🔍 Read the full analysis: How To Respond To This Week’s Security Risks, From Firewall Bugs To Token Theft on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A weekly security roundup published October 29 highlights six risks: ongoing Fortinet firewall compromises, new Fortinet software fixes, Android banking malware, a malicious PDF, an Android authenticator flaw that Microsoft has fixed, and automated credential scanning. The reports support practical steps including prioritizing patches, reviewing exposed credentials and treating unexpected prompts with caution; several statistics come from security vendors and have limits.
A security roundup published October 29 highlights six risks for organizations and consumers, including an ongoing campaign targeting Fortinet firewalls, newly released Fortinet software fixes and an Android flaw involving Microsoft work-account tokens that Microsoft says it has fixed. The incidents show why security teams should prioritize internet-facing systems and exposed credentials, while users should be wary of unexpected prompts and attachments.
The most immediate concern for firewall operators is the reported FortiBleed campaign. A joint warning from the FBI and U.S. Secret Service on October 6 said the campaign was still active. According to the advisory, attackers use reused or weak passwords and credentials exposed in earlier incidents to gain access to Fortinet devices. The agencies cite SOCRadar, which reported verifying more than 86,644 compromised devices in 194 countries. That figure is attributed to the security company and does not establish how many devices remain compromised now.
Separately, Fortinet released security updates for FortiOS, FortiManager and FortiAnalyzer on October 22, including fixes rated critical or high severity. Fortinet said public advisories would follow on November 10 and described the updates as a priority for customers. The roundup advises administrators to apply relevant updates, review firewall accounts and configuration backups, remove or disable accounts that should not be active, and require multifactor authentication. FortiBleed is described by Fortinet as a credential problem, not a new Fortinet vulnerability.
The other four items affect different parts of the security chain. CloudSEK reported an Android crime kit called MR ROBOT that criminals rent to create fake banking apps designed to steal one-time codes and forward calls. Trellix said an empty PDF disguised as a FedEx tax invoice delivered a backdoor when a user accepted a PDF reader warning. Enclave researchers reported that another Android app could obtain work-account login tokens from Microsoft Authenticator; Microsoft says it fixed the issue, identified as CVE-2026-80097. Cequence, meanwhile, tracked a scanner using about 32 fake AI-bot identities while seeking password files and cloud keys.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Prioritize Firewalls and Credentials
The firewall reports matter because these devices sit at the boundary of company networks and may provide attackers with broad access if administrator accounts are compromised. The agencies’ warning describes credential reuse and password guessing, rather than a newly disclosed Fortinet flaw, as key parts of the campaign. Patching still matters: separate Fortinet fixes address software vulnerabilities, and attackers may try to study patches to develop exploits. Fortinet said AI tools could help attackers reverse-engineer patches and build exploits faster, but that is the company’s assessment, not a confirmed timeline for attacks against these particular fixes.
The remaining reports show that defenses can fail through routine user actions and software trust relationships as well as through unpatched systems. A fake banking app can target one-time codes, a PDF warning can prompt a risky choice, and an app with no requested permissions may still exploit a flaw to obtain authentication tokens. For businesses, this means patch management should sit alongside account reviews, endpoint protections and clear reporting paths for suspicious prompts. For individuals, installing apps only from trusted sources and refusing unexpected permission or document warnings can reduce exposure, though neither step guarantees protection.
Products Worth Considering
EcoFlow Smart Home Panel 2 Whole-Home Backup System Hub
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Six Risks in One Weekly Digest
The report says it selected six stories from the 30 items in The Hacker News’ weekly security digest for October 29, then checked the original advisory or research report for each. Its recommendations span company firewalls, Android phones, email and security teams’ vulnerability priorities. The author notes that many figures come from security companies that discovered the issues and may also sell security products, so their counts should be read with that attribution in mind.
One example is Hudson Rock’s October 27 analysis of 1,703 firewall configuration reports from 1,689 devices. It counted 40,573 password-bearing records, including local-user and directory-connection account records. Hudson Rock cautioned that these were records, not necessarily distinct people or active accounts; 7,437 local accounts were marked disabled. The roundup also says CISA gave U.S. federal agencies three days to address PHP2Shell, while a Gotenberg document-tool flaw was not on CISA’s Known Exploited Vulnerabilities catalog despite VulnCheck recording 1,358 attack attempts over 30 days. Those are different measures from different sources, not a direct comparison of overall risk.
“FortiBleed “is not a new Fortinet vulnerability.””
— Fortinet
Counts and Exposure Still Unclear
The published figures do not establish how many Fortinet devices are currently exposed or whether every account in the configuration reports remains usable. SOCRadar’s number is a reported count of verified compromised devices, while Hudson Rock’s count covers records in analyzed reports; neither should be treated as a live global census. Fortinet’s public advisories for the October 22 updates were scheduled for November 10, so the roundup does not provide the full vulnerability details or affected-version list.
Details also remain limited for the other cases. The source material does not give the number of people affected by MR ROBOT, the extent of infections linked to the PDF, or evidence that the scanner tracked by Cequence successfully stole credentials. Microsoft is reported to have fixed the Authenticator issue, but the roundup does not specify which app versions are affected or how many accounts were exposed. The Gotenberg attempt count is attributed to VulnCheck, and the absence of a flaw from CISA’s list does not by itself establish that it is safe to defer remediation.
Patch, Review, Then Verify
Organizations using Fortinet products should check the vendor’s security guidance and apply the updates that match their products and versions, then review administrator access, password reuse, multifactor authentication and stored configuration files. They should also follow Fortinet’s scheduled November 10 advisories for technical details. Security teams can use CISA’s Known Exploited Vulnerabilities catalog as one input to prioritization, while checking other credible advisories and exposure reports rather than treating catalog inclusion as the sole test.
Android users and administrators should confirm that affected software is updated, restrict app installation to trusted sources and report suspicious login prompts or banking apps. People who encounter unexpected invoice PDFs should avoid approving unfamiliar warnings and verify the sender through a separate channel. The reports do not establish a single response that covers every risk; organizations should track vendor updates and incident guidance as more technical details become public.
Key Questions
Is FortiBleed a newly disclosed Fortinet software flaw?
Fortinet says it is not a new vulnerability. The campaign described in the roundup relies on exposed, reused or weak credentials. Fortinet released separate software updates for FortiOS, FortiManager and FortiAnalyzer on October 22.
What should Fortinet customers do now?
Check Fortinet’s guidance for the products and versions in use, apply relevant security updates, review administrator accounts and configuration backups, and require multifactor authentication. Watch for the public advisories scheduled for November 10.
Did Microsoft fix the Android Authenticator issue?
The source report says Microsoft fixed the issue, identified as CVE-2026-80097. It does not specify affected app versions or the number of accounts potentially exposed, so users and administrators should check Microsoft’s current update guidance.
Does CISA’s list cover every vulnerability teams should patch?
No. The roundup notes that the Gotenberg flaw was not on CISA’s Known Exploited Vulnerabilities catalog, while VulnCheck reported 1,358 attack attempts over 30 days. The catalog is one prioritization resource, not a complete measure of every organization’s risk.
Source: ThorstenMeyerAI.com
