🔍 Read the full analysis: AI Security: Turning This Week’s Headlines Into Practical Steps on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A security roundup dated Oct. 29 reviews six developments and pairs each with a practical response, including active attacks on Fortinet firewalls, Android banking malware and a malicious PDF. The roundup draws on vendor research and government advisories; some figures are researchers’ counts, not independently verified totals.
ThorstenMeyerAI.com published a six-story security roundup on October 29, drawing from the week’s cybersecurity reports and advisories to outline actions for businesses and ordinary users. The report highlights continuing attacks on Fortinet firewalls, an Android banking-malware service, a malicious PDF, a fixed Microsoft Authenticator issue, automated credential scanning and gaps in an official US vulnerability list.
The roundup says it selected six items from The Hacker News’ October 29 digest, which contained 30 stories, and consulted original advisories or research where available. Its recommendations are practical rather than claims that all readers have been affected: review and patch exposed systems, protect accounts with multifactor authentication, treat unexpected files and permission prompts cautiously, and check security priorities beyond a single government list. The report also notes that many figures come from security companies that sell security products, so their counts should be read with that source context.
One of the most urgent items concerns Fortinet products. The report says Fortinet released critical and high-severity updates for FortiOS, FortiManager and FortiAnalyzer on October 22, with public advisories scheduled for November 10. Separately, the FBI and US Secret Service warned on October 6 that the FortiBleed campaign remained active. The agencies cited SOCRadar’s verification of more than 86,644 compromised devices across 194 countries. That is a figure attributed to the security firm, not a government count of confirmed victims.
Other items include CloudSEK’s October 28 account of MR ROBOT, an Android crime kit rented by criminals to make fake banking apps that can steal one-time codes and forward calls; Trellix’s report of a backdoor delivered through a fake FedEx tax-invoice PDF; and researchers’ finding that an Android issue could expose Microsoft Authenticator work-account tokens to another app. Microsoft has fixed the Authenticator issue, identified as CVE-2026-80097. Cequence reported a scanner using about 32 fabricated AI-bot identities while seeking password files and cloud keys. Finally, the report contrasts CISA’s three-day deadline for federal agencies to fix PHP2Shell with a critical Gotenberg flaw that VulnCheck said had 1,358 recorded attack attempts in 30 days but was not on CISA’s Known Exploited Vulnerabilities catalog.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Actions for Exposed Systems and Accounts
The stories matter because they point to several common routes into organizations and personal accounts: internet-facing network equipment, reused credentials, malicious attachments and deceptive app permissions. A firewall compromise can expose a company’s network boundary and administrative access. Banking malware that intercepts one-time codes can undermine protections users may assume make a login safe. A forged AI-bot identity also shows why a claimed automated identity should not be treated as proof that a request is legitimate.
The immediate response differs by audience. Organizations using Fortinet equipment should prioritize the vendor’s updates and review administrator access, passwords, multifactor authentication and exposed configuration backups. Android users should install apps only from trusted sources, check the publisher and avoid granting unexpected access to calls or messages. Email recipients should not approve a document reader’s security warning simply to open an invoice. These are risk-reduction steps, not a guarantee that a device or account is safe.
The roundup also cautions IT teams against using inclusion on CISA’s list as the only test for urgency. CISA’s Known Exploited Vulnerabilities catalog is a useful federal remediation tool, but the Gotenberg example cited by VulnCheck suggests that security teams may need to consider other credible reports of exploitation as well. The article does not establish that every reported attack attempt succeeded or that every organization using the affected software was targeted.
Products Worth Considering
eufy Security eufyCam C37 4-Camera Kit with 360° Pan and Tilt
eufy Security Essential Alarm System, 7-Piece, No Monthly Fee
Roborock Qrevo CurvX Robot Vacuum and Mop
As an affiliate, we earn on qualifying purchases.
How the Six Reports Connect
The FortiBleed campaign described in the roundup is not presented as a newly discovered Fortinet software vulnerability. Fortinet has said the activity involved credentials exposed in earlier incidents, weak passwords and accounts without a second factor. The FBI and Secret Service warning, as summarized by the source, describes attackers reusing leaked credentials, guessing weak passwords and cracking password files stored using a legacy method. The attackers could then create administrator accounts and sell access; the agencies named ransomware groups INC/Lynx and Payload as buyers.
A separate October 27 report from Hudson Rock examined 1,703 firewall configuration reports from 1,689 devices and counted 40,573 records containing plaintext passwords. Hudson Rock said these were records, not people, and that not all were active; it identified 7,437 local accounts as disabled. These figures describe the material the company analyzed and should not be equated with a count of currently compromised users.
Fortinet’s October 22 software updates are another, distinct development. The company said the fixes address critical and high-severity issues found with AI-assisted testing and warned that AI tools may allow attackers to analyze patches and build exploits more quickly. The source says detailed public advisories were due November 10. That timing makes prompt patch planning relevant, while the information available in the roundup does not disclose the vulnerabilities’ full technical details.
““FortiBleed is not a new Fortinet vulnerability.””
— Fortinet
Limits of the Reported Counts
The roundup relies in part on research from cybersecurity firms, and the supplied source does not independently verify their totals. The number of devices cited in the FortiBleed warning, Hudson Rock’s password-record count and VulnCheck’s Gotenberg attack-attempt figure each have different methods and meanings. In particular, attempts are not necessarily successful compromises, and password records do not directly represent active people or accounts.
The public details of Fortinet’s October 22 fixes were not yet available in the roundup; the source says advisories were expected November 10. It is also not clear from the material how many organizations installed the updates, how many devices in the cited campaigns remain vulnerable, or whether the named malware and scanning activity affected any particular reader. Microsoft’s issue is reported as fixed, but the source does not give a count of affected accounts or confirmed abuse.
Patch Updates and Verify Exposure
Organizations using FortiOS, FortiManager or FortiAnalyzer should review Fortinet’s available update guidance and plan the relevant security changes as a priority, then check for unfamiliar administrator accounts and exposed configuration files. They should also review the November 10 advisories when published for technical detail on the critical and high-severity fixes. Teams should confirm whether their installed versions are affected rather than assuming that all deployments face the same exposure.
IT and security teams can use CISA’s KEV catalog as one input while checking vendor notices and credible exploitation research for software they run. For individuals, the practical steps are to update apps and operating systems, avoid unexpected app permissions, and treat unsolicited invoice files and security warnings with care. The roundup provides no later incident figures or confirmation that the reported campaigns have ended, so monitoring and verification remain necessary.
Key Questions
What is the main development in the October 29 roundup?
ThorstenMeyerAI.com selected six security stories from The Hacker News’ weekly digest and paired each with an action for businesses or individual users. The items cover Fortinet, Android banking malware, a malicious PDF, Microsoft Authenticator, automated scanning and vulnerability prioritization.
Does FortiBleed involve a newly disclosed Fortinet vulnerability?
Not according to Fortinet’s statement cited in the roundup. The company described FortiBleed as activity involving stolen or weak credentials, rather than a new Fortinet vulnerability. Separately, Fortinet released security updates on October 22 for FortiOS, FortiManager and FortiAnalyzer.
What should Fortinet customers do?
Review Fortinet’s available update guidance and prioritize applicable updates. Organizations should also check administrator accounts, password practices, multifactor authentication and the exposure of configuration backups. The roundup says detailed advisories for the October 22 updates were expected on November 10.
What is the Android threat described in the report?
CloudSEK reported a rented crime kit called MR ROBOT that can help criminals create fake banking apps. The report says those apps can steal one-time codes and secretly forward calls. Users should install apps from trusted sources and scrutinize requests for access to calls, messages or other sensitive functions.
Does CISA’s list cover every actively exploited software flaw?
The source presents CISA’s Known Exploited Vulnerabilities catalog as useful but not exhaustive. It says VulnCheck reported attack attempts against a critical Gotenberg flaw that was not listed in CISA’s catalog. Security teams should consider vendor advisories and other credible reporting alongside the list.
Source: ThorstenMeyerAI.com
