🔍 Read the full analysis: The AI Security Week In Review: Fixes, Fraud And Stolen Tokens on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
A security roundup published October 29 highlights six developments: Fortinet updates for critical and high-severity flaws, an active campaign using stolen firewall credentials, Android banking fraud tools and a fixed Microsoft Authenticator issue. It also examines a malicious PDF, fake AI-bot identities and the limits of relying only on CISA’s Known Exploited Vulnerabilities list. Some incident counts come from security firms and reflect their own analyses.
ThorstenMeyerAI.com published a six-story security roundup on October 29, covering Fortinet firewall updates, an ongoing campaign targeting firewall credentials, Android banking fraud tools and a Microsoft Authenticator issue that the company has fixed. The report also describes a malicious PDF, a scanner posing as AI bots and a gap between CISA’s federal patch deadlines and other reported attack activity.
Fortinet released updates on October 22 for FortiOS, FortiManager and FortiAnalyzer, including fixes rated critical and high severity, according to the report. Fortinet has not yet published the public advisories; it said they would follow on November 10. Separately, the FBI and U.S. Secret Service warned on October 6 that a campaign dubbed FortiBleed remains active. The agencies cited SOCRadar’s count of more than 86,644 compromised devices across 194 countries. That figure is attributed to the security firm, not an official government device count.
The report says FortiBleed activity relies on credentials exposed in earlier breaches, weak passwords and password files stored using an older method. Attackers may add administrator accounts and sell access. Hudson Rock separately analyzed 1,703 firewall configuration reports from 1,689 devices and found 40,573 records containing plaintext passwords. The company cautioned that these were records, not necessarily unique people or active accounts; 7,437 local accounts were marked disabled. Fortinet has said the campaign is not based on a new Fortinet vulnerability.
Other items include MR ROBOT, an Android crime kit that CloudSEK says criminals rent to create fake banking apps capable of stealing one-time codes and forwarding calls; and a backdoor Trellix traced to a blank PDF disguised as a FedEx tax invoice. Trellix said the PDF depended on a user accepting a reader warning. Researchers at Enclave reported that an Android app with no permissions could obtain Microsoft Authenticator work-account tokens under a specific scenario; Microsoft has fixed the issue, identified as CVE-2026-80097. The roundup also cites Cequence’s observation of a scanner rotating through about 32 fake AI-bot identities while seeking password files and cloud keys.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Firewall and Identity Fixes Matter
The stories point to risks across network access, mobile banking and workplace identity, not a single new attack technique. A compromised firewall account can provide a foothold into an organization; stolen authentication tokens can let another app act with a user’s work access. Fake banking apps and deceptive documents target people at the point where they approve a login or open a file.
The roundup’s practical message is to treat software updates and credential hygiene as connected defenses. Applying a patch does not remove passwords already stolen, while stronger passwords and multifactor authentication do not replace vendor fixes. The examples also show why security teams should check the details of an advisory and exposed configuration data rather than rely on a product name or threat label alone.
Popular right now
Vitamix Propel Series 510 Professional-Grade Blender, 3 Programs, Black
Bose QuietComfort Wireless Noise Cancelling Headphones, Sandstone
KitchenAid Artisan Series 5-Quart Tilt-Head Stand Mixer, Dried Rose (KSM150PS)
As an affiliate, we earn on qualifying purchases.
Six Reports Behind the Roundup
The source says The Hacker News published a digest of 30 security stories that week. ThorstenMeyerAI.com selected six it considered most relevant to businesses and ordinary users, stating that it returned to original advisories or research reports where available. The article identifies security companies as the source for many of the numbers and notes that those firms also sell security products.
Alongside the Fortinet and mobile issues, the roundup discusses CISA’s Known Exploited Vulnerabilities catalog. It says CISA gave U.S. federal agencies three days to address PHP2Shell, while a critical Gotenberg flaw was not on the list despite VulnCheck recording 1,358 attack attempts in 30 days. That attempt count is VulnCheck’s reported observation; the source does not establish that it represents unique attacks or successful compromises. The comparison is presented as a reminder that a government catalog is not a complete inventory of every risk.
“FortiBleed is not a new Fortinet vulnerability.”
— Fortinet
What the Counts Cannot Establish
The full scale of current exposure remains uncertain. The source does not provide a complete, independently verified count of FortiGate devices still compromised or accounts whose passwords remain usable. Hudson Rock’s configuration records include disabled accounts, and SOCRadar’s device count is attributed to the company cited by the agencies.
Public details about Fortinet’s October 22 fixes are also pending until the planned November 10 advisories. The roundup does not give the full technical conditions for the Microsoft Authenticator issue or quantify the number of affected users. For the other reports, the source summarizes vendor and research findings but does not establish how many victims were affected or whether every attempted attack succeeded.
Advisories and Defensive Follow-Up
Fortinet’s public advisories are scheduled for November 10; customers should consult the vendor’s current notices and apply the relevant updates. The roundup also points administrators toward reviewing firewall accounts and configuration backups, replacing reused or weak credentials, and using multifactor authentication. These steps address the credential campaign described in the report, while patching addresses separate software flaws.
Organizations using Microsoft Authenticator on Android should confirm that the fixed version is deployed and review Microsoft’s advisory for affected configurations. Users should avoid installing banking apps from untrusted sources and treat unexpected document-reader warnings as a reason to stop and verify the file. Security teams should use CISA’s KEV catalog as one input to prioritization, not as a complete list of every actively targeted vulnerability.
Key Questions
What is the main news in this security roundup?
ThorstenMeyerAI.com selected six security stories from the week, including Fortinet updates, an active campaign targeting firewall credentials, Android banking malware and a Microsoft Authenticator issue that has been fixed.
Does FortiBleed exploit a new Fortinet vulnerability?
Fortinet says it does not. The company attributes the campaign to credentials exposed in earlier incidents, weak passwords and password guessing. The FBI and U.S. Secret Service have warned that the campaign remains active.
What did Hudson Rock find in firewall configuration reports?
Hudson Rock said its analysis of 1,703 reports from 1,689 devices identified 40,573 records containing plaintext passwords. The company cautioned that records are not the same as unique people or active accounts; some accounts were marked disabled.
Has Microsoft fixed the Authenticator issue?
Yes, according to the source. Microsoft fixed the Android issue identified as CVE-2026-80097. The roundup does not specify the number of affected users or all conditions required for the issue.
When are Fortinet’s public advisories expected?
The roundup says Fortinet scheduled the public advisories for November 10, 2026, following updates released on October 22.
Source: ThorstenMeyerAI.com
