Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Starting on January 15, 2026, Arctic Wolf began observing a new cluster of automated malicious activity involving unauthorized firewall configuration changes on FortiGate devices. This activity involved the creation of generic accounts intended for persistence, configuration changes granting VPN access to those accounts, as well as exfiltration of firewall configurations.

As technology evolves, so do the security foundations that underpin the systems we rely on every day. One such foundational change is coming soon from Cisco Duo, the widely‑used multi‑factor authentication (MFA) platform that many organisations deploy to secure access to critical systems. Although this change isn’t a vulnerability in the traditional sense, it could impact the availability of Duo authentication services for outdated software and integrations.

Let’s be honest: in 2026, the traditional “firewall” is a bit of a relic. Having spent years analyzing how threat actors operate, I can tell you they aren’t banging on your front door anymore. Why would they? It’s much easier to build a pixel-perfect replica of your front door down the street and trick your customers into handing over their keys there.

The answer to whether WAF can see and prevent browser attacks that break PCI compliance depends on the lens you use. Through the lens of Requirement 6.4.2, the answer is mostly yes. But through the lens of 6.4.3 and 11.6.1, it gets a little blurry. Requirement 6.4.2 is about stopping web-based attacks at the application layer by inspecting outbound and inbound HTTP traffic at the server side.