TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Reports published this week describe active Fortinet password theft, a rented Android banking fraud kit, a malicious PDF and other security risks. The recommended steps include patching affected systems, updating Microsoft Authenticator, and treating CISA’s exploited-vulnerability list as a starting point.
A review of six security developments reported between October 21 and 29 highlights active password theft targeting Fortinet firewalls, Android malware aimed at bank customers, and flaws affecting business software and authentication. The reports, drawn from advisories and research by security companies and government agencies, point to practical steps for IT teams and ordinary users, including patching, updating apps and avoiding untrusted links.
Fortinet released critical and high-severity fixes for FortiOS, FortiManager and FortiAnalyzer on October 22. The company asked customers to prioritize the updates, while the technical details are scheduled to be published November 10. The FBI and U.S. Secret Service have warned that a campaign dubbed FortiBleed, involving theft of passwords from Fortinet firewalls, remains active. Hudson Rock reported finding 40,573 plaintext password records across 1,703 firewall reports; those figures are the company’s count.
CloudSEK reported October 28 that an Android crime kit called MR ROBOT is rented to criminals for making fake banking apps. The kit can steal one-time codes and forward calls, according to the researchers. CloudSEK said one affiliate was associated with 153 devices and 5,407 text messages. Separately, Trellix described an empty PDF disguised as a FedEx tax invoice that could trigger a hidden backdoor if a user approved a warning from the PDF reader.
Researchers at Enclave said another Android issue could let an app with no permissions obtain work-account login tokens from Microsoft Authenticator. Microsoft has fixed the flaw, tracked as CVE-2026-80097. Cequence reported that one automated scanner cycled through about 32 fake AI-bot identities while requesting sensitive files, including environment files and cloud or SSH keys. In vulnerability management, CISA gave U.S. federal agencies three days to address PHP2Shell after adding it to its Known Exploited Vulnerabilities catalog. VulnCheck recorded 1,358 attack attempts against Gotenberg in 30 days, but the flaw was not on that catalog at the time of the source report.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
Where Teams and Users Face Risk
The reports show how familiar weaknesses can expose both organizations and individuals: internet-accessible administration, stolen credentials, deceptive app downloads and trust in software prompts. A compromised firewall or work-account token can provide access beyond a single device, while a fake banking app can capture authentication codes or intercept calls. The sources describe different incidents and research findings; they do not establish that all six developments are connected or part of one campaign.
For defenders, the Fortinet fixes and CISA listing offer concrete priorities. Yet the Gotenberg example shows why teams need to consider evidence of exploitation and whether a service is exposed, rather than relying only on one catalog. For individual users, refusing unsolicited app links and declining prompts to launch content from unexpected PDFs can reduce exposure to the described tactics.
Products Worth Considering
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Logitech MX Brio Ultra HD 4K Webcam, Graphite
As an affiliate, we earn on qualifying purchases.
How This Week’s Risks Emerged
The source article says it selected six items from a 30-story weekly digest published by The Hacker News on October 29 and checked them against original advisories or research reports. Its figures largely come from the security firms that identified the activity, which are also vendors of security products. The numbers should be read as those firms’ reported observations, not as independently established totals for all affected users or attacks.
The reports span several days: Fortinet issued fixes October 22; Enclave published its Authenticator research October 23; Trellix reported the PDF case October 26; and CloudSEK and Cequence published findings October 28. CISA’s catalog listing for PHP2Shell also appeared October 26, with a deadline of October 29 for U.S. federal agencies. The source provides no comparable deadline for private organizations.
What the Reports Do Not Establish
The source material does not state how many organizations installed Fortinet’s fixes, how many people were affected by MR ROBOT, or how widely the malicious PDF was distributed. Fortinet’s technical details are due November 10, so the full scope of the vulnerabilities and any links between them and the reported password theft remain unclear here. The reported counts from Hudson Rock, CloudSEK, Cequence and VulnCheck reflect their own collection or monitoring methods; the material does not provide independent validation or a shared measurement basis.
It is also unclear whether the scanner described by Cequence was operated by one actor or represented broader activity, and the source gives no evidence that its requests resulted in successful access. The Gotenberg attack-attempt count is not a count of confirmed compromises. The roundup does not specify whether CISA later added Gotenberg to its catalog.
Patch Deadlines and Follow-Up
Fortinet’s technical disclosures are scheduled for November 10. Administrators should check the company’s advisories and apply the fixes relevant to their deployed versions; the source also recommends moving admin logins off the public internet and resetting VPN and administrator passwords. Users should install banking apps only through trusted app stores or a bank’s official site, decline PDF prompts to launch external content, and update Microsoft Authenticator. Organizations can set a minimum supported Authenticator version.
For vulnerability prioritization, CISA’s PHP2Shell deadline for U.S. federal agencies was October 29. Security teams can start with CISA’s exploited-vulnerability catalog, then review other vulnerabilities with reported exploitation and exposed services, including Gotenberg where relevant. The source material does not give a follow-up date for that review or confirm subsequent catalog changes.
Key Questions
Which issue does the source describe as still active?
The FBI and U.S. Secret Service warned that the FortiBleed password-theft campaign targeting Fortinet firewalls remained active. Fortinet released fixes on October 22.
What should Android users do about MR ROBOT?
Do not install a banking app from a message link. Use a trusted app store or your bank’s official website, and contact the bank through a known channel if a message prompts an urgent app installation.
Has the Microsoft Authenticator issue been fixed?
Microsoft has fixed the Android issue identified as CVE-2026-80097, according to the source. Users should update the app, while organizations can enforce a minimum app version.
Does CISA’s vulnerability catalog include every actively exploited flaw?
The roundup says Gotenberg had 1,358 attack attempts recorded by VulnCheck over 30 days but was not on CISA’s catalog at the time. The source therefore advises teams to use the catalog as a starting point and also review other reported exploitation and internet-exposed software.
Source: Thorsten Meyer AI
