🔍 Read the full analysis: AI Security For The Week: What To Patch, Check And Protect on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A security roundup published Oct. 29 highlights six issues affecting firewalls, Android phones, email and security patch priorities. The source recommends prioritizing Fortinet updates, checking for exposed credentials and applying fixes where available; several reported counts come from security companies and have limits.
ThorstenMeyerAI.com published a six-item security roundup on October 29, highlighting active risks involving Fortinet firewalls, Android banking malware, a malicious PDF, Microsoft Authenticator, automated scanners impersonating AI bots and gaps in official vulnerability-priority lists. The report draws on vendor advisories, government warnings and security-company research, and gives readers an action for each item.
The most immediate enterprise concern is Fortinet’s October 22 updates for FortiOS, FortiManager and FortiAnalyzer, which include critical- and high-severity fixes. Fortinet has not yet published the related public advisories; the roundup says they are due November 10. Separately, the FBI and U.S. Secret Service warned October 6 that the FortiBleed credential-theft campaign remains active. The campaign uses credentials exposed in earlier incidents or weak passwords, rather than a newly disclosed Fortinet vulnerability, according to Fortinet’s position quoted in the source.
The roundup also flags threats to individual users and organizations’ accounts. CloudSEK reported October 28 on MR ROBOT, an Android crime kit rented by criminals to create fake banking apps that can steal one-time codes and forward calls. Trellix said October 26 it had traced a backdoor to a blank PDF disguised as a FedEx tax invoice; the described infection required the victim to accept a PDF reader warning. Researchers reported that a flaw in Microsoft Authenticator for Android could expose work-account login tokens to another app; Microsoft has fixed the issue, identified as CVE-2026-80097.
Two other findings concern how organizations assess and respond to risk, including patch plans for PHP2Shell. Cequence reported a scanner cycling through about 32 false AI-bot identities while requesting sensitive files and cloud keys. Separately, CISA’s Known Exploited Vulnerabilities catalog included PHP2Shell, for which federal agencies were given three days to remediate, while the roundup says a critical Gotenberg flaw was not listed. VulnCheck recorded 1,358 attempted attacks against Gotenberg over 30 days; that figure is the company’s reported count, not a measure of confirmed compromises.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Prioritize Exposed Systems and Accounts
The findings point to risks across internet-facing infrastructure and everyday account use. A firewall compromise can provide a foothold into a business network, while stolen banking codes or work login tokens can expose personal or company accounts. The reports also show why a patch list alone may not capture every risk: security teams need to weigh available evidence, exposure and their own software inventory.
For IT teams, the practical response is to review Fortinet deployments and apply the relevant updates, check for reused or exposed credentials, and require multifactor authentication where possible. Organizations should also verify whether they use affected products such as Gotenberg and Microsoft Authenticator for Android. For individuals, the advice is to avoid installing banking apps from untrusted sources and to treat unexpected document warnings as a reason to stop and verify the file.
The evidence needs careful interpretation. The source notes that many incident counts come from companies that sell security services. Hudson Rock’s Fortinet analysis counted password records, not confirmed active users; it also identified disabled accounts. These observations can guide investigation, but they do not establish how many organizations were successfully breached.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Black
As an affiliate, we earn on qualifying purchases.
Six Findings Behind the Roundup
The article was framed as a response to The Hacker News’ October 29 weekly digest, which contained 30 security stories. Thorsten Meyer says he selected six, then checked the original advisory or research report for each. The resulting piece is a recap rather than a new vulnerability disclosure or a single incident report.
For Fortinet, the roundup distinguishes two related but separate developments: newly issued product updates and an ongoing campaign that abuses credentials. The FBI and Secret Service cited SOCRadar’s verification of more than 86,644 compromised devices across 194 countries. That is a figure attributed to the security firm, not a government count independently detailed in the source. Hudson Rock’s October 27 report analyzed 1,703 configuration reports from 1,689 devices and found 40,573 records containing plaintext passwords, including local-user and directory-connection account records.
The other findings were disclosed on different dates: Trellix reported the PDF case October 26, CloudSEK reported MR ROBOT October 28, and Enclave’s Authenticator research was dated October 23. The source says Microsoft has addressed the Authenticator issue. It also notes that Fortinet credited Anthropic, OpenAI, Google and SpaceX for help with AI-assisted testing of its products.
Limits of the Reported Evidence
Several details remain unavailable or unverified in the supplied material. Fortinet’s public advisories are not due until November 10, so the specific vulnerabilities, affected versions and remediation details are not described here. The source does not provide the full technical reports for every finding, nor does it establish how many victims were successfully compromised in each case.
Some counts are company-reported observations with different methods and scopes. Hudson Rock’s password records do not equal active accounts or people, and its dataset includes disabled accounts. The source does not state a comparison baseline for the 1,358 Gotenberg attack attempts, so that figure should be read as a raw count within a 30-day period, not as a rate increase. It is also unclear from the material whether the Gotenberg flaw is being exploited successfully or why it was absent from CISA’s catalog.
Check Advisories and Patch Status
Organizations using Fortinet products should review the updates already released on October 22 and monitor Fortinet’s November 10 advisories for product-specific details. Security teams should inventory exposed firewall and server systems, review credential exposure, disable accounts that are no longer needed and confirm multifactor authentication is enabled. They should assess Gotenberg against their own systems even though the roundup says it is not on CISA’s list.
Users of Microsoft Authenticator on Android should install available app and operating-system updates and follow Microsoft’s guidance for CVE-2026-80097. People should install banking apps through trusted official channels and avoid approving unexpected PDF reader prompts. Further findings may change priorities as vendors publish technical details and agencies update vulnerability guidance.
Key Questions
What is the main security development this week?
A six-item weekly security recap published October 29 highlighted Fortinet updates and an active credential campaign, along with risks affecting Android banking apps, PDF readers, authentication tokens and exposed servers.
What should organizations do about Fortinet products?
Review and apply the available October 22 updates for FortiOS, FortiManager and FortiAnalyzer as appropriate, then check Fortinet’s scheduled November 10 advisories for the technical details and affected versions.
Does FortiBleed involve a new Fortinet vulnerability?
Fortinet says the campaign does not involve a new Fortinet vulnerability. The source describes attackers using previously exposed or weak credentials to access devices, while government agencies warn that the campaign remains active.
Has Microsoft fixed the Authenticator issue?
The roundup says Microsoft has fixed the Android issue identified as CVE-2026-80097. Users should install available updates and consult Microsoft’s guidance for affected accounts.
Are the reported attack counts confirmed victim totals?
No. The figures come from security-company research and refer to different things, including devices, password records and attempted attacks. They do not necessarily represent confirmed victims or successful compromises.
Source: ThorstenMeyerAI.com
