiting known software vulnerabilities has surpassed stolen credentials as the leading breach vector. About 31% of analyzed breaches began with vulnerability exploitation. The share of critical known-exploited vulnerabilities that were fully remediated dropped to 26%, down from 38% the year before.
AI tools now let attackers identify vulnerable systems and develop exploits within hours of a disclosure, outpacing most organizations' patch cycles. For WAFplanet readers, this reinforces the importance of virtual patching through web application firewalls as a bridge between vulnerability disclosure and permanent fix deployment.
Original source: Mintz via JD Supra
Cantina Launches with $8M for Agentic Security Automation
Cantina emerged from stealth with $8 million in funding to automate the work that happens after a vulnerability is found. Its platform runs AI agents across customer environments for discovery, triage, remediation, and verification. The company cites the 2026 Verizon DBIR's finding that only 26% of critical known-exploited vulnerabilities get fully remediated as evidence that the fix gap is widening faster than manual processes can handle.
Cantina's approach mirrors a broader trend: security operations is moving from detection-centric to remediation-centric workflows. The company holds trusted access with OpenAI and participates in Anthropic's Cyber Verification Program.
Russian Threat Group Exploits Microsoft OWA XSS Flaw in Active Campaigns
Proofpoint reported that Russian threat actor Laundry Bear (TA488) is actively exploiting CVE-2026-42897, a cross-site scripting vulnerability in Microsoft Outlook Web Access, to target U.S. and European government, telecom, financial, and aerospace organizations. The "half-click" exploit triggers upon viewing the email, deploying a JavaScript payload that harvests mailbox contents. The group previously used a similar technique against Zimbra.
This attack vector is a textbook case for WAF deployment. A web application firewall with XSS detection rules can identify and block the malicious payload before it reaches the OWA server, providing a layer of protection beyond patching alone. Azure WAF customers should review their OWA endpoint policies.
Original source: The Hacker News
Also Notable
- JetBrains disclosed CVE-2026-63077, a critical authentication bypass in TeamCity On-Premises enabling remote code execution. Given previous exploitation by ransomware and state actors, immediate patching is advised.
- Check Point launched its AI Network Firewall with R82.20, bringing AI traffic inspection (prompts, agent actions) to existing firewall hardware without new infrastructure.
WAFplanet Take
This week's stories share a common thread: the gap between vulnerability disclosure and remediation is widening, and attackers are exploiting it with increasingly automated tooling. The Verizon DBIR's finding that exploit-based breaches now lead for the first time should be a wake-up call. WAFs remain one of the most effective tools for closing that gap through virtual patching and real-time attack detection. Combined with strong patch management processes, they form a defense that can keep pace with today's threat landscape.
