🔍 Read the full analysis: This Week’s AI Cybersecurity Guide: Patching, Malware And Token Safety on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A security roundup published October 29 highlights six developments, including an active campaign targeting Fortinet firewalls, Android banking malware for rent, and a malicious PDF backdoor. Microsoft has fixed an Android Authenticator issue that could expose work-account tokens; organizations should patch affected systems and review credentials and access controls.
A security roundup published October 29 highlights six developments affecting business networks and personal devices, including an active campaign against Fortinet firewalls, Android malware that steals banking credentials, and a backdoor delivered through a disguised PDF. The report recommends prioritizing patches, checking exposed credentials and treating unexpected permission prompts with caution; it draws on government advisories and research from security companies.
The most urgent network issue in the roundup is the FortiBleed campaign. The FBI and U.S. Secret Service warned on October 6 that activity targeting Fortinet firewalls remained ongoing. Their advisory cited SOCRadar, which reported verifying more than 86,644 compromised devices across 194 countries. That figure is attributed to the security firm, not an independently established count by the agencies. The campaign reuses previously exposed passwords and targets weak credentials, according to the source account. Fortinet has said FortiBleed is not a new vulnerability in its products.
Separately, Fortinet released security updates on October 22 for FortiOS, FortiManager and FortiAnalyzer, including fixes rated critical and high severity. The company said public advisories for the issues would follow on November 10. The roundup also reports that CloudSEK identified MR ROBOT, an Android crime kit rented by criminals to create fake banking apps that steal one-time codes and forward calls. Trellix, meanwhile, described a backdoor concealed in an empty PDF disguised as a FedEx tax invoice; the attack depended on a user accepting a PDF reader’s warning.
Another finding concerns Microsoft Authenticator on Android. Researchers at Enclave reported that another app could obtain work-account login tokens under a particular attack scenario. Microsoft has fixed the issue, listed as CVE-2026-80097. The roundup also notes a Cequence report about a scanner that cycled through roughly 32 false AI-bot identities while requesting password files and cloud keys. Finally, it contrasts CISA’s Known Exploited Vulnerabilities catalog with a separate VulnCheck report: PHP2Shell was added to the federal must-patch list, while a critical Gotenberg flaw was not listed despite VulnCheck recording 1,358 attack attempts over 30 days.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Risks Across Networks and Devices
The reports point to different ways attackers can obtain access: weak or reused passwords, deceptive apps and documents, and software flaws. For organizations, a firewall compromise can expose network access and stored configuration data, while stolen authentication tokens may let an intruder use a legitimate work account. For individuals, fake banking apps can target both login details and one-time codes.
The figures should be read with their source and limits in mind. Security companies produced several of the counts and findings cited in the roundup; the companies have relevant expertise, but some also sell security services. For example, Hudson Rock’s October 27 analysis counted 40,573 password-bearing records in reports involving 1,689 devices, not 40,573 confirmed active users. The company said 7,437 local-account records were marked disabled. These distinctions matter when turning research into remediation priorities.
The Gotenberg example also shows why a government catalog is useful but incomplete as a sole measure of risk. CISA’s KEV list tracks known exploited vulnerabilities, but the roundup says the Gotenberg flaw was absent from it while VulnCheck reported attack attempts. Security teams may need to consider vendor advisories, threat intelligence and their own exposure alongside the catalog.
Products Worth Considering
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
As an affiliate, we earn on qualifying purchases.
Six Findings, One Weekly Roundup
The report is a selection from a larger weekly digest: The Hacker News published 30 security stories on October 29, and the roundup’s author selected six for business and consumer readers. The six span firewall access, Android banking malware, a PDF-based backdoor, a mobile authentication issue, automated scanning that impersonated AI bots, and vulnerability prioritization.
Fortinet’s campaign warning and its product updates are related to the same vendor but are separate developments. The FBI and Secret Service warning describes credential-based attacks, while the October 22 software updates address product vulnerabilities. The roundup says Fortinet planned to publish details of the new fixes on November 10. It also reports that Fortinet cited the risk that attackers may use AI tools to analyze patches and develop exploits more quickly; that is the company’s rationale, not a measured timeline for these specific flaws.
The practical recommendations in the source are deliberately direct: patch exposed systems, review firewall credentials and configuration backups, and avoid granting unexpected permissions. These steps address the reported attack paths without assuming that every organization or device has been affected.
““FortiBleed is not a new Fortinet vulnerability.””
— Fortinet, as quoted in the roundup
Counts and Advisories Still Developing
The reported compromise totals do not establish how many devices remain accessible to attackers or how many affected organizations have completed remediation. The SOCRadar figure is a count cited by the government advisory, while Hudson Rock’s figures refer to records in configuration reports; neither should be treated as a confirmed count of active victims. Fortinet’s public advisories for the October 22 fixes were scheduled for November 10, so the roundup does not provide their full technical details or identify affected versions.
The source material also does not specify which Android versions or app configurations are required for the Authenticator token issue, or how broadly it was exploited before Microsoft’s fix. The scale and victim impact of MR ROBOT and the PDF backdoor are not established in the supplied reports. For the Gotenberg figure, VulnCheck’s 1,358 attempts cover a 30-day period, but the roundup does not say how many succeeded or identify the affected deployments.
Patch, Review, and Verify
Organizations using FortiOS, FortiManager or FortiAnalyzer should review Fortinet’s October 22 updates and apply fixes appropriate to their systems. They should also check firewall accounts for reused or weak passwords, enable multifactor authentication where available, restrict administrative access and protect configuration backups. Teams should follow Fortinet’s November 10 advisories for the full vulnerability details.
Android users and administrators should install available Microsoft Authenticator updates and review the vendor’s guidance for CVE-2026-80097. Users should avoid installing banking apps from untrusted sources and treat unexpected prompts to approve access or grant permissions as a warning. Security teams should check their software inventory for exposed PHP and Gotenberg deployments and use current vendor and government advisories to guide patch decisions. The reported campaign activity, exploitation figures and remediation status remain subject to updates.
Key Questions
What is the main security development in this roundup?
The report highlights six security findings, led by an ongoing campaign targeting Fortinet firewalls and new Fortinet security updates. It also covers Android banking malware, a malicious PDF, a fixed Authenticator issue, automated credential scanning and vulnerability-list coverage.
Does FortiBleed refer to a new Fortinet software flaw?
Not according to Fortinet’s statement quoted in the roundup. The campaign is described as using reused or weak credentials; Fortinet said it was not a new vulnerability in its products. Separately, the company released fixes for FortiOS, FortiManager and FortiAnalyzer on October 22.
What does the MR ROBOT Android kit do?
CloudSEK reported that criminals rent the kit to build fake banking apps. The apps are described as targeting banking credentials and one-time codes and secretly forwarding calls. The supplied material does not establish the number of victims.
Has Microsoft fixed the Authenticator issue?
Yes. The roundup says Microsoft fixed the Android issue reported by Enclave, identified as CVE-2026-80097. Users and administrators should consult Microsoft’s update guidance for affected versions and recommended steps.
Should teams rely only on CISA’s KEV catalog?
No single list captures every relevant risk. The roundup says a Gotenberg flaw was not on CISA’s catalog despite a VulnCheck report of 1,358 attack attempts over 30 days. Teams should also review vendor advisories, threat intelligence and their own exposed systems.
Source: ThorstenMeyerAI.com
