🔍 Read the full analysis: A Practical Look At AI Security This Week: What To Fix And Watch on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A security roundup dated October 29 identifies six developments affecting firewalls, Android phones, email, AI-bot identification and vulnerability prioritization. The source recommends treating Fortinet updates and exposed firewall credentials as urgent, while noting that some figures come from security vendors and that several advisories remain incomplete.
A security roundup published October 29 highlights six developments for businesses and everyday users, led by active attacks against Fortinet firewalls and newly released fixes for Fortinet products. The report also covers Android banking malware, a backdoor delivered through a disguised PDF, a fixed Microsoft Authenticator issue, automated credential scraping and gaps in official vulnerability-priority lists.
The roundup draws on a weekly digest from The Hacker News, then checks the selected items against original advisories or research reports. Its publisher says the aim is to identify six practical risks and offer a clear action for each. It also cautions that many of the numerical estimates come from security companies that discovered the activity and may sell related protection.
For network administrators, the immediate focus is Fortinet. The company released security updates for FortiOS, FortiManager and FortiAnalyzer on October 22, with fixes described as critical and high severity. Fortinet asked customers to prioritize the changes; public advisory details are scheduled for November 10. Separately, the FBI and U.S. Secret Service said the FortiBleed campaign remained active. Their advisory cited SOCRadar’s count of more than 86,644 compromised devices across 194 countries. That figure is attributed to the security firm, not an independently established government tally.
Other items point to risks outside network equipment. CloudSEK reported that the MR ROBOT Android crime kit is rented to criminals to create fake banking apps that steal one-time codes and forward calls. Trellix described a backdoor hidden in an empty PDF presented as a FedEx tax invoice; the report says infection depended on the recipient accepting a PDF reader warning. Researchers also reported that an Android issue in Microsoft Authenticator could expose work-account login tokens to another app. Microsoft has fixed the issue, listed as CVE-2026-80097.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Where Teams Should Focus First
The six reports share a practical lesson: attackers can exploit ordinary weaknesses rather than relying on a single new technique. The roundup points to internet-facing login pages, reused or weak passwords, a user accepting a prompt, and software trusting another program’s identity. These are different problems, but each can expose accounts, networks or company data.
For organizations, the firewall stories combine two distinct concerns: active credential-based intrusions and newly disclosed product fixes. Updating affected devices addresses software flaws, while changing exposed or reused credentials, enabling multifactor authentication and reviewing administrator accounts address the campaign described by law enforcement. One measure does not replace the other.
For individuals, fake banking apps and malicious attachments can put account access at risk. The Authenticator report also matters to employers because work login tokens may grant access to company services. Taken together, the stories support checking app sources and permission prompts, keeping devices current, and treating security warnings as decisions with consequences—not routine clicks.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
As an affiliate, we earn on qualifying purchases.
How This Week’s Alerts Connect
The source describes its article as a selection from 30 stories in The Hacker News’ October 29 weekly digest, not a complete record of every security event. It says it reviewed the original advisory or research for each of its six selections. The stories span different kinds of evidence: government warnings, vendor patch notices and reports from security researchers.
The FortiBleed campaign is described as using credentials obtained from earlier incidents, weak passwords and password cracking, rather than a newly discovered Fortinet vulnerability. The FBI and Secret Service warned on October 6 that the campaign was continuing. Fortinet has said FortiBleed is not a new Fortinet vulnerability and has pointed to reused credentials, password guessing and missing multifactor authentication.
The roundup also says the U.S. Cybersecurity and Infrastructure Security Agency gave federal agencies three days to address PHP2Shell, while a critical flaw in the Gotenberg document tool was absent from CISA’s Known Exploited Vulnerabilities catalog. VulnCheck recorded 1,358 attack attempts in 30 days against Gotenberg, according to the source’s account. That number is a reported observation for that time window, not a comparison with a stated baseline.
“FortiBleed is “not a new Fortinet vulnerability”.”
— Fortinet, as quoted in its June 19 PSIRT statement
What the Available Counts Show
The reported numbers do not all describe the same thing. SOCRadar’s figure is a count of devices it said were compromised, while Hudson Rock’s later analysis counted records found in firewall configuration reports. Hudson Rock examined 1,703 reports from 1,689 devices and counted 40,573 records containing passwords in plain text; it said 7,437 local accounts were marked disabled. The source cautions that records are not people and that not all credentials may still work.
The public Fortinet advisories for the October 22 updates were scheduled for November 10, so the source does not provide the vulnerability identifiers or full technical details for those fixes. It is also unclear from the supplied material how many organizations have installed the updates, how many exposed credentials remain valid, or whether the Gotenberg attack-attempt count represents successful compromises. Vendor and researcher findings are attributed reports, not a complete measure of all incidents.
Patch, Review and Await Advisories
Fortinet customers should follow the company’s update guidance for affected FortiOS, FortiManager and FortiAnalyzer systems, and watch for the scheduled November 10 advisories for technical details. Organizations using Fortinet devices should also review administrator accounts, replace potentially exposed or reused passwords, enable multifactor authentication where available and check whether unexpected accounts or configuration changes have appeared.
Security teams can compare their software inventory with both CISA’s Known Exploited Vulnerabilities catalog and vendor advisories rather than treating one list as exhaustive. The Gotenberg example in the roundup illustrates why a catalog omission does not by itself establish that a flaw is safe to defer. For phone users, the practical steps are to obtain banking apps from trusted sources, avoid accepting unexplained prompts, and install available updates. Microsoft’s Authenticator issue is reported as fixed, but organizations should confirm that the fix is present on managed devices.
Key Questions
What is the main security development this week?
The roundup’s leading concern is the combination of active FortiBleed credential attacks and Fortinet’s October 22 security updates for FortiOS, FortiManager and FortiAnalyzer. The FBI and U.S. Secret Service warned that the campaign was still active.
Is FortiBleed described as a newly discovered Fortinet vulnerability?
No. Fortinet said FortiBleed is not a new product vulnerability. The reported campaign uses previously exposed or weak credentials and password guessing, according to the company and the source material.
Has Microsoft fixed the Authenticator issue?
Yes. The source says Microsoft fixed the reported Android issue that could allow another app to obtain work-account login tokens. It identifies the issue as CVE-2026-80097; users and employers should check that the fix is installed.
Does CISA’s vulnerability list cover every urgent flaw?
No. The roundup notes that the Gotenberg flaw was not listed in CISA’s Known Exploited Vulnerabilities catalog, despite VulnCheck reporting 1,358 attack attempts in 30 days. A missing listing does not, on its own, show that a vulnerability is harmless.
Source: ThorstenMeyerAI.com
