🔍 Read the full analysis: AI Security In Focus: What This Week’s News Says To Do on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A weekly security roundup published October 29 highlights six developments affecting firewalls, Android banking and authentication, malicious documents, bot activity and patch priorities. The reports support practical steps such as applying vendor fixes, reviewing exposed credentials and verifying unexpected permission requests; some figures come from security companies’ own investigations.
A security roundup published October 29 identifies six recent developments for businesses and ordinary users, including an active campaign targeting Fortinet firewalls, Android tools used to steal banking credentials, and a backdoor delivered through a malicious PDF. The reports point to practical steps—especially applying vendor fixes and checking account security—but the roundup also cautions that several incident counts come from the security firms that investigated them.
The firewall warning combines two separate developments. The FBI and U.S. Secret Service said on October 6 that the FortiBleed campaign remains active, while Fortinet announced security updates for FortiOS, FortiManager and FortiAnalyzer on October 22. Fortinet said the fixes include critical- and high-severity issues and asked customers to prioritize the changes. Public advisories were scheduled for November 10, leaving the specific vulnerability details undisclosed in the material provided.
The federal agencies cited SOCRadar, which reported verifying more than 86,644 compromised devices across 194 countries. The roundup describes attackers reusing exposed passwords, guessing weak credentials and cracking password files, then creating administrator accounts. Hudson Rock separately reported examining 1,703 configuration reports from 1,689 devices and finding 40,573 password-bearing records. It said some entries were disabled; these are records, not necessarily distinct people or working accounts. Fortinet has said FortiBleed is not a new vulnerability in its products, attributing the campaign to reused or weak credentials and missing multifactor authentication.
Other reports cover different points of exposure. CloudSEK described MR ROBOT, an Android crime kit rented by criminals to create fake banking apps that can steal one-time codes and forward calls. Trellix traced a backdoor to a blank PDF disguised as a FedEx tax invoice; the reported infection depended on the user approving a PDF reader warning. Enclave researchers said another app could obtain Microsoft Authenticator login tokens on Android, and Microsoft has since fixed the issue, listed as CVE-2026-80097. Cequence tracked a scanner rotating among about 32 fake AI-bot identities while seeking password files and cloud keys.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Where the Attacks Find Access
The six items show how security failures can begin at different layers: an internet-facing firewall, a mobile app, a document prompt or a bot impersonating an automated service. For organizations, a compromised firewall can provide access to a broader network, while exposed work-account tokens can undermine protections that rely on authentication apps. For individuals, a convincing fake banking app can put both credentials and one-time codes at risk.
The practical implication is not that every organization faces the same threat or that every listed device remains compromised. It is that patching alone is not enough: teams also need to review credentials, multifactor authentication, backup files and access logs. Users can reduce risk by installing apps only from trusted sources and treating unexpected prompts or document warnings as a reason to stop and verify.
Patch lists also have limits. The roundup says CISA gave U.S. federal agencies three days to address PHP2Shell, while a critical Gotenberg flaw was not included on CISA’s Known Exploited Vulnerabilities catalog in the cited material. VulnCheck recorded 1,358 attack attempts in 30 days against Gotenberg. That figure is a reported count of attempts, not proof that 1,358 systems were breached. Security teams should use official lists as a baseline, not as a complete inventory of risk.
Products Worth Considering
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
EcoFlow Smart Home Panel 2 Whole-Home Backup System Hub
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Six Reports, One Weekly Roundup
The article from ThorstenMeyerAI.com summarizes a Thursday edition of The Hacker News’ weekly security digest, which it says contained 30 stories. Its author selected six, saying the selection was aimed at developments relevant to businesses and ordinary users, and says the original advisories or research reports were consulted. The roundup groups the six as two involving company-facing systems, two involving phones, one involving email or documents, and one involving prioritization of vulnerabilities.
The sources include government agencies, affected vendors and security research companies. Their roles matter when weighing the evidence: agencies and vendors provide advisories about campaigns and fixes, while firms such as SOCRadar, Hudson Rock, CloudSEK, Trellix, Enclave, Cequence and VulnCheck report findings from their own investigations. The roundup explicitly flags that many figures come from companies that sell security products. Readers should treat those numbers as attributed findings, rather than independently verified totals.
For the firewall issue, Fortinet’s October updates are distinct from the continuing FortiBleed credential campaign. One concerns software fixes; the other, as Fortinet describes it, involves credential exposure and weak account protections. Keeping those developments separate helps avoid interpreting the campaign as proof that the newly updated vulnerabilities were exploited.
““FortiBleed is not a new Fortinet vulnerability.””
— Fortinet
Counts and Advisories Still Pending
The full technical details of Fortinet’s October 22 fixes were not yet public in the source material; Fortinet scheduled the associated advisories for November 10. The material does not establish whether the newly fixed vulnerabilities were exploited in the FortiBleed campaign, and Fortinet describes that campaign as involving credentials rather than a new product vulnerability.
Several reported totals also have limits. Hudson Rock counted password-bearing records, including entries marked disabled, rather than confirmed active accounts or distinct victims. The SOCRadar device figure is attributed to that company through the federal advisory. The roundup does not provide independent confirmation of every research firm’s findings, nor does it establish how many users were harmed by MR ROBOT, the PDF backdoor or the Authenticator issue.
The account of the six items is incomplete at the end of the supplied source text, so it does not provide every original advisory detail or action. The available material also does not say whether the Gotenberg issue was later added to CISA’s catalog, or give a complete patch schedule for every product discussed.
Patch, Review, Then Recheck
Organizations using Fortinet products should review Fortinet’s October updates and prioritize the recommended changes, then consult the vendor advisories when they are published on November 10. Teams should also check for unexpected administrator accounts, rotate credentials that may have been exposed or reused, and confirm that multifactor authentication is enabled. The source does not specify a universal remediation checklist, so organizations should follow vendor guidance and their own incident-response procedures.
Security teams should assess PHP2Shell and Gotenberg against their actual software inventories instead of relying only on CISA’s KEV catalog. For the mobile findings, users and administrators should apply Microsoft’s fix for CVE-2026-80097 where relevant, review app provenance, and avoid approving unexpected prompts. The next confirmed milestone in the material is Fortinet’s scheduled publication of its advisories; broader incident totals and the status of other vulnerabilities may change as vendors and researchers release further information.
Key Questions
What is the main development in this week’s security roundup?
A roundup published October 29 selected six recent reports and advisories, covering a Fortinet firewall campaign, Android banking and authentication risks, a malicious PDF, fake AI-bot identities and vulnerability patch priorities.
Does FortiBleed mean Fortinet disclosed a new firewall vulnerability?
Not according to Fortinet. The company said FortiBleed is not a new Fortinet vulnerability and linked the campaign to reused or weak credentials and missing multifactor authentication. Fortinet separately issued October security updates for several products.
What should companies do about the Fortinet reports?
Review and prioritize Fortinet’s October updates, check for unexpected administrator accounts, and assess whether credentials may have been reused or exposed. Consult the vendor’s advisories, scheduled in the source material for November 10, for product-specific details.
Was Microsoft Authenticator on Android fixed?
The roundup says Microsoft fixed the reported issue that could allow another app to obtain work-account login tokens. It identifies the issue as CVE-2026-80097; users and administrators should follow Microsoft’s update guidance.
Does CISA’s vulnerability list cover every serious flaw?
No. The roundup says Gotenberg’s critical flaw was not on the cited CISA Known Exploited Vulnerabilities list, despite VulnCheck reporting 1,358 attack attempts in 30 days. That is an attributed count of attempts, not confirmed breaches, and the list should not replace checking software inventories.
Source: ThorstenMeyerAI.com
