The whole premise of perimeter security is that you can harden the edge of your network — the firewall, the VPN — and then let your data flow safely out to the cloud behind it. This week researchers detailed a global campaign that inverts that premise: a single threat actor compromised the edge appliances themselves, at organizations across four continents, and walked out with more than 70,000 credentials. The wall was the door.
credentials exposed from breached network devices and LDAP dumps
the firewalls and VPNs that were the way in — Fortinet and Palo Alto
a path traversal and an auth bypass in the edge appliances themselves
Researchers at Group-IB and NyxLab, reported by The Hacker News, detailed a worldwide campaign by a threat actor they track as 'k0t' that went after the devices at the edge of corporate networks — Fortinet FortiGate firewalls and Palo Alto Networks GlobalProtect, PAN-OS and Prisma Access. The actor scanned the internet for exposed appliances with tools like FOFA and ZoomEye, then exploited CVE-2025-64446 (a FortiWeb path traversal) and CVE-2026-0257 (a PAN-OS/Prisma Access authentication bypass). The haul: more than 70,000 credentials pulled from network devices and LDAP dumps, across victims on four continents.
Perimeter security makes a quiet trade: it assumes the edge can be held, so your data is safe to leave the building as long as it leaves through the right door. But the door is a product, written by people, with its own bugs — and when the firewall itself has an authentication bypass, the wall you were trusting becomes the fastest way in. This isn't a Fortinet or a Palo Alto problem; it's structural. Anything valuable that has to cross the edge is only as safe as the edge, and the edge is now where attackers look first.
One threat actor breached Fortinet and Palo Alto firewalls and VPNs worldwide via two CVEs, harvesting 70,000+ credentials from network devices and LDAP dumps.
The devices meant to protect the perimeter became the breach. Everything you route through the edge to the cloud is only as safe as an appliance with its own unpatched bugs.
Keep the workload that matters most off the edge entirely. If your AI runs on hardware inside the building and sends nothing out, a breached firewall has nothing of yours to expose.
The most resilient data is the data that never has to cross a boundary you don't own. A firewall is a wall with a door, and a door is a thing that can be opened. The compute that matters most shouldn't depend on a stranger's appliance staying unbreached — it should never leave the room it was created in.
On-device.
AuraVision runs the intelligence on hardware in your own building — Aura in the room, Farsight in the rack. Your prompts and your data never traverse a VPN or a firewall to a cloud, so there is no edge appliance standing between you and your own AI, and nothing of yours to dump when one of them is breached. You can't lose at the perimeter what was never routed through it.
Know someone who should see this? Send it to them.