🔍 Read the full analysis: AI Security Notes For The Week: Patches, Malware And Exposed Tokens on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A security roundup published October 29 highlights six developments: Fortinet updates and an active credential-theft campaign, Android banking malware for rent, a backdoor delivered through a deceptive PDF, exposed Microsoft work-account tokens, automated scans for secrets, and differences between CISA’s must-patch list and other reported risks. The source identifies practical responses, but some incident counts come from security vendors and the full Fortinet advisories are scheduled for November 10.
A security report published October 29 highlights six recent risks for businesses and individual users, including Fortinet firewall updates, an ongoing campaign using stolen credentials, and Android malware designed to steal banking codes. The roundup also covers an exposed Microsoft work-account token issue that Microsoft says it fixed, and argues that organizations should not rely on CISA’s must-patch list as their only measure of risk.
The report selects six stories from a 30-item weekly digest published by The Hacker News and says it checked the original advisories or research for each. Fortinet released coordinated security updates for FortiOS, FortiManager and FortiAnalyzer on October 22, following earlier updates for FortiMail and FortiAuthenticator. The detailed public advisories are scheduled for November 10. The report describes the updates as including critical- and high-severity fixes and says Fortinet identified AI-assisted testing as part of the work.
Separately, the FBI and U.S. Secret Service warned on October 6 that a campaign called FortiBleed was still active. According to the joint advisory, the attackers reuse previously exposed passwords, guess weak credentials and exploit poorly protected access to create administrator accounts. The agencies cite SOCRadar’s report of more than 86,644 compromised devices across 194 countries. Hudson Rock reported on October 27 that it analyzed 1,703 configuration reports from 1,689 devices, finding 40,573 records containing plaintext passwords. Those are records, not confirmed unique people or active accounts; the report says 7,437 local accounts were marked disabled.
The other cases involve different routes to access. CloudSEK reported October 28 on MR ROBOT, an Android crime kit rented by criminals to make fake banking apps that can steal one-time codes and forward calls. Trellix said an empty PDF disguised as a FedEx tax invoice delivered a backdoor when a user accepted a PDF reader’s warning. Researchers at Enclave reported that another Android app could obtain Microsoft Authenticator login tokens for a work account; Microsoft has fixed the issue, listed as CVE-2026-80097. Cequence also reported a scanner rotating among about 32 false AI-bot identities while requesting password files and cloud keys.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Risks Across Firewalls, Phones and Cloud Keys
The six reports show how attackers can target different points in an organization’s security chain: internet-facing network equipment, mobile devices, email attachments and exposed application programming interface credentials. The methods described are not all new software flaws. In the FortiBleed campaign, the agencies and Fortinet point to reused or weak passwords and missing second-factor authentication, making credential practices and account monitoring relevant alongside software patching.
The roundup’s practical message is that teams need more than a single vulnerability list. CISA’s Known Exploited Vulnerabilities catalog is a key resource for U.S. federal agencies, but the report says a separate critical Gotenberg flaw with 1,358 recorded attack attempts in 30 days was absent from the catalog. That figure is attributed to VulnCheck, and the source does not provide the underlying measurement methodology here. A missing listing does not establish that a product is safe; organizations still need to review vendor advisories and their own exposure.
For ordinary users, the reported Android and PDF cases underline the importance of checking app legitimacy and treating unexpected security prompts carefully. For employers, compromised firewall configuration files and work login tokens may expose access beyond a single device. The specific impact depends on whether credentials or tokens remain valid and what permissions they carry.
Products Worth Considering
FLEXISPOT Standing Desk with Monitor Riser & Cable Management
Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER)
As an affiliate, we earn on qualifying purchases.
How the Six Reports Connect
The source is a selected roundup, not a single coordinated incident. It says The Hacker News published a digest of 30 security stories on October 29, then selects six it considers relevant to businesses and ordinary users. The writer says most statistics come from the security firms that discovered or analyzed the activity and notes that those firms also sell security products. Counts should therefore be read with their stated scope and attribution, not treated as independently verified totals.
Fortinet has disputed describing FortiBleed as a newly discovered Fortinet vulnerability. Its security response team said the campaign involves credentials reused from earlier incidents and password guessing against devices with weak passwords and no second factor. That distinction matters: the active campaign described by authorities is separate from the Fortinet product updates issued October 22. The report says Fortinet cited the speed at which attackers can study patches and develop exploits as one reason to treat the updates as a priority.
The report also distinguishes CISA’s federal remediation deadlines from wider risk prioritization. It says CISA gave federal agencies three days to address PHP2Shell, while a Gotenberg issue with attack attempts counted by VulnCheck was not on the agency’s list. These examples concern different software and evidence sources; the roundup does not establish that their severity or exposure is directly comparable.
“FortiBleed “is not a new Fortinet vulnerability”.”
— Fortinet
What the Counts and Fixes Do Not Show
The roundup does not establish how many FortiBleed devices remain exposed, how many credentials found in configuration records are still valid, or how many organizations have installed Fortinet’s October 22 updates. Hudson Rock’s reported records include disabled accounts, and the source cautions that records are not equivalent to people or active accounts. Fortinet’s detailed public advisories are not due until November 10, so the report does not give the full technical details of the fixes.
Some other details are also limited. The source does not state how many victims were affected by the MR ROBOT kit or the Trellix PDF backdoor, or how many organizations were reached by the Cequence scanner. It says Microsoft fixed the Authenticator issue but does not specify in this material which app versions received the fix or whether exploitation was observed in real-world attacks. The Gotenberg attempt count is attributed to VulnCheck; the roundup does not provide enough detail to assess how the attempts were counted or whether they succeeded.
Patch Systems and Verify Exposure
Organizations using Fortinet products should review Fortinet’s October 22 update notices, identify exposed and affected systems, and plan installation according to their environment’s change procedures. They should also check for unexpected administrator accounts, review firewall configuration backups, replace reused or weak passwords, and enable multifactor authentication where supported. Fortinet’s full public advisories are expected on November 10.
Security teams can review CISA’s KEV catalog while also checking vendor advisories and credible research on software they use, including Gotenberg. Users should install available app updates, obtain banking apps from trusted sources, and avoid approving unexpected prompts in PDF readers or authentication apps. The report provides no confirmed schedule for further findings or case totals, so subsequent advisories and vendor updates will determine what can be established about the scale and remediation of these risks.
Key Questions
What is the main development in this security report?
The October 29 roundup selects six recent security stories, covering firewall patches and credential theft, Android banking malware, a malicious PDF, work-account tokens, automated scanning for secrets and patch-list coverage.
Is FortiBleed described as a new Fortinet software vulnerability?
No. Fortinet said FortiBleed is not a new Fortinet vulnerability, describing the activity as involving reused credentials and password guessing. The report separately notes that Fortinet issued product updates on October 22.
What did the report say about the Microsoft Authenticator issue?
Researchers at Enclave reported that another Android app could obtain Microsoft Authenticator login tokens for a work account. The source says Microsoft fixed the issue, tracked as CVE-2026-80097, but gives no version or real-world exploitation details.
Does being absent from CISA’s KEV catalog mean software is safe?
No. The roundup says a Gotenberg flaw with 1,358 attack attempts recorded over 30 days by VulnCheck was not on the catalog. CISA’s list is one source for prioritization, not a complete inventory of every risk an organization may face.
What should organizations do next?
Review and apply relevant vendor updates, check firewall accounts and configuration backups, replace weak or reused passwords, and enable multifactor authentication. Teams should also review vendor notices and exposure beyond the CISA KEV list.
Source: ThorstenMeyerAI.com
