🔍 Read the full analysis: AI Teams’ Guide To This Week’s Security Fixes And Threats on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A security roundup published October 29 highlights six developments affecting firewalls, Android phones, email, AI-related access controls and patch priorities. The source recommends prioritizing Fortinet updates and reviewing exposed credentials, while noting that some threat figures come from security vendors and that public details on the Fortinet fixes are pending.
A security roundup published October 29 highlighted six developments for businesses and everyday users, led by active attacks against Fortinet firewalls and coordinated security updates for Fortinet products. The report also described an Android banking crime kit, a backdoor delivered through a disguised PDF, a fixed Microsoft Authenticator issue, automated scanning using fake AI-bot identities, and a gap between official patch lists and other reported attack activity.
The roundup, based on a 30-story weekly digest from The Hacker News, says Fortinet released critical and high-severity fixes for FortiOS, FortiManager and FortiAnalyzer on October 22. Fortinet has kept the related advisory details private until November 10. Separately, the FBI and U.S. Secret Service warned on October 6 that a campaign dubbed FortiBleed remained active. The agencies cited SOCRadar, which reported verifying more than 86,644 compromised devices across 194 countries.
According to the roundup, FortiBleed involves attackers reusing leaked credentials, guessing weak passwords and cracking password files, then creating administrator accounts on affected firewalls. The agencies named ransomware groups INC/Lynx and Payload as buyers of access. Fortinet has said the campaign does not exploit a new Fortinet vulnerability, instead pointing to reused credentials and weak passwords on devices without multi-factor authentication. Hudson Rock separately analyzed 1,703 configuration reports from 1,689 devices and counted 40,573 records containing plaintext passwords. Those are records, not confirmed active accounts or distinct people; the company said 7,437 local accounts were marked disabled.
Other items in the roundup include CloudSEK’s October 28 report on MR ROBOT, an Android crime kit rented by criminals to create fake banking apps that can steal one-time codes and forward calls. Trellix reported October 26 that an empty PDF disguised as a FedEx tax invoice delivered a backdoor after a user accepted a PDF reader warning. Microsoft has fixed an Android Authenticator issue identified by Enclave that could expose work-account login tokens to another app. Cequence said it tracked a scanner cycling through about 32 fake AI-bot identities while requesting password files and cloud keys. Finally, the roundup contrasted CISA’s three-day federal patch deadline for PHP2Shell with VulnCheck’s report of 1,358 Gotenberg attack attempts in 30 days; Gotenberg was not on CISA’s Known Exploited Vulnerabilities list at the time described.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Where Teams Should Focus First
The reports point to practical security risks that do not depend on a new, sophisticated exploit: reused or weak passwords, a user approving a warning, or software accepting another app’s identity claims. For organizations, a compromised firewall can expose a network’s entry point and enable attackers to create accounts or sell access. The reported configuration records also show why firewall backups need careful access controls: they can contain sensitive credentials.
For individuals, the Android banking kit’s ability to capture one-time codes and forward calls targets steps people may rely on to protect accounts. A fix to Authenticator reduces a specific exposure, but organizations still need to apply the update and check affected devices. The reports are a reminder that a security team’s patch queue should account for vendor advisories and credible reports of attacks, not only a single government list.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB
HP Sprocket Photo Booth Machine Instant Color Photo Printer with 10.1 Touchscreen, LED Ring Light, 250+ Frames, 3×4 ZINK Paper, QR Code Shar
As an affiliate, we earn on qualifying purchases.
How This Week’s Reports Fit
The source selected six stories from a weekly Hacker News digest of 30 security items, prioritizing issues it considered relevant to companies and ordinary users. It says it checked original advisories or research reports for the selected items. The roundup also cautions that many figures come from security vendors that sell protective services, and attributes company-specific counts to those firms.
Fortinet’s October 22 updates are distinct from the FortiBleed campaign: the company issued software fixes, while the campaign described by U.S. agencies relies on compromised or weak credentials. The two developments nonetheless converge on the same devices, so administrators need to review both patch status and account security. The source says Fortinet’s public advisories for the latest fixes were scheduled for November 10.
“FortiBleed “is not a new Fortinet vulnerability.””
— Fortinet
What the Reports Do Not Establish
The roundup does not establish how many of the firewall records Hudson Rock counted correspond to currently active accounts or how many devices remain exposed. Its figures describe records and reports analyzed, not a verified total of victims. Fortinet’s detailed public advisories for the October 22 fixes were not yet available, so the specific vulnerabilities, affected versions and required upgrade paths were not included in the source material.
The MR ROBOT and PDF-backdoor reports describe research findings, but the source does not give a complete count of victims or confirmed successful attacks. Cequence’s scanner count is a company observation; the roundup provides no independent estimate of how many sites were affected. The Gotenberg attempt count is attributed to VulnCheck and covers a stated 30-day window, but the material does not say how many attempts succeeded. CISA’s list is also not a complete inventory of every vulnerability under attack.
Patch, Review, Then Recheck
Fortinet customers should review the October 22 updates for FortiOS, FortiManager and FortiAnalyzer and apply the relevant fixes according to vendor guidance. When the detailed advisories are published on November 10, administrators can confirm affected versions and any additional remediation steps. Teams should also check firewall accounts for unfamiliar administrators, replace reused or weak passwords, enable multi-factor authentication where available, and restrict access to configuration backups.
Android users and IT teams should install available updates for Microsoft Authenticator and obtain banking apps only from trusted sources. Organizations should review PDF-reader warnings and monitor systems for suspicious document activity. Security teams can use CISA’s KEV list as one input, while checking vendor advisories and reputable threat research for active activity not listed there. The source does not specify a confirmed date for further updates on the other reports.
Key Questions
What is the main security development in this roundup?
The lead issue is a continuing campaign targeting Fortinet firewalls, alongside critical and high-severity Fortinet updates released October 22. The source treats the campaign and the software fixes as related priorities, but says the campaign relies on credentials rather than a new Fortinet vulnerability.
Does FortiBleed exploit a newly discovered Fortinet flaw?
Fortinet said the campaign does not involve a new Fortinet vulnerability. The FBI and U.S. Secret Service warned that the activity remained ongoing and described attackers using leaked or weak credentials to gain access.
What should Fortinet administrators do now?
Review and apply the relevant October 22 updates, inspect firewall administrator accounts, replace reused or weak passwords, enable multi-factor authentication where possible, and protect configuration backups. Check Fortinet’s detailed advisories when they are published on November 10.
What is MR ROBOT?
CloudSEK described MR ROBOT as an Android crime kit rented by criminals to build fake banking apps. The report says those apps can steal one-time codes and secretly forward calls; the roundup does not provide a victim count.
Does CISA’s exploited-vulnerability list include every active threat?
No. The roundup says Gotenberg was not on CISA’s Known Exploited Vulnerabilities list even though VulnCheck reported 1,358 attack attempts over 30 days. That count does not establish how many attempts succeeded, and the list should be treated as one source for patch decisions rather than a complete account of threat activity.
Source: ThorstenMeyerAI.com
