🔍 Read the full analysis: This Week In Security For AI: What Needs Attention Now on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A ThorstenMeyerAI.com roundup published October 29 selected six security developments from The Hacker News’ weekly digest and checked them against advisories or research reports. The issues span Fortinet firewall exposure, Android banking malware, a malicious PDF, Microsoft Authenticator tokens, fake AI-bot identities and patch priorities; several details and statistics come from security researchers and remain subject to their stated limits.
ThorstenMeyerAI.com published a six-story security roundup on October 29, selecting issues it says merit attention from businesses and individual users from The Hacker News’ 30-story weekly digest. The roundup focuses on Fortinet firewall risks, Android banking malware, a malicious PDF, Microsoft Authenticator tokens, fake AI-bot identities and patch prioritization, and offers a practical action for each.
The most urgent cluster concerns Fortinet network products. The roundup reports that Fortinet issued critical- and high-severity updates for FortiOS, FortiManager and FortiAnalyzer on October 22. It also cites an October 6 joint warning from the FBI and U.S. Secret Service that the FortiBleed campaign remained active. The public details of the October updates were scheduled for November 10, according to the source.
Other findings affect different points of access. CloudSEK reported an Android crime kit called MR ROBOT, rented by criminals to create fake banking apps that can steal one-time passcodes and forward calls. Trellix said an empty PDF disguised as a FedEx tax invoice delivered a backdoor when a recipient accepted the PDF reader’s warning. Separately, researchers reported that an Android app could obtain work-account login tokens through Microsoft Authenticator; Microsoft has since fixed the issue, and the source identifies it as CVE-2026-80097.
The final two items concern identity and remediation. Cequence tracked a scanner cycling through about 32 purported AI-bot identities while requesting password files and cloud keys. CISA added PHP2Shell to its Known Exploited Vulnerabilities catalog, with a three-day deadline for U.S. federal agencies, while the roundup says a critical Gotenberg flaw was absent from that list despite VulnCheck recording 1,358 attack attempts over 30 days. Those figures and observations are attributed to the named researchers and agencies, not independently established here.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Risks Across Six Common Entry Points
The selection matters because it spans systems organizations and individuals rely on every day: internet-facing firewalls, phones, email attachments, authentication apps and cloud credentials. A compromised firewall can expose a network, while stolen authenticator tokens can give an attacker access to a work account without simply guessing its password. Fake banking apps target both login information and verification codes.
The reports also point to different ways access can be gained. The FortiBleed warning describes attackers using previously exposed or weak credentials, rather than attributing the campaign to a newly disclosed Fortinet vulnerability. The PDF incident, by contrast, depended on a user accepting a warning. Treating these as distinct problems helps teams choose responses: check firewall accounts and access controls, apply vendor updates, and reinforce safe handling of unexpected files.
Patch lists can help prioritize work, but the roundup’s Gotenberg example underscores a limitation: absence from CISA’s catalog does not establish that software is safe. Security teams need to assess exposure, exploit evidence and the software they actually run, alongside official priority lists. The reported attempt count is one source’s observation over a specified 30-day period, not a measure of successful compromises.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Apple MacBook Pro (14.2-inch, 2025) – M5 chip, 16GB Unified Memory, 1TB SSD, Space Black
Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD
As an affiliate, we earn on qualifying purchases.
How This Week’s Items Were Selected
The article is a weekly recap, not a new incident announcement. Its author says The Hacker News published a 30-story digest on October 29, then selected six items considered most relevant to businesses and ordinary users. The author says each was checked against an original advisory or research report, and notes that many statistics come from security vendors that also sell protective services.
Fortinet’s firewall updates and the FortiBleed campaign are related in the roundup but are not presented as the same issue. Fortinet said FortiBleed was not a new vulnerability in its products, attributing activity to reused credentials and weak passwords, including cases without multifactor authentication. The October 22 product updates address separate security flaws; their public advisories were due November 10. The article also notes Fortinet’s explanation that AI-assisted testing helped identify issues and that faster patch analysis may shorten the time between a fix and an exploit.
Several reported counts need their original scope. The FBI and Secret Service warning cited SOCRadar’s verification of more than 86,644 compromised devices across 194 countries. Hudson Rock later analyzed 1,703 configuration reports from 1,689 devices and counted password-containing records; it cautioned that records are not people and that not all credentials remain active. Its count included 7,437 local accounts marked disabled. These are attributed research findings, not a verified current tally of active victims.
Open Questions on Exposure and Exploitation
The roundup does not establish how many Fortinet devices remain exposed or accessible, whether the accounts counted in configuration reports are still usable, or how many reported attack attempts against Gotenberg succeeded. Hudson Rock explicitly cautioned that its password records do not equal active users, and some local accounts in its dataset were disabled.
Public technical details for Fortinet’s October 22 updates were not yet available in the source account; the advisories were expected November 10. The roundup also does not provide the number of organizations affected by MR ROBOT, the PDF backdoor or the Authenticator issue. Microsoft is reported to have fixed the token issue, but the source does not specify how widely the vulnerable setup was used or whether attackers exploited it in real-world incidents.
The reported 32 fake bot identities and the Gotenberg attempt count are research observations with limited scope. They do not by themselves establish the total scale of activity, successful access or resulting harm.
Updates, Access Checks and Patch Decisions
Fortinet’s public advisories were due on November 10, the next point at which administrators could review the technical details of the October 22 fixes. Organizations using FortiOS, FortiManager or FortiAnalyzer should consult Fortinet’s official security notices and follow its stated update guidance. The FBI and Secret Service warning also makes credential hygiene relevant: teams should review firewall administrator accounts, remove unneeded access, replace reused or weak passwords and use multifactor authentication where supported.
For other systems, readers can check that Microsoft Authenticator on Android is updated, obtain banking apps from trusted sources, and avoid accepting unexpected PDF security prompts without verifying the file. Security teams can compare CISA’s KEV catalog with their own asset inventory and other credible vulnerability and exploitation reporting, including for tools not listed in the catalog.
The roundup does not announce a single upcoming investigation or enforcement action. Further status depends on vendors’ advisories, researchers’ follow-up reports and organizations’ own exposure checks. The recommended steps are defensive measures, not a guarantee that an account or device has not already been compromised.
Key Questions
What is the main development in this roundup?
ThorstenMeyerAI.com published a six-item selection of security news on October 29, drawing on advisories and research reports and pairing each item with a suggested action.
Does FortiBleed mean Fortinet disclosed a new vulnerability?
No. Fortinet said FortiBleed was not a new Fortinet vulnerability and attributed the campaign to reused credentials and weak passwords. The roundup separately reports that Fortinet issued updates for critical- and high-severity flaws in several products on October 22.
What did researchers report about Microsoft Authenticator?
Researchers said an Android app could be tricked into obtaining work-account login tokens through Microsoft Authenticator. The source reports that Microsoft fixed the issue, identified as CVE-2026-80097, but does not state how many users were affected or whether the flaw was exploited.
Does a vulnerability’s absence from CISA’s KEV list mean it is safe?
No. The roundup notes that the Gotenberg flaw was not on CISA’s Known Exploited Vulnerabilities list despite VulnCheck recording attack attempts. A catalog entry can guide priorities, but its absence does not prove a product is unexposed or safe.
Source: ThorstenMeyerAI.com
