🔍 Read the full analysis: This Week’s Security Roundup For AI: Risks And Responses on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A security roundup published October 29 highlights six threats and defenses, including an active campaign against Fortinet firewalls, Android banking malware and a backdoor hidden in a blank PDF. The reports point to practical responses such as applying vendor fixes, protecting credentials and checking software beyond official priority lists; some figures come from the security firms that investigated the activity.
A October 29 security roundup highlighted six developments for businesses and individual users, including an active campaign targeting Fortinet firewalls, Android banking malware for rent and a backdoor delivered through a blank PDF. The items draw on vendor advisories, government warnings and security-company research, and point to immediate steps such as patching, securing accounts and treating unexpected prompts with caution.
The roundup, published by ThorstenMeyerAI.com, selected six stories from a larger weekly digest by The Hacker News and reviewed the original advisories or reports. Its central infrastructure warning concerns Fortinet products: the FBI and U.S. Secret Service said on October 6 that the FortiBleed credential-theft campaign remained active. A joint advisory cited SOCRadar, which reported verifying more than 86,644 compromised devices across 194 countries. That figure is a security firm’s count, not an independently established total in the material provided.
Fortinet also released security updates on October 22 for FortiOS, FortiManager and FortiAnalyzer, including critical- and high-severity fixes. The company said public details would follow on November 10. Separately, CloudSEK reported on October 28 that an Android crime kit called MR ROBOT is rented to criminals to create fake banking apps that can steal one-time codes and forward calls. Trellix said an empty PDF disguised as a FedEx tax invoice could deliver a backdoor if a recipient accepted a PDF reader’s warning.
The other reports concern account security and threat prioritization. Researchers at Enclave said another Android app could obtain Microsoft Authenticator login tokens for a work account; Microsoft has fixed the issue, identified as CVE-2026-80097. Cequence reported that one scanner rotated through about 32 fake AI-bot identities while requesting password files and cloud keys. Finally, the roundup contrasted CISA’s three-day federal deadline to address PHP2Shell with VulnCheck’s report of 1,358 Gotenberg attack attempts in 30 days; Gotenberg was not on CISA’s Known Exploited Vulnerabilities list in the cited material.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Where Security Teams Should Act
The reports matter because they describe risks at several points where organizations and users depend on trust: network gateways, login credentials, mobile authentication and document handling. A compromised firewall can expose a broader corporate network, while stolen work-account tokens may give an attacker access without the password alone. Fake banking apps can target people directly by intercepting codes or calls.
The reports also show why security decisions cannot rest on a single label or list. CISA’s KEV catalog helps federal agencies prioritize known exploited vulnerabilities, but the roundup’s Gotenberg example shows that other evidence of attempted attacks may warrant attention too. That does not establish that Gotenberg is being exploited successfully or that it belongs on the catalog; it does mean teams may need to weigh vendor notices, exposure and threat reports alongside official lists.
Some figures cited are produced by companies that sell security services. The roundup says it checked original sources and identifies company-generated counts, but the figures should be read with their stated scope and limitations. The practical measures remain concrete: install available fixes, review exposed systems and accounts, and avoid granting permissions or approving warnings without a clear reason.
Products Worth Considering
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Bose TV Speaker (2nd Gen) Compact Soundbar with Bluetooth and HDMI
As an affiliate, we earn on qualifying purchases.
The Week’s Advisories and Reports
The roundup was published on Thursday, October 29, and condensed six stories from The Hacker News’ weekly digest. Its source material spans government advisories and research published from October 6 through October 28. The FortiBleed warning is distinct from Fortinet’s October 22 software updates: the campaign described by the agencies relies on credentials, including reused or weak passwords, rather than being presented as a newly discovered Fortinet software flaw.
According to the FBI and Secret Service advisory, attackers can use credentials to create administrator accounts and may lock legitimate administrators out. The agencies named INC/Lynx and Payload as ransomware groups that buy access. Hudson Rock’s October 27 analysis covered 1,703 configuration reports from 1,689 devices and counted 40,573 records containing plaintext passwords. It said 7,437 local accounts were marked disabled, and stressed that records do not equal people or necessarily represent active credentials.
Other reports describe different mechanisms rather than a single coordinated campaign: CloudSEK’s rented Android kit, Trellix’s PDF delivery method, Enclave’s Authenticator issue, and Cequence’s scanner impersonating AI bots. Keeping those findings separate matters: they come from different researchers, concern different products and users, and do not establish that the incidents share an operator.
“FortiBleed “is not a new Fortinet vulnerability.””
— Fortinet
What the Reports Do Not Establish
The public details behind Fortinet’s October 22 fixes were scheduled for November 10, so the specific flaws and their exposure were not yet described in the provided material. The cited FortiBleed totals come from SOCRadar and Hudson Rock analyses; the source does not independently verify every device or account, and Hudson Rock noted that some listed accounts were disabled. The material also does not establish how many of the credentials remain usable.
For MR ROBOT, the blank-PDF backdoor, the Authenticator issue and the AI-bot scanner, the supplied accounts do not give complete information about affected populations, successful compromises or total losses. Microsoft is reported to have fixed its issue, but the material does not specify which Android versions or users received the fix. The 1,358 Gotenberg figure is described as attack attempts over 30 days, not confirmed successful intrusions; the source does not provide a comparison baseline.
Patches, Reviews and Follow-Up
Fortinet’s next stated milestone was publication of public advisories on November 10. Organizations using FortiOS, FortiManager or FortiAnalyzer should check Fortinet’s update guidance and review whether the relevant fixes have been applied. Teams should also check firewall configurations and credentials, especially administrator accounts and accounts connected to directory services, while following guidance from the FBI and Secret Service on the active campaign.
Android users should install available operating-system and app updates, use official app stores and be cautious of banking apps that request unusual access. Organizations should confirm that Microsoft Authenticator is updated on managed Android devices and review account protections. Security teams can also check their exposure to PHP2Shell and Gotenberg against vendor and government guidance, rather than treating the KEV list as the sole source for patch decisions. The material does not provide a later status for these issues, so further advisories and vendor updates will determine what has changed.
Key Questions
Is FortiBleed a newly discovered Fortinet software vulnerability?
Fortinet said it is not a new vulnerability. The campaign described in the roundup relies on compromised, reused or weak credentials. Fortinet separately released product updates on October 22 for critical- and high-severity issues.
What should Fortinet customers do now?
Check Fortinet’s current guidance and apply relevant updates for FortiOS, FortiManager and FortiAnalyzer. Review administrator accounts, passwords and directory-linked credentials, and follow the FBI and Secret Service advisory on the active campaign.
Did the Gotenberg attacks succeed?
The cited VulnCheck report counted 1,358 attack attempts in 30 days. The supplied material does not say how many succeeded, and an attempt count should not be treated as a confirmed number of compromises.
Has Microsoft fixed the Authenticator issue?
The roundup says Microsoft fixed the Android issue, tracked as CVE-2026-80097. It does not specify affected versions or the rollout status for every device, so users should check for app and device updates.
Source: ThorstenMeyerAI.com
