🔍 Read the full analysis: This Week’s AI Security News, Explained: From Firewall Fixes To Token Theft on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
This October 29 roundup highlights six security developments, including Fortinet updates and an ongoing campaign targeting firewall credentials, Android token theft, and rented malware for fake banking apps. The cited reports come from government agencies and security firms; some figures are vendor-reported, and details of Fortinet’s new fixes remain private until November 10.
A six-story security roundup published October 29 flags active risks to company firewalls, Android work accounts and users who open malicious files, while urging security teams not to rely on official patch lists alone. The developments include Fortinet security updates, a continuing campaign using stolen or weak firewall passwords, and research into malware that can steal account tokens or banking codes.
Fortinet released critical and high-severity updates for FortiOS, FortiManager and FortiAnalyzer on October 22. The company said the fixes followed testing that included AI-assisted methods and asked customers to prioritize applying them. Public advisories detailing the vulnerabilities are scheduled for November 10, so the specific flaw information was not yet public in the source material.
Separately, the FBI and U.S. Secret Service said a campaign dubbed FortiBleed remains active. Their October 6 advisory cites SOCRadar, which reported verifying more than 86,644 compromised devices across 194 countries. The agencies describe attackers reusing previously leaked credentials, guessing weak passwords and targeting password files, then creating administrator accounts and selling access. The agencies named ransomware groups INC/Lynx and Payload as buyers. These figures and details are attributed to the advisory and the cited security firm.
Other research covered phone and email threats. CloudSEK reported an Android crime kit called MR ROBOT, rented by criminals to make fake banking apps that steal one-time codes and forward calls. Trellix described a backdoor delivered through a blank PDF posing as a FedEx tax invoice; its account says the infection required the user to accept a PDF reader warning. Enclave researchers reported that another Android app could obtain Microsoft Authenticator work-account tokens without requesting permissions; Microsoft has fixed the issue, tracked as CVE-2026-80097.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Risks Across Networks and Phones
The stories point to several practical routes into accounts and networks: exposed network devices, old or weak passwords, deceptive prompts and software trust between apps. A compromised firewall can give an attacker a route into a company network, while stolen authentication tokens may let access continue without repeatedly entering a password. Fake banking apps and malicious documents can target individuals as well as organizations.
The roundup also raises a prioritization issue. CISA’s Known Exploited Vulnerabilities catalog helps federal agencies identify flaws requiring action, but the source notes that Gotenberg’s critical vulnerability was not listed despite VulnCheck reporting 1,358 attempted attacks in 30 days. That figure is VulnCheck’s reported count; the source does not provide independent verification or enough detail here to compare it with other vulnerabilities. Security teams may need to consider threat intelligence beyond a single catalog.
The immediate actions are conventional but consequential: apply relevant updates, replace reused or weak credentials, use multifactor authentication, review firewall accounts and configuration backups, and treat unexpected prompts or attachments cautiously. These measures address the methods described; they do not establish that every organization is affected.
Products Worth Considering
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
As an affiliate, we earn on qualifying purchases.
How This Week’s Alerts Connect
The roundup draws on a wider weekly digest from The Hacker News, which it says contained 30 stories. Its author selected six, then consulted original advisories or research reports. The six span firewall exposure, Android threats, a malicious PDF, automated scanning for credentials, and vulnerability-list coverage. The provided material gives more detail on some stories than others, so the evidence and certainty vary by item.
For FortiBleed, the source distinguishes the alleged campaign from Fortinet’s separate October 22 software updates. Fortinet said the campaign was not a new Fortinet vulnerability, attributing access to credential reuse, password guessing and weak passwords without a second factor. Hudson Rock’s October 27 analysis of 1,703 configuration reports from 1,689 devices counted 40,573 records containing plaintext passwords. The company cautioned that these are records, not necessarily distinct or active people: 7,437 local accounts were marked disabled.
The remaining reports include Cequence’s account of a scanner posing as about 32 fake AI-bot identities while requesting password files and cloud keys; CloudSEK’s MR ROBOT findings; Trellix’s PDF analysis; and Enclave’s Authenticator research, alongside Microsoft’s fix. The source also says CISA gave U.S. federal agencies three days to address PHP2Shell. Those claims are attributed to the named organizations, not presented as independently verified findings.
“reverse-engineer patches and build working exploits in hours or days, rather than weeks”
— Fortinet, describing the risk from AI-assisted attack research
Advisory Details Still Pending
Fortinet’s public advisories for the October 22 fixes were scheduled for November 10, leaving the specific vulnerabilities and affected configurations unclear in the supplied material. The source does not establish how many organizations applied the updates or whether the newly patched flaws have been exploited.
Several numbers come from companies that investigate or sell security services. The FortiBleed device count is attributed to SOCRadar through the government advisory, while Hudson Rock’s figures describe configuration records, including some disabled accounts. The source does not independently validate those datasets. It also does not provide complete technical details or affected-version lists for MR ROBOT, the PDF backdoor, the scanner activity or Gotenberg’s reported attacks.
The roundup’s framing of the six stories as the week’s most consequential is an editorial selection, not a formal ranking. The supplied text also ends partway through its firewall discussion, so it does not fully document every one of the six actions or all source caveats.
Patch Advisories and Account Reviews
Fortinet’s public advisories were expected on November 10; customers can use those notices to confirm affected products and versions, then follow the company’s update guidance. The FBI and Secret Service warning makes firewall credential hygiene an immediate concern regardless of the separate patch release: organizations can review administrative accounts, remove unauthorized access, change reused credentials, enable multifactor authentication and protect configuration backups.
For Android users and administrators, Microsoft’s fix for CVE-2026-80097 is the reported next step, alongside keeping Authenticator and other apps updated. Security teams can check their own exposure to Gotenberg and PHP2Shell rather than treating inclusion on CISA’s catalog as the sole measure of risk. The source provides no further dates for updates on the other research findings, so additional vendor guidance or advisories may clarify their scope.
Key Questions
What is FortiBleed?
FortiBleed is the name used for a continuing campaign targeting Fortinet firewall access, according to an FBI and U.S. Secret Service advisory. The agencies describe attackers using reused or weak passwords and then creating administrator accounts. Fortinet says the campaign is not a newly identified Fortinet vulnerability.
What should Fortinet customers do now?
Fortinet released updates for FortiOS, FortiManager and FortiAnalyzer on October 22 and asked customers to prioritize them. Customers should consult Fortinet’s advisories, scheduled in the source for November 10, to identify affected versions. They should also review firewall accounts and credentials in light of the separate active campaign warning.
Did Microsoft fix the Authenticator token issue?
Yes. The source says Microsoft fixed the Android issue reported by Enclave researchers, tracked as CVE-2026-80097. It does not give the fix’s release date or affected app versions, so users and administrators should check Microsoft’s current product guidance.
What is MR ROBOT?
MR ROBOT is an Android crime kit described by CloudSEK as a rented tool for creating fake banking apps. CloudSEK said the apps can steal one-time codes and secretly forward calls. The source does not specify how widely the kit has been used or how many victims were affected.
Does a vulnerability’s absence from CISA’s list mean it is safe to defer?
No. The roundup says Gotenberg’s critical flaw was not on CISA’s Known Exploited Vulnerabilities catalog, while VulnCheck reported 1,358 attack attempts in 30 days. That number is attributed to VulnCheck, and the supplied material does not independently verify it. The example supports checking multiple reliable sources when prioritizing patches.
Source: ThorstenMeyerAI.com
