🔍 Read the full analysis: Are Your AI Systems Ready For This Week’s Security Threats? on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A security roundup published Oct. 29 highlights six threats involving firewalls, Android banking apps, a malicious PDF, Microsoft Authenticator, fake AI-bot identities and patch prioritization. The reports describe active campaigns and disclosed vulnerabilities, but several figures come from security firms’ own analyses and do not establish how many victims remain exposed.
A security roundup published Oct. 29 identified six developments that businesses and consumers should review, including an ongoing campaign targeting Fortinet firewalls, Android malware designed to steal banking codes, and a vulnerability in Microsoft Authenticator that the company says it has fixed. The report, by Thorsten Meyer of ThorstenMeyerAI.com, selected six items from The Hacker News’ weekly digest and drew on the original advisories and research reports where available.
The most urgent infrastructure issue in the roundup is FortiBleed, a campaign that the FBI and U.S. Secret Service said remained active in an Oct. 6 advisory. The agencies cited SOCRadar, which reported verifying more than 86,644 compromised devices across 194 countries. That figure is the security firm’s count, as relayed by the agencies; the source material does not establish how many devices are still compromised. The campaign uses previously exposed or weak credentials, according to the advisory, rather than relying on a newly disclosed Fortinet vulnerability.
Separately, Fortinet issued security updates on Oct. 22 for FortiOS, FortiManager and FortiAnalyzer, including fixes rated critical and high severity. Fortinet said public details would follow on Nov. 10. The company also said AI-assisted testing contributed to finding issues and warned that AI tools may help attackers analyze patches and develop exploits more quickly. The roundup describes that timing as a reason to prioritize updates, while the public advisories and vulnerability details were not yet available in the cited material.
Other items include CloudSEK’s Oct. 28 report on MR ROBOT, an Android crime kit rented by criminals to create fake banking apps that can steal one-time codes and forward calls; and Trellix’s account of a backdoor delivered through an empty PDF disguised as a FedEx tax invoice. Trellix said the PDF required a user to accept a warning from the reader. Researchers also reported that an Android app could obtain Microsoft Authenticator work-account tokens without requesting permissions; Microsoft says it fixed the issue, listed as CVE-2026-80097. Cequence reported a scanner using roughly 32 fake AI-bot identities to seek password files and cloud keys. Finally, the roundup contrasts CISA’s three-day deadline for federal agencies to address PHP2Shell with a Gotenberg flaw that VulnCheck said had 1,358 recorded attack attempts in 30 days but was not on CISA’s Known Exploited Vulnerabilities catalog.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
The Risks Span Firewalls and Phones
The six reports point to different ways attackers can exploit routine weaknesses: reused passwords, deceptive files, compromised authentication tokens, and software that trusts a program’s claimed identity. The mix matters because security teams cannot address it with a single patch or product. Firewall administrators need to assess exposure and credentials; organizations using affected software need to review vendor guidance; and users should treat unexpected files and requests to approve access with care.
For companies, the Fortinet developments carry particular operational weight. Firewalls and related management systems sit at the network boundary, and stolen administrator access can give an intruder a route into wider systems. The roundup also reports that Hudson Rock analyzed 1,703 configuration reports from 1,689 devices and found 40,573 password-containing records. Hudson Rock cautioned that these were records, not necessarily distinct people or active credentials; 7,437 local-account records were marked disabled. Those limits matter: the count indicates exposure in the material analyzed, not a confirmed tally of usable accounts or current victims.
The Gotenberg example also highlights a planning problem: an official priority list is not a complete inventory of risk. CISA’s catalog is a useful signal, but the cited report says the Gotenberg flaw was absent despite reported attack attempts. Organizations still need to compare their own software and exposure against vendor advisories and other credible reporting.
Popular right now
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Vitamix Propel Series 510 Professional-Grade Blender, 3 Programs, Black
Ninja Foodi 10-Quart DualZone 6-in-1 Air Fryer, Black, DZ302
As an affiliate, we earn on qualifying purchases.
What the Six Reports Cover
The roundup was prompted by The Hacker News’ Oct. 29 weekly digest, which contained 30 stories. Meyer selected six and said he checked original advisories or research reports for each. The source article notes that many figures came from security companies that also sell protective services, and it identifies company-originated counts rather than presenting them as independently verified totals.
Fortinet has said FortiBleed is not a new Fortinet vulnerability. In a June 19 statement, the company attributed the campaign to credentials reused from earlier incidents and password guessing against devices with weak passwords and no second factor. The FBI and Secret Service advisory described the campaign as ongoing. Fortinet’s Oct. 22 product updates are a separate development: they address disclosed security issues, with public details scheduled for Nov. 10, according to the roundup.
The remaining reports concern separate products and techniques, not one coordinated attack. CloudSEK, Trellix, Enclave, Microsoft, Cequence, CISA and VulnCheck are cited for their respective findings or advisories. The article gives a practical action for each item, but its source material does not provide a single consolidated list of affected versions or a confirmed count of victims across all six developments.
““FortiBleed is not a new Fortinet vulnerability.””
— Fortinet
Exposure Counts Need Careful Reading
The public material cited in the roundup does not show how many Fortinet devices remain compromised, which reported credentials are still usable, or how many organizations have been affected. SOCRadar’s device count and Hudson Rock’s configuration-record count measure different things and should not be combined into a victim total. The source also notes that some records Hudson Rock found were disabled.
Fortinet’s public advisories for the Oct. 22 updates were scheduled for Nov. 10, so the specific vulnerabilities, affected versions and recommended steps were not included in the cited account. The roundup says Microsoft fixed the Authenticator issue, but does not specify the fixed app version or affected release range. It also does not provide enough detail to independently assess the reported Gotenberg attempts or to establish whether every attempt resulted in access.
More broadly, the source material reports findings from security firms and researchers, but does not give a common method for measuring the six threats. Claims about campaign scale, attack attempts and tool capabilities should be read with their individual attribution and limits.
Patch and Verify Affected Systems
Fortinet customers should review the company’s security notices, apply the relevant updates for FortiOS, FortiManager and FortiAnalyzer, and check for unexpected administrator accounts or exposed configuration backups. The FBI and Secret Service warning, as summarized in the report, also points to reviewing credentials, replacing reused passwords and using multifactor authentication. Organizations should follow vendor instructions and their own incident-response procedures rather than assume a patch alone resolves possible prior access.
Users and administrators should install the fixed Microsoft Authenticator version once confirmed by Microsoft’s release guidance, and verify app updates through official channels. Businesses should also review the source advisories for MR ROBOT, the Trellix PDF incident, Cequence’s scanner report and the Gotenberg flaw to determine whether their devices or services are affected. CISA’s catalog can inform patch schedules, but should not be the only source used to identify exposed software.
The next stated milestone in the source material is Fortinet’s planned Nov. 10 publication of public advisories. Those notices should provide more detail for customers assessing affected products and required remediation. Until then, the roundup supports a risk-based review, but it does not confirm a single exposure level or response that applies to every organization.
Key Questions
What is the main security development in this report?
Thorsten Meyer’s Oct. 29 roundup selected six security stories from The Hacker News’ weekly digest, including an active campaign targeting Fortinet firewalls and several threats involving phones, email and software patching.
Does FortiBleed exploit a new Fortinet vulnerability?
Fortinet said FortiBleed is not a new Fortinet vulnerability. The company attributed the campaign to reused credentials and password guessing, while the FBI and U.S. Secret Service warned that it remained active.
How many Fortinet devices were reported compromised?
The agencies cited SOCRadar’s report of more than 86,644 compromised devices across 194 countries. That is the firm’s reported count; the source material does not say how many remain compromised.
What should organizations do about the Fortinet updates?
Review Fortinet’s security guidance and apply relevant updates for FortiOS, FortiManager and FortiAnalyzer. Fortinet’s public advisories were scheduled for Nov. 10 in the source report; administrators should also check credentials, account activity and configuration-backup security.
Does CISA’s vulnerability catalog cover every urgent flaw?
No. The roundup says CISA gave federal agencies three days to address PHP2Shell, while a Gotenberg flaw with 1,358 recorded attack attempts in 30 days, according to VulnCheck, was not on the cited catalog. The comparison supports checking vendor advisories and exposure, not relying on one list alone.
Source: ThorstenMeyerAI.com
