How can I find out which kernel extension has been updated?

Solution 1:

The name of the software developer and the contents of the kernel extension is cryptographically signed to ensure that it cannot be tampered with. Therefore I do not think it is likely that someone is pretending to be Apple, or that they're trying to modify an Apple extension.

However, I do think it is likely that some software you've installed (presumably FortiClient) has attempted to install an Apple kernel extension. I.e. an authentic Apple kernel extension that either wasn't installed before, or was installed in a version that the software wasn't compatible with - and so that developer has made the software so that it attempts to install the right version of Apple's kernel extension that they want to use.

I wouldn't exactly say that's a good way of doing things - and certainly not without informing the user - but it does sounds like a thing that could happen in practice without it being nefarious.