🔍 Read the full analysis: How AI Teams Can Act On This Week’s Firewall, Malware And Token News on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A security roundup published October 29 highlights active attacks against Fortinet firewalls, new Fortinet security updates, Android banking malware, a malicious PDF campaign, an Android authenticator flaw and automated credential scanning. The reports point to practical steps for security teams, but several figures come from security vendors and do not establish how many victims remain exposed.
A six-story security roundup published October 29 by ThorstenMeyerAI.com highlights active attacks against Fortinet firewalls, newly released Fortinet security updates, Android banking malware and other credential-theft risks. The report urges businesses to prioritize firewall security while checking how their teams handle mobile login tokens, suspicious documents and software patching.
The report says Fortinet released critical and high-severity updates for FortiOS, FortiManager and FortiAnalyzer on October 22. Fortinet has not yet made the associated advisories public; the roundup says they are scheduled for November 10. Separately, the FBI and U.S. Secret Service warned on October 6 that the FortiBleed campaign remains active. The agencies cited SOCRadar’s count of more than 86,644 compromised devices across 194 countries. That figure is attributed to the security firm and does not establish how many devices are still compromised.
The described FortiBleed activity relies on credentials, not a newly identified Fortinet vulnerability, according to Fortinet. Attackers reuse previously exposed passwords, guess weak ones or crack password files, then create administrator accounts and sell access, the source report says. Hudson Rock’s October 27 analysis of 1,703 configuration reports from 1,689 devices found 40,573 records containing plaintext passwords. Hudson Rock cautioned that these were records, not necessarily active accounts or distinct people; 7,437 local accounts were marked disabled.
Other items in the roundup include CloudSEK’s report of MR ROBOT, an Android crime kit rented by criminals to create fake banking apps that can steal one-time codes and forward calls; and Trellix’s account of a backdoor delivered through a blank PDF disguised as a FedEx tax invoice. Trellix said infection depended on the recipient accepting a PDF reader warning. Researchers also reported that an Android app with no permissions could obtain Microsoft Authenticator login tokens for a work account. Microsoft has fixed that issue, identified as CVE-2026-80097.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Firewall Credentials Matter
The firewall findings put two related but distinct risks in view: active credential-based intrusions and newly disclosed product fixes. Updating software addresses known flaws, but it does not by itself remove passwords already exposed in configuration files or stop attackers from using weak or reused credentials. Organizations may need to treat patching and account security as separate workstreams.
The other reports show how attackers can target the accounts and tools that employees rely on every day. Banking malware can intercept authentication steps, while a compromised work token could grant access without an attacker needing to collect a password in the usual way. The reported PDF attack also relied on a person accepting a warning, linking technical controls with user decisions.
For AI and security teams, the roundup offers a practical reminder: do not treat a tool’s claimed identity as proof of trust. Cequence said it tracked one scanner presenting about 32 different fake AI-bot identities while requesting password files and cloud keys. That is a vendor-reported observation, not evidence that all automated traffic claiming to be an AI bot is malicious.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
As an affiliate, we earn on qualifying purchases.
Six Risks in One Weekly Roundup
The source article says The Hacker News published a digest of 30 security stories on October 29. ThorstenMeyerAI.com selected six and says it checked original advisories or research reports where available. The selection covers network firewalls, Android devices, email-delivered malware, automated scanning and vulnerability prioritization.
One prioritization example concerns PHP2Shell, for which CISA gave U.S. federal agencies three days to act, according to the report. It contrasts that deadline with a critical flaw in document software Gotenberg: VulnCheck recorded 1,358 attack attempts in 30 days, while the report says Gotenberg was not listed in CISA’s Known Exploited Vulnerabilities catalog. The attempts figure is attributed to VulnCheck; the source does not specify whether each attempt succeeded.
The roundup describes CISA’s catalog as a useful but incomplete guide to immediate patching priorities. A listing or omission should not be treated as a complete measure of exposure: organizations also need to consider their own software inventory, internet exposure and evidence of attempted attacks.
“FortiBleed “is not a new Fortinet vulnerability”.”
— Fortinet
Exposure Counts Need Qualification
The cited figures describe different things and should not be combined into a single estimate of victims. SOCRadar’s 86,644 devices are described as compromised devices verified across 194 countries, while Hudson Rock counted password-bearing records in configuration reports. The available material does not establish how many affected devices remain accessible, how many passwords still work or how many organizations are represented.
The Fortinet advisories were not public at the time of the roundup, so the specific flaws, affected versions and technical remediation details are not included here. The report also does not provide independent confirmation of the Android malware’s prevalence, the PDF campaign’s victim count or the success rate of Gotenberg attack attempts. Those details remain unclear from the supplied material.
Patch, Review, Then Recheck
Organizations using FortiOS, FortiManager or FortiAnalyzer should review Fortinet’s October 22 update notice and apply the relevant fixes under their change procedures. They should also check firewall configurations for unexpected administrator accounts, rotate exposed or reused credentials, review access to configuration backups and use multifactor authentication where available. When Fortinet publishes the advisories on November 10, teams can confirm affected versions and any additional technical guidance.
Security teams can review Android device and app controls, confirm that Microsoft Authenticator is current, and remind staff not to approve unexpected document-reader prompts. For vulnerability triage, compare CISA’s KEV catalog with the organization’s own asset list and credible reports of activity rather than relying on catalog presence alone. The source material does not specify a further milestone for the other campaigns, so monitoring for new vendor and agency advisories remains the next step.
Key Questions
What is the main development in this roundup?
The October 29 report highlights active Fortinet firewall attacks alongside security updates released October 22 and several other credential-theft and malware reports.
Does FortiBleed exploit a new Fortinet vulnerability?
Fortinet said FortiBleed is not a new product vulnerability. The campaign described in the report uses previously exposed or weak credentials to gain access.
What should organizations do about the Fortinet updates?
Review Fortinet’s update guidance and apply relevant fixes. The roundup says detailed advisories for FortiOS, FortiManager and FortiAnalyzer were scheduled for November 10; it does not list affected versions.
Was the Microsoft Authenticator issue fixed?
Yes. The source report says Microsoft fixed the Android token-handling issue, identified as CVE-2026-80097. Users and administrators should check that they have the applicable updated software.
Does CISA’s KEV catalog include every urgent vulnerability?
No. The roundup contrasts CISA’s PHP2Shell response with a Gotenberg flaw it says was absent from the catalog despite a VulnCheck report of 1,358 attack attempts in 30 days. The attempt count does not show how many attacks succeeded.
Source: ThorstenMeyerAI.com
