🔍 Read the full analysis: A Week In AI Security: The Risks And Responses That Matter on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A report dated October 29 reviewed six security developments affecting firewalls, Android phones, email and vulnerability prioritization. The source describes an active campaign targeting Fortinet devices, new mobile and PDF-delivered threats, a fixed Microsoft Authenticator flaw, and a gap between CISA’s required patch list and other reported risks.
ThorstenMeyerAI.com published a review of six security developments on October 29, highlighting an active campaign against Fortinet firewalls alongside threats involving Android banking malware, a malicious PDF, work-account authentication and automated web scanning. The roundup draws on company research and government advisories, and points readers to actions such as updating software, strengthening account protections and checking exposed systems.
The most urgent item in the review concerns Fortinet firewall credentials. The source says the FBI and U.S. Secret Service warned on October 6 that a campaign dubbed FortiBleed remained active. The agencies cited SOCRadar, which reported verifying more than 86,644 compromised devices across 194 countries. According to the account, attackers reused previously exposed passwords, guessed weak ones and targeted devices lacking multifactor authentication. The FBI and Secret Service named ransomware groups INC/Lynx and Payload as buyers of access.
A separate report from Hudson Rock, dated October 27, examined 1,703 configuration reports from 1,689 devices and counted 40,573 records containing plaintext passwords. Hudson Rock said those records included local accounts and Active Directory connection credentials; it also noted that some local accounts were disabled. The source cautions that records do not equal people or necessarily represent working credentials. Fortinet has said FortiBleed is not a new Fortinet vulnerability, attributing the activity to stolen or weak passwords and missing second-factor protections.
Fortinet also released security updates for FortiOS, FortiManager and FortiAnalyzer on October 22, addressing critical- and high-severity issues, according to the roundup. Public advisories were scheduled for November 10. The other selected stories include CloudSEK’s report of an Android crime kit called MR ROBOT, Trellix’s account of a backdoor delivered through a deceptive blank PDF, and researchers’ report that a flaw in Microsoft Authenticator on Android could expose work-account login tokens. The source says Microsoft has fixed that flaw. It also cites Cequence’s observation of a scanner using about 32 fake AI-bot identities, and VulnCheck’s count of attack attempts against Gotenberg.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Firewall and Account Risks Matter
The reports matter because they describe routes into systems that businesses and individuals rely on: internet-facing firewalls, workplace sign-ins, mobile banking and email attachments. Compromised firewall credentials can give an attacker a foothold in a company network, while stolen authentication tokens may let another app access a work account. A fraudulent banking app can target one-time codes, and a convincing invoice can prompt a user to approve a risky action.
The roundup also highlights a practical problem for security teams: patch priority lists do not capture every risk. CISA’s Known Exploited Vulnerabilities catalog requires U.S. federal agencies to address listed flaws on specified timelines, but the source says Gotenberg was not listed despite VulnCheck reporting 1,358 attack attempts over 30 days. That count is attributed to VulnCheck; the source does not establish how many attempts succeeded. Teams may need to combine official lists with threat intelligence and their own exposure checks.
Popular right now
Vitamix Propel Series 750 Professional-Grade Blender, 4 Programs, Black
Samsung 48-Inch S90H OLED 4K Smart TV (2026)
De'Longhi Rivelia Fully Automatic Espresso Machine with Milk Frother, White
As an affiliate, we earn on qualifying purchases.
Six Reports Behind the Weekly Review
The October 29 article selected six items from a larger weekly Hacker News security digest. Its author says the selection was intended to focus on issues relevant to companies and ordinary users, and that original advisories or research reports were consulted. Many of the numerical findings come from security companies that also sell protective services; the source says it identifies company-reported counts as such.
The Fortinet coverage combines two related but distinct developments: the active credential-based FortiBleed campaign and newly released software fixes for Fortinet products. The source says Fortinet used AI-assisted testing to find some issues and credited Anthropic, OpenAI, Google and SpaceX. It also quotes Fortinet’s concern that AI tools could help attackers analyze patches and develop exploits more quickly. That is the company’s assessment, not a confirmed timetable for exploitation of these specific flaws.
The remaining reports span different attack methods. CloudSEK described MR ROBOT as a rented Android crime kit for building fake banking apps that steal one-time codes and forward calls. Trellix traced a backdoor to an empty PDF presented as a FedEx tax invoice; its report says the attack depended on a victim accepting the PDF reader’s warning. Enclave researchers reported the Microsoft Authenticator issue on October 23, and the source identifies Microsoft’s fix as CVE-2026-80097. Cequence’s scanner findings and VulnCheck’s Gotenberg count were reported on October 28 and October 26, respectively.
“FortiBleed “is not a new Fortinet vulnerability.””
— Fortinet
What the Reports Do Not Establish
The source does not provide a complete account of the number of successful intrusions across all six stories. In the FortiBleed findings, device counts, credential records and active accounts are different measures; Hudson Rock also reported disabled accounts, and the reports do not confirm that every credential remains usable. The source does not say how many organizations were affected by the Android kit, PDF backdoor or Authenticator flaw.
It also does not establish whether the reported Gotenberg attack attempts resulted in compromises or why the flaw was absent from CISA’s catalog. The Fortinet public advisories were still due on November 10 at the time of publication, so the roundup does not give their full technical details or identify the precise impact of each fix. Findings from security vendors are attributed to those firms, and their methods and underlying datasets are not detailed in the supplied material.
Patches and Checks to Follow
Organizations using Fortinet products should review Fortinet’s October updates and apply relevant fixes, while monitoring for the public advisories scheduled for November 10. The source recommends treating firewall security as more than a patching task: rotate reused or exposed credentials, remove unnecessary administrator accounts, use multifactor authentication and protect configuration backups that may contain sensitive account information.
For other systems, administrators can verify that Microsoft Authenticator on Android is updated, review exposure to Gotenberg and other document-processing tools, and use threat reports alongside CISA’s KEV list when setting patch priorities. Individual users should install apps only from trusted sources, treat unexpected invoice attachments cautiously and avoid approving security prompts they did not expect. The supplied reports do not specify further official actions or deadlines for the other items.
Key Questions
What is the main security development in this roundup?
The review’s most urgent item is an active campaign targeting Fortinet firewall credentials, alongside separate security updates for Fortinet products and five other reports affecting mobile apps, documents, authentication and patch prioritization.
Does FortiBleed exploit a new Fortinet vulnerability?
Fortinet said FortiBleed is not a new product vulnerability. The source describes the campaign as relying on stolen or guessed passwords and weak account protections. Fortinet also released updates for separate critical- and high-severity issues.
Has Microsoft fixed the Authenticator issue?
Yes. The source says Microsoft fixed the reported Android issue, which researchers said could allow another app to obtain work-account login tokens. It identifies the issue as CVE-2026-80097.
Does the Gotenberg attack count mean systems were breached?
No such conclusion is established in the source. VulnCheck reported 1,358 attack attempts over 30 days, but the supplied material does not say how many attempts succeeded or whether they caused compromises.
Source: ThorstenMeyerAI.com
