Harden Contracts and Patching After Ransomware, Zero‑Day, Logistics Breach

What happened

US cyber agencies warn that Gunra ransomware affiliates are exploiting authentication-bypass vulnerabilities in Fortinet FortiOS and FortiProxy to gain administrative access and conduct data theft plus encryption. The advisory links the actor to specific CVEs and describes a Linux variant capable of highly parallel and partial-file encryption, making compromises more damaging operationally. Watch vendor patch confirmations and whether exploit activity extends to other appliance families or unpatched estate segments

Why the category manager should care

Treat Fortinet appliance exposure as an actionable procurement gap: demand patch evidence, hardened configurations, and contractual remediation support before renewal or new buys

Key facts

• Exploits tied to Fortinet CVE references called out in the advisory
• Ransomware operates as ransomware-as-a-service with global affiliates
• Linux variant supports high-parallel encryption and partial-file encryption

What happened

Microsoft's Patch Tuesday fixed hundreds of vulnerabilities and included a Windows use-after-free zero-day that North Korea's Lazarus Group has already exploited to deploy a kernel-mode rootkit. The presence of observed exploitation makes immediate patch validation and controlled rollouts for sensitive endpoints operationally necessary. Watch vendor KBs and MSP rollback procedures for changes that may affect uptime or require coordinated forensic handoffs

Why the category manager should care

Confirm MSPs and endpoint suppliers have tested patch rollout and rollback plans and include proof of successful deployment for prioritized systems

Key facts

• Monthly patch cycle covered hundreds of vulnerabilities
• CVE-2026-68820 was exploited in the wild and linked to kernel-rootkit deployment
• Other notable flaws include remote-execution exposure in Windows services

What happened

A cyberattack on CEVA disrupted multiple European warehouses and likely exposed customer order data, producing shipment delays and follow-on customer notifications for affected partners. The incident is operationally material for buyers reliant on third-party warehousing because it manifests as delayed deliveries, lost visibility, and potential data-liability exposures. Watch supplier communications for scope of affected facilities and any proposed contractual changes to notification or retention policies

Why the category manager should care

Treat logistics suppliers as critical cyber and continuity vendors: demand incident playbooks, notification SLAs, and data-retention limits contractually

Key facts

• Attack impacted multiple European warehouse facilities
• Customer order data retained by the provider was likely exposed
• Some affected facilities had not fully restored operations at latest reporting

What happened

Together AI signed a large IBM Cloud deal to run inference on Nvidia HGX B300 clusters, citing IBM's available capacity as the deciding factor. Operational importance stems from major buyers reserving capacity ahead of need, which affects availability and pricing for others seeking inference infrastructure. Watch cloud providers for allocation guarantees or revised commercial models that reflect demand concentration

Why the category manager should care

Negotiate allocation, priority access, or pricing-protection clauses for GPU-heavy workloads instead of relying on spot or ad-hoc availability

Key facts

• Deal secures a large deployment of Nvidia HGX B300 systems for inference
• B300 boxes are deployable in traditional air-cooled datacenters
• Capacity is being taken online on the vendor's announced timeline