🔍 Read the full analysis: This Week In AI Security: Making Sense Of The Threats And Fixes on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A review of six security developments this week points to active attacks on Fortinet devices, a rented Android banking-fraud kit, a malicious PDF lure and an Android authentication flaw that Microsoft has fixed. The roundup also highlights fake AI-bot identities used to seek sensitive data and a critical Gotenberg flaw absent from CISA’s must-patch list. The reports support practical steps such as patching, protecting credentials and checking software exposure.
A security roundup published October 29 highlights six developments affecting businesses and everyday users, including an active campaign against Fortinet firewalls, Android malware targeting banking logins and a fixed Microsoft Authenticator issue. The developments matter because they involve exposed network devices, stolen credentials and software flaws, while the evidence and scope differ across reports.
The roundup draws on The Hacker News’ weekly digest and says it selected six of the digest’s 30 stories, checking the original advisories or research reports where available. It warns that many figures come from security companies that identified the issues, so those figures are attributed to the reporting organizations rather than treated as independently verified totals.
The most urgent network-security item is Fortinet’s FortiBleed campaign. The FBI and U.S. Secret Service warned on October 6 that the activity remained ongoing. Their joint advisory cites SOCRadar as verifying more than 86,644 compromised devices across 194 countries. The reported method uses previously exposed or weak passwords and can lead to unauthorized administrator accounts. The agencies named ransomware groups INC/Lynx and Payload as buyers of access.
Separately, Fortinet issued security updates on October 22 for FortiOS, FortiManager and FortiAnalyzer, including critical- and high-severity fixes. Public advisory details are due November 10. Other items in the roundup include CloudSEK’s report on the rentable Android crime kit MR ROBOT, Trellix’s account of a backdoor hidden in a blank PDF presented as a FedEx tax invoice, and Microsoft’s fix for an Android Authenticator issue tracked as CVE-2026-80097.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Risks Span Firewalls and Phones
The six reports point to several ways attackers can gain access without relying on a single novel technique: reused passwords, weak authentication, deceptive documents and software behavior that exposes login tokens. For organizations, a compromised firewall can provide a route into broader systems; for individuals, fake banking apps and stolen one-time codes can put accounts at risk.
The roundup’s practical value is its focus on actions rather than threat labels. Organizations can prioritize Fortinet updates, review administrator access and require multifactor authentication. Users can avoid installing apps from untrusted sources and treat unexpected document warnings as a reason to stop. These measures do not guarantee protection, but they address the access paths described in the reports.
It also cautions security teams against relying on one government list to set every patch priority. VulnCheck reported 1,358 recorded attack attempts against Gotenberg in 30 days, while the flaw was not on CISA’s Known Exploited Vulnerabilities catalog at the time described. That figure is VulnCheck’s count, and the roundup does not provide a comparison baseline.
Products Worth Considering
Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD
Apple iMac 2024 All-in-One Desktop with M4 Chip, 24‑inch Retina Display, 16GB Unified Memory, 256GB SSD, Silver
Apple MacBook Pro (14.2-inch, 2025) – M5 chip, 16GB Unified Memory, 1TB SSD, Space Black
As an affiliate, we earn on qualifying purchases.
Six Reports From One Week
The roundup, published by Thorsten Meyer on ThorstenMeyerAI.com, is a selective review of a much longer weekly security digest. Its six subjects cover different parts of the security picture: two concern company network or software exposure, two involve phones, one focuses on a malicious email attachment, and one concerns the priorities used by security teams.
For FortiBleed, the agencies’ warning about an ongoing campaign is distinct from Fortinet’s separate October 22 software updates. Fortinet has said FortiBleed is not a new Fortinet vulnerability, attributing the campaign to compromised or weak credentials. The roundup also cites Hudson Rock’s October 27 analysis of 1,703 configuration reports from 1,689 devices, which counted 40,573 records containing plaintext passwords. Hudson Rock says these are records, not necessarily active accounts or unique people; 7,437 local-account records were marked disabled.
The other reported findings also have specific limits. CloudSEK described MR ROBOT as a kit rented by criminals to make fake banking apps that can steal one-time codes and forward calls. Trellix said the PDF backdoor depended on a victim accepting a PDF reader warning. Enclave researchers demonstrated the Authenticator issue, and Microsoft has issued a fix. Cequence reported tracking a scanner that used about 32 false AI-bot identities while seeking password files and cloud keys.
“FortiBleed is “not a new Fortinet vulnerability.””
— Fortinet
Scope and Exposure Still Vary
The full technical details of Fortinet’s October 22 fixes are not yet public in the source material; the company scheduled public advisories for November 10. The roundup does not list the affected versions or explain which deployments are exposed, so administrators need to consult Fortinet’s advisories when available and check their own environments.
The FortiBleed figures also have different meanings: SOCRadar’s device count and Hudson Rock’s configuration-record count are not interchangeable measures of affected organizations or active users. Hudson Rock says some listed accounts were disabled, and the material does not establish how many records remain exploitable. For the other cases, the source material does not give a total number of victims, confirmed financial losses or a complete list of affected software versions.
The Gotenberg attack-attempt figure is attributed to VulnCheck, and the source does not specify how those attempts were distributed or how many succeeded. CISA’s catalog status can also change, so its omission at the time described should not be read as evidence that the flaw is harmless.
Patch Reviews and New Advisories
Fortinet customers should review the company’s October updates and check the November 10 advisories for affected versions and remediation instructions. Organizations should also investigate firewall credentials and configuration backups, remove unauthorized accounts, change exposed or reused passwords and use multifactor authentication where supported.
Security teams can review whether they run Gotenberg or other exposed services and consult current vendor and government advisories rather than relying solely on the CISA catalog. Users should install Microsoft’s Authenticator fix, keep Android apps updated and treat unexpected PDF warnings or banking-app requests with caution. The source material does not identify a later status update for the campaign or the other reported threats.
Key Questions
What is the main security development in this roundup?
The October 29 roundup selected six threats and fixes, led by an ongoing FortiBleed campaign against Fortinet devices and separate Fortinet security updates released October 22.
Is FortiBleed a newly discovered Fortinet software flaw?
Fortinet said FortiBleed is not a new Fortinet vulnerability. The company attributed the campaign to attackers using exposed or weak credentials; the FBI and U.S. Secret Service warned that the activity was still ongoing.
Has Microsoft fixed the Android Authenticator issue?
Yes. The roundup says Microsoft fixed the issue, tracked as CVE-2026-80097, after researchers demonstrated that another app could be tricked into receiving work-account login tokens.
Why does the roundup mention Gotenberg if it is not on CISA’s list?
VulnCheck reported 1,358 recorded attack attempts in 30 days against a critical Gotenberg flaw, while the roundup said it was not on CISA’s Known Exploited Vulnerabilities list at that time. The reported attempts do not establish how many attacks succeeded.
What should Fortinet customers do now?
Review and apply relevant Fortinet security updates, check official advisories for affected versions, audit firewall accounts and configuration files, and replace exposed or reused passwords. Fortinet’s public advisories for the October 22 updates were scheduled for November 10.
Source: ThorstenMeyerAI.com
