🔍 Read the full analysis: AI Security Brief: This Week’s Malware, Patches And Practical Advice on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A security roundup dated October 29 highlights six developments: an active campaign targeting Fortinet firewalls, critical Fortinet updates, Android banking malware, a backdoor delivered through a deceptive PDF, a fixed Microsoft Authenticator flaw and new findings on automated bot impersonation. The reports point to practical steps including updating exposed systems, reviewing credentials and checking which software is missing from official patch-priority lists.
A security roundup published October 29 flags an ongoing campaign against Fortinet firewalls alongside new malware and software flaws affecting Android users, email recipients and business systems. The reports describe six developments and practical responses, including applying security updates, reviewing exposed credentials and treating unexpected document prompts cautiously.
The most immediate business concern is FortiBleed, an active campaign targeting Fortinet firewall devices. The FBI and U.S. Secret Service warned on October 6 that the campaign was continuing. Their advisory cited SOCRadar’s verification of more than 86,644 compromised devices in 194 countries. The agencies say attackers use credentials exposed in earlier incidents or weak passwords to gain access, create administrator accounts and, in some cases, lock out legitimate administrators. They identify the ransomware groups INC/Lynx and Payload as buyers of access.
Fortinet released updates on October 22 for FortiOS, FortiManager and FortiAnalyzer, with critical- and high-severity fixes. The company said public advisories would follow on November 10. Separately, CloudSEK reported on October 28 that an Android crime kit named MR ROBOT is rented to criminals to create fake banking apps that can steal one-time codes and forward calls. Trellix reported on October 26 that a backdoor was concealed in an empty PDF presented as a FedEx tax invoice; the infection depended on a user accepting a PDF reader’s warning.
Other findings include a Microsoft Authenticator for Android issue that researchers said could expose work-account login tokens to another app; Microsoft has issued a fix, identified as CVE-2026-80097. Cequence reported a scanner rotating among roughly 32 fake AI-bot identities while seeking password files and cloud keys. And while CISA required U.S. federal agencies to address PHP2Shell within three days, the roundup notes that a critical Gotenberg flaw was absent from CISA’s Known Exploited Vulnerabilities catalog despite VulnCheck recording 1,358 attack attempts in 30 days.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Where Security Teams Should Act
The reports matter because they connect familiar security gaps to current attack activity. A firewall can be compromised through reused or weak credentials even when the campaign does not rely on a newly disclosed product flaw. That makes credential hygiene, multifactor authentication and access review relevant alongside patching.
The Android and PDF cases show how fraud can exploit ordinary user actions and trusted-looking workflows. The Authenticator finding also illustrates why app permissions alone may not tell users whether a mobile application can expose sensitive account material. Microsoft has fixed the reported flaw, but organizations still need to confirm that managed devices receive the update.
For IT teams, the contrast between the CISA list and the Gotenberg report is a reminder that official priority catalogs are not a complete inventory of risk. The roundup’s figures come from different sources and measures: compromised devices, exposed records and recorded attack attempts are not interchangeable. Some counts come from security vendors that sell protection services, so their scope and methodology matter.
Products Worth Considering
Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How This Week’s Reports Fit
The roundup draws on The Hacker News’ October 29 weekly digest, selecting six stories from a larger collection and checking them against original advisories or research reports. Its author notes that many measurements come from the companies investigating the activity, which may also sell security products.
Fortinet’s campaign and its software updates are related to the same product ecosystem but are distinct issues. Fortinet has said FortiBleed is not a new Fortinet vulnerability, attributing the access described to reused credentials and weak passwords without second-factor protection. Separately, the company issued updates addressing security flaws in several products. The public technical details for those updates were scheduled for November 10, after the October 22 release.
The reports also vary in status. The Authenticator issue is described as fixed, while the FortiBleed campaign was still active in the agencies’ October warning. The MR ROBOT kit, PDF backdoor and bot-identity activity are findings attributed to security researchers. CISA’s PHP2Shell deadline applies to U.S. federal agencies; it is not a general deadline for every organization.
“FortiBleed is not a new Fortinet vulnerability.”
— Fortinet
What the Reports Do Not Establish
The reported FortiBleed totals do not establish how many devices remain vulnerable or accessible today. Hudson Rock’s October 27 analysis covered 1,703 configuration reports from 1,689 devices and counted 40,573 password-containing records. The source cautions that these are records, not people, and that some accounts were disabled; the count does not show that every credential remains usable.
Fortinet’s detailed public advisories were not yet available in the source material, so the specific flaws, affected versions and exact remediation steps for the October 22 updates cannot be fully assessed here. The roundup also does not provide independent confirmation of the vendor-reported malware and bot activity, or a breakdown of how the 1,358 Gotenberg attack attempts were measured. The actual number of victims and any resulting losses are not specified.
Updates and Checks to Follow
Fortinet’s public advisories were scheduled for November 10. Administrators should consult those notices for affected versions and remediation details, while reviewing the October 22 updates and following the FBI and Secret Service guidance on exposed firewall credentials. Teams should also check for unexpected administrator accounts, rotate potentially exposed passwords and use multifactor authentication where available.
Organizations using Microsoft Authenticator on Android should verify that the fix for CVE-2026-80097 has reached managed devices. Security teams can review whether they use Gotenberg or software affected by PHP2Shell and assess exposure against their own inventories rather than relying only on CISA’s catalog. For individuals, the reports support basic precautions: install app updates, use official banking apps, and do not approve unfamiliar prompts in document readers.
Key Questions
What is FortiBleed?
FortiBleed is the name used for a campaign targeting Fortinet firewall devices. The FBI and U.S. Secret Service said it was still active in an October 6 warning and described attackers using exposed or weak credentials to gain access.
Are Fortinet’s October updates the same issue as FortiBleed?
No. Fortinet said FortiBleed was not a new product vulnerability and linked it to credential risks. The company separately released critical- and high-severity security updates for FortiOS, FortiManager and FortiAnalyzer on October 22.
What does the MR ROBOT Android kit do?
CloudSEK reported that the rented kit helps criminals create fake banking apps. Those apps can steal one-time codes and secretly forward calls, according to the company’s October 28 report.
Has the Microsoft Authenticator issue been fixed?
Microsoft has issued a fix for the reported Android issue, identified as CVE-2026-80097. The roundup does not say how many devices were affected or how widely the flaw was exploited.
Does CISA’s list cover every urgent security flaw?
No. The roundup says CISA set a three-day deadline for U.S. federal agencies to address PHP2Shell, while a reported Gotenberg flaw was not on the agency’s known-exploited list. Organizations should check their own software and risk information as well as official catalogs.
Source: ThorstenMeyerAI.com
