🔍 Read the full analysis: Firewall Fixes And Token Theft: This Week’s AI Security Takeaways on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A security roundup published October 29 highlights six developments: Fortinet firewall updates alongside an active credential-theft campaign, Android banking malware, a backdoor delivered through a deceptive PDF, an Android authenticator token flaw that Microsoft says it fixed, and AI-bot impersonation used in scanning. It also finds a gap between CISA’s must-fix list and other reported risks; the evidence and severity differ by case.
A security roundup published October 29 identifies six recent issues affecting business networks, Android devices and online accounts, led by Fortinet firewall updates and an active campaign using stolen or weak credentials to access Fortinet devices. The developments matter because they involve both exploitable software weaknesses and everyday security failures, while the source says some figures come from security vendors that sell protective services.
Fortinet released security updates for FortiOS, FortiManager and FortiAnalyzer on October 22, including critical- and high-severity fixes, according to the company. Public advisories with further technical details are scheduled for November 10. Separately, the FBI and the U.S. Secret Service warned on October 6 that the FortiBleed credential-theft campaign was still active. Their advisory cites SOCRadar’s count of more than 86,644 compromised devices across 194 countries. That is a security firm’s reported count, not an independently established total in the supplied material.
The roundup says FortiBleed attackers reuse previously exposed passwords, try weak passwords and exploit password files stored using a legacy method. They may create administrator accounts and sell access, with ransomware groups named as potential buyers in the agency advisory. Hudson Rock separately reported analyzing 1,703 configuration reports from 1,689 devices and finding 40,573 password-containing records. The firm cautioned that these are records rather than people, and that some accounts were disabled. Fortinet has said FortiBleed is not a new Fortinet vulnerability, attributing access to compromised or weak credentials and a lack of multifactor authentication.
Other items in the recap include CloudSEK’s report on MR ROBOT, an Android crime kit rented by criminals to create fake banking apps that can steal one-time codes and forward calls; Trellix’s account of a backdoor concealed in a blank PDF disguised as a FedEx tax invoice; and research showing that an Android app could obtain Microsoft Authenticator work-account login tokens. The roundup says Microsoft fixed the authenticator issue, identified as CVE-2026-80097. Cequence reported a scanner rotating through about 32 fake AI-bot identities while seeking password files and cloud keys. The figures and descriptions are attributed to the companies that reported the findings.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Risks Span Firewalls and Phones
The cases point to different ways attackers can get access: stolen credentials, missing or delayed patches, deceptive files and weaknesses in how apps handle authentication tokens. For businesses, a compromised firewall account can expose a network boundary and create a route for further intrusion. For individuals, fake banking apps and stolen one-time codes can put financial accounts at risk.
The Android authenticator report also illustrates why a permission prompt is not the only measure of app risk: the research described an app with no permissions obtaining work-account tokens through an issue in another app. Microsoft’s stated fix reduces that specific exposure, but the supplied material does not give enough technical detail to assess which devices or configurations were affected.
The roundup’s CISA comparison is a reminder that an official priority list is not a complete inventory of risk. It says CISA gave federal agencies three days to address PHP2Shell, while a critical Gotenberg flaw was not listed despite VulnCheck reporting 1,358 attack attempts over 30 days. That attempt count is attributed to VulnCheck; it does not, by itself, establish successful compromises.
Popular right now
Ninja CREAMi 7-in-1 Ice Cream Maker, NC301
Samsung 48-Inch S90H OLED 4K Smart TV (2026)
Vitamix Propel Series 750 Professional-Grade Blender, 4 Programs, Black
As an affiliate, we earn on qualifying purchases.
How This Week’s Reports Connect
The roundup draws from reports published between October 6 and October 28, rather than describing a single coordinated attack. The FortiBleed warning and the October 22 Fortinet updates are related to the same product environment but concern distinct issues: the campaign described in the advisory relies on credentials, while the updates address software flaws. Fortinet said detailed public advisories for the newer fixes would follow on November 10.
Several findings were reported by security vendors, including SOCRadar, Hudson Rock, CloudSEK, Trellix, Enclave, Cequence and VulnCheck. These organizations may have direct visibility into incidents or vulnerabilities, but their counts and interpretations remain attributable reports. The roundup itself notes that many numbers come from firms that also sell security products. Its six selections are an editorial judgment about relevance to businesses and ordinary users, not a claim that these are the week’s only important security stories.
The source recommends treating firewall changes as a priority, checking exposure to known threats and using multifactor authentication. Those measures address the specific risks described, but they do not replace reviewing each vendor advisory or determining whether a particular system is affected.
“FortiBleed is “not a new Fortinet vulnerability.””
— Fortinet
What the Reports Do Not Establish
The public technical details for Fortinet’s October 22 fixes are not due until November 10, so the specific vulnerabilities and affected configurations are not provided here. The supplied material also does not independently verify SOCRadar’s device count or Hudson Rock’s records, establish how many accounts remain usable, or state how many victims suffered confirmed follow-on attacks.
For the other reports, the roundup does not provide full technical advisories, affected app versions or complete victim counts. It says Microsoft fixed the Authenticator issue but does not specify when the fix reached every affected Android user. VulnCheck’s 1,358 Gotenberg attempts are not described as successful intrusions. The source also does not give the complete details of CISA’s PHP2Shell deadline or the Gotenberg issue’s status beyond its reported absence from the agency’s list.
Patch Notices and Account Checks
Fortinet’s public advisories are scheduled for November 10; administrators should consult the company’s current update guidance and assess affected FortiOS, FortiManager and FortiAnalyzer installations. Teams should also review firewall accounts and stored configuration files, remove or rotate exposed credentials, and use multifactor authentication where available. Those steps address the credential risks described in the FBI and Secret Service warning, separate from installing software fixes.
Android users and organizations should rely on updated versions of Microsoft Authenticator and review relevant Microsoft guidance for CVE-2026-80097. Organizations using Gotenberg or PHP should check vendor and CISA notices for affected versions and remediation deadlines rather than treating inclusion on a priority list as the sole measure of exposure. The reports cited in the roundup may be updated as vendors publish technical details and researchers clarify the scope of affected systems.
Key Questions
Are Fortinet’s October updates the same issue as FortiBleed?
No. The roundup describes FortiBleed as a campaign using stolen or weak credentials, while Fortinet’s October 22 releases address software vulnerabilities. Fortinet’s detailed public advisories for those fixes were scheduled for November 10.
How many Fortinet devices were compromised?
The FBI and the U.S. Secret Service advisory cites SOCRadar’s report of more than 86,644 compromised devices across 194 countries. That figure is attributed to SOCRadar; the supplied material does not provide an independent verification or a count of confirmed victims of subsequent attacks.
Did Microsoft fix the Android Authenticator issue?
The roundup says Microsoft fixed the issue, identified as CVE-2026-80097. It does not specify when the fix reached every device or provide affected-version details, so users and administrators should check Microsoft’s current guidance and keep the app updated.
Does being absent from CISA’s list mean Gotenberg is safe?
No. The roundup says the reported critical Gotenberg flaw was not on CISA’s list, while VulnCheck reported 1,358 attack attempts over 30 days. The source does not say those attempts succeeded. Organizations should check their exposure and vendor guidance rather than treating a list entry as the only signal of risk.
Source: ThorstenMeyerAI.com
