🔍 Read the full analysis: What Does This Week’s Security News Mean For AI? A Practical Guide on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A security roundup dated October 29 highlights six developments involving Fortinet firewalls, Android banking malware, a malicious PDF, Microsoft Authenticator, AI-bot impersonation and vulnerability patch priorities. The source recommends immediate defensive steps, while some figures come from security firms’ own investigations and cannot be independently confirmed from the material provided.
A security roundup published October 29 highlights six developments that could affect companies and individual users, including an active campaign targeting Fortinet firewalls, Android malware aimed at bank customers and a flaw involving Microsoft Authenticator that the company says it has fixed. The roundup’s author, Thorsten Meyer, drew from advisories and research reports and paired each item with a defensive action; several attack counts come from security firms’ own analyses.
The most urgent network issue in the roundup is FortiBleed, a campaign targeting Fortinet firewalls. The FBI and US Secret Service warned on October 6 that the activity was ongoing, according to the source. The agencies cited SOCRadar’s report of more than 86,644 compromised devices across 194 countries. Those figures are attributed to the security firm, not presented as a government count. The reported method involves reused or weak passwords and exposed password data, rather than a newly identified Fortinet vulnerability.
Fortinet separately issued updates on October 22 for FortiOS, FortiManager and FortiAnalyzer, addressing critical and high-severity issues, according to the source. It says public advisories are scheduled for November 10. Other selected reports describe an Android crime kit called MR ROBOT, which CloudSEK says is rented by criminals to create fake banking apps; a malicious PDF disguised as a FedEx tax invoice, which Trellix says relied on a user accepting a warning; and an Android Microsoft Authenticator issue that researchers said could expose work-account login tokens to another app. Microsoft has fixed the Authenticator issue, the source says.
The final two items concern automated access and patch prioritisation. Cequence reported tracking a scanner that used about 32 false AI-bot identities while seeking password files and cloud keys. Separately, the roundup contrasts CISA’s three-day deadline for federal agencies to patch PHP2Shell with a reported 1,358 attack attempts against Gotenberg in 30 days, a flaw the source says was absent from CISA’s Known Exploited Vulnerabilities catalog. The figures and interpretations are attributed to the named companies and agencies.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Where AI Meets Everyday Security
The roundup’s practical message is that these incidents do not depend on a single advanced AI attack technique. They expose familiar weak points: internet-facing network equipment, reused passwords, unsafe software prompts and misplaced trust in automated identities. For businesses, a compromised firewall can provide a route into internal systems; for individuals, a counterfeit banking app can put credentials and one-time codes at risk.
AI matters in two ways in the material. Fortinet is cited as warning that AI tools may help attackers study software patches and develop exploits faster, potentially shortening the time defenders have to update systems. Cequence’s report, meanwhile, illustrates how scanners can claim to be legitimate AI agents while seeking sensitive files. Neither point means every AI-labelled request is malicious or that AI alone caused these incidents. The operational lesson is to verify identity and access, patch exposed systems promptly, and avoid treating bot labels as proof of trustworthiness.
The roundup also cautions against treating official vulnerability lists as a complete inventory of risk. CISA’s catalog is a prioritisation tool for federal agencies, while the reported Gotenberg activity suggests that defenders may need to consult vendor advisories and credible incident reporting as well. A missing catalog entry does not establish that a flaw is safe to ignore.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
As an affiliate, we earn on qualifying purchases.
How the Six Reports Connect
The source is a selection from a weekly digest published by The Hacker News on October 29. Meyer says he chose six of its thirty stories, checked the original advisories or research reports and translated each into a short explanation and suggested action. The supplied material contains detailed reporting on the Fortinet campaign and brief summaries of the other five items, so the latter should be read as attributed summaries rather than full technical accounts.
The firewall reporting combines two separate developments: the ongoing credential-based FortiBleed campaign and Fortinet’s release of security updates for several products. The source stresses that Fortinet describes FortiBleed as not being a new Fortinet vulnerability. Hudson Rock’s October 27 analysis of configuration reports is another distinct data point: it counted password records, including records associated with disabled accounts. The roundup cautions that these are records, not a count of active people or confirmed usable credentials.
For the other cases, the source attributes the MR ROBOT findings to CloudSEK on October 28, the PDF investigation to Trellix on October 26, the Authenticator research to Enclave on October 23 and Microsoft’s fix to its CVE-2026-80097 record. Cequence’s scanner report is dated October 28. These dates help establish the week’s timeline, but the provided material does not include full advisories for every item.
Limits of the Reported Counts
The material does not provide the full underlying advisories or research reports for all six stories, and it does not independently verify the security firms’ counts. The 86,644-device figure is attributed to SOCRadar through the FBI and US Secret Service advisory; Hudson Rock’s password totals refer to records in configuration reports, not necessarily active accounts. The source says 7,437 local accounts in that analysis were marked disabled.
It is also unclear from the supplied text how many victims have been affected by MR ROBOT, the PDF backdoor or the Authenticator issue, whether the reported scanner obtained any files, and whether Gotenberg attack attempts resulted in successful compromises. The Fortinet public advisories are described as due on November 10, so the specific vulnerabilities and affected versions are not detailed here. These points should not be inferred from the roundup’s summaries.
Immediate Steps and Upcoming Advisories
Organizations using Fortinet products should review the vendor’s security updates and apply relevant fixes according to their environment and change controls. They should also check for unfamiliar administrator accounts, replace reused or weak passwords, enable multifactor authentication where available and restrict access to firewall management interfaces. Because the source says public Fortinet advisories are scheduled for November 10, administrators should consult those notices for affected versions and specific remediation guidance.
Android users should install updates from trusted sources, avoid banking apps reached through unsolicited links and review app permissions and account activity. For work accounts, organizations should confirm that Microsoft Authenticator is current and follow Microsoft’s guidance for CVE-2026-80097. Security teams should treat CISA’s KEV catalog as one input to patch prioritisation, alongside vendor notices, exposure and credible reports of exploitation. The material does not specify a confirmed outcome or further milestone for the other investigations.
Key Questions
What is the main security development in this roundup?
The roundup brings together six security reports dated during the week to October 29, led by an ongoing campaign targeting Fortinet firewalls and separate security updates for Fortinet products. It also covers mobile malware, a malicious PDF, an Authenticator issue, automated scanning and patch priorities.
Does FortiBleed mean Fortinet disclosed a new vulnerability?
Not according to Fortinet’s statement quoted in the source. The reported campaign uses credentials that were reused, weak or exposed; Fortinet’s separate October 22 product updates address critical and high-severity issues.
What should a business do about its firewall?
Review Fortinet’s security updates, apply fixes relevant to the products in use, check for unfamiliar administrator accounts, strengthen passwords and enable multifactor authentication where supported. Consult the vendor’s advisories for affected versions and detailed steps.
Was the Microsoft Authenticator issue fixed?
The source says Microsoft fixed the Android issue researchers reported and identifies it as CVE-2026-80097. It does not provide further technical details or say how many accounts were affected.
Are the attack counts confirmed totals of victims?
No. The counts are attributed to security firms’ analyses and may measure devices, records or attack attempts rather than confirmed victims. The source specifically cautions that Hudson Rock counted password records, including some associated with disabled accounts.
Source: ThorstenMeyerAI.com
