🔍 Read the full analysis: A Week Of Security News For AI: What Calls For Action on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A weekly security roundup published October 29 highlights six developments affecting businesses and everyday users, including an active campaign targeting Fortinet firewalls, Android banking malware and a malicious PDF. The recommended responses include patching exposed systems, protecting credentials and treating CISA’s Known Exploited Vulnerabilities list as a priority guide rather than a complete inventory of risk.
ThorstenMeyerAI.com published a six-story security roundup on October 29, drawing on advisories and research reports to outline actions for businesses and individual users. The stories cover an active campaign against Fortinet firewalls, Android banking malware, a malicious PDF, a Microsoft Authenticator issue that has been fixed, automated credential scanning and a gap between a federal patch list and other reported risks.
The roundup says the FBI and U.S. Secret Service warned on October 6 that the FortiBleed campaign remains active. The agencies cite security company SOCRadar, which reported verifying more than 86,644 compromised devices across 194 countries. The roundup describes attackers reusing previously exposed passwords, guessing weak ones and seeking access to firewall accounts. Fortinet says FortiBleed is not a new Fortinet vulnerability and attributes the activity to reused credentials and password guessing, particularly where passwords are weak and multifactor authentication is absent.
Fortinet released security updates for FortiOS, FortiManager and FortiAnalyzer on October 22, with critical- and high-severity fixes, according to the source article. Public advisories are scheduled for November 10. Separately, Hudson Rock’s October 27 analysis counted 40,573 records containing plaintext passwords in configuration reports from 1,689 devices. The company cautioned that the records are not equivalent to unique people or necessarily active accounts; 7,437 local accounts were marked disabled.
Other items include CloudSEK’s October 28 report on MR ROBOT, an Android crime kit rented by criminals to create fake banking apps that can steal one-time codes and forward calls. Trellix reported October 26 that a backdoor was delivered through an empty PDF disguised as a FedEx tax invoice, relying on a user accepting a PDF-reader warning. Enclave reported an Android Microsoft Authenticator token issue on October 23; Microsoft says it has fixed the issue under CVE-2026-80097. Cequence described a scanner cycling through roughly 32 fake AI-bot identities while seeking password files and cloud keys.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Actions for Firewalls and Accounts
The reports point to practical exposure across network equipment, phones and workplace accounts. A compromised firewall can give an intruder a foothold at the boundary of a company network, while stolen authenticator tokens or banking codes can expose accounts even when users believe they are protected by an app or one-time verification.
For administrators, the immediate response is to review Fortinet updates and apply the relevant fixes, check internet-facing devices and account protections, and treat exposed configuration backups as sensitive. The roundup also recommends skepticism toward unexpected attachments and permission requests. Its broader point is that security lists and automated bot labels do not cover every risk: organizations need to consider reported vulnerabilities and suspicious activity alongside formal priority lists.
Popular right now
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Ninja Flip Toaster Oven & Air Fryer, 8-in-1, Stainless Steel, SP151
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Almond Cream
As an affiliate, we earn on qualifying purchases.
How the Six Reports Connect
The article is a selection from a larger weekly digest published by The Hacker News on October 29. Thorsten Meyer says he chose six of its 30 stories for business and personal relevance and checked the original advisory or research report for each. The roundup notes that some measurements come from security companies that sell protective services, and it identifies company-produced counts as such.
Several stories involve familiar weaknesses rather than a single new attack technique: reused passwords, weak account protections, misleading prompts and software trust. In the FortiBleed account, the FBI and Secret Service describe attackers using credentials and access methods associated with prior exposure. Fortinet’s separate October 22 updates address product vulnerabilities; the source says details of those advisories are due November 10. The roundup treats these as related security priorities, not as evidence that the campaign exploited the newly patched flaws.
The final item concerns how defenders prioritize vulnerabilities. CISA’s Known Exploited Vulnerabilities catalog gives U.S. federal agencies deadlines for addressing listed flaws. The source contrasts CISA’s three-day deadline for PHP2Shell with a reported critical vulnerability in Gotenberg, for which VulnCheck counted 1,358 attack attempts over 30 days, that was not on the catalog at the time described.
“FortiBleed is “not a new Fortinet vulnerability.””
— Fortinet
Limits of the Reported Counts
The figures in the roundup have different scopes and come from different sources. SOCRadar’s count of more than 86,644 devices is cited by the federal agencies, while Hudson Rock’s 40,573 figure refers to password-containing records in configuration reports. Hudson Rock said some accounts were disabled and the records should not be read as a count of people or necessarily usable credentials. The available material does not establish how many of those accounts remain active or how many devices are currently exposed.
The source article does not provide full technical details for Fortinet’s October 22 fixes; it says public advisories are expected November 10. It also does not include detailed incident counts for MR ROBOT or the PDF backdoor, or explain the complete scope and exploitation conditions of the Authenticator issue. The Gotenberg attempt figure is attributed to VulnCheck and covers a 30-day period, but the roundup does not establish how many attempts succeeded. These reported observations should not be treated as equivalent measures of confirmed compromise.
Patches and Advisories Due Next
Fortinet’s public advisories for the October 22 updates are scheduled for November 10, according to the roundup. Administrators can review available vendor updates and their own exposure before then, while avoiding assumptions about the unpublished technical details. Federal agencies must meet the deadline CISA assigned for PHP2Shell, and security teams can review whether Gotenberg and other exposed services are present in their environments even when a vulnerability is absent from the federal catalog.
For individuals, the suggested steps are to avoid installing banking apps from untrusted sources, reject unexpected permission requests, and treat invoice attachments or security prompts with caution. Organizations should audit firewall access, restrict and protect configuration files, replace reused credentials and use multifactor authentication where supported. The reports describe a set of risks, but they do not show that every user or organization has been affected; checking systems and applying relevant fixes remain the next practical steps.
Key Questions
What is the main news in this security roundup?
ThorstenMeyerAI.com selected six security stories from the week and paired each with an action for businesses or individual users. They include Fortinet firewall activity, Android threats and gaps in vulnerability prioritization.
Does FortiBleed refer to a newly disclosed Fortinet flaw?
Fortinet says FortiBleed is not a new Fortinet vulnerability. The company points to reused credentials and password guessing. Separately, Fortinet released product security updates on October 22, with public details scheduled for November 10.
What should Fortinet customers do now?
Review and apply relevant vendor updates, check internet-facing firewall accounts, replace reused or weak passwords, use multifactor authentication where available, and protect configuration backups that may contain credentials.
Is every record in Hudson Rock’s report an active account?
No. Hudson Rock counted password-containing records in configuration reports, not confirmed active users. The roundup says 7,437 local accounts in the analysis were marked disabled.
Does CISA’s vulnerability list include every serious risk?
No. The roundup says Gotenberg was not on the CISA list at the time, while VulnCheck reported 1,358 attack attempts over 30 days. That figure does not establish how many attempts succeeded; security teams should assess their own exposed systems as well as consult official lists.
Source: ThorstenMeyerAI.com
