🔍 Read the full analysis: AI Security Update: What To Do About This Week’s Emerging Issues on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A security roundup published Oct. 29 highlights six issues affecting firewalls, Android phones, PDFs, authentication apps, websites and vulnerability patching. The reported risks include an active campaign using stolen Fortinet credentials and a fixed Microsoft Authenticator flaw; the article recommends practical defensive steps while noting that some figures come from security firms’ own research.
ThorstenMeyerAI.com published a review on October 29 of six security issues it selected from The Hacker News’ weekly digest, outlining defensive steps for businesses and individual users. The report covers an active campaign targeting Fortinet firewalls, Android banking malware, a malicious PDF, a fixed Microsoft Authenticator flaw, automated credential probing and gaps in official patch-priority lists.
The most urgent item for organizations with Fortinet equipment is the reported FortiBleed campaign. The article says the FBI and U.S. Secret Service warned on October 6 that the campaign remained active. According to the joint advisory, attackers use credentials exposed in earlier incidents or weak passwords to access firewalls. The agencies cite SOCRadar, which reported verifying more than 86,644 compromised devices across 194 countries. Those figures are attributed to the security firm, not an independent government count.
Fortinet released security updates for FortiOS, FortiManager and FortiAnalyzer on October 22, including critical- and high-severity fixes, according to the company. The public advisories were scheduled for November 10. Separately, the article cites Hudson Rock’s October 27 analysis of 1,703 configuration reports from 1,689 devices. It counted 40,573 records containing plaintext passwords, including 37,076 local account records; Hudson Rock cautioned that these were records, not necessarily active accounts or distinct people. Fortinet has said FortiBleed is not a new vulnerability in its products, attributing the campaign to reused credentials and weak passwords.
Other items involve different routes into accounts and systems. CloudSEK reported an Android crime kit called MR ROBOT that criminals rent to create fake banking apps capable of stealing one-time codes and forwarding calls. Trellix said an empty PDF disguised as a FedEx tax invoice could install a backdoor if a user accepted the reader’s warning. Researchers reported that another Android app could obtain work-account login tokens through Microsoft Authenticator; Microsoft says it has fixed the issue, identified as CVE-2026-80097. Cequence reported one automated scanner cycling through about 32 fake AI-bot identities while requesting password files and cloud keys.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Risks Across Firewalls and Phones
The six reports point to a practical security concern: attackers can exploit stolen credentials, deceptive prompts and software trust, not just newly discovered vulnerabilities. A compromised firewall may expose access to a wider company network, while banking malware or stolen work tokens can put personal and business accounts at risk.
The findings also show why a single patch list cannot replace local risk review. The article says CISA gave U.S. federal agencies three days to address PHP2Shell, while a critical Gotenberg flaw was absent from CISA’s Known Exploited Vulnerabilities catalog. VulnCheck reported 1,358 attack attempts against Gotenberg in a 30-day period. That count is attributed to VulnCheck; the source does not specify that every attempt resulted in a compromise.
For readers, the immediate value is a set of concrete checks: update exposed systems, replace reused credentials, require multifactor authentication where available, and treat unexpected permission or document prompts with caution. These steps do not prove that a device is safe, but they address the access methods described in the reports.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
As an affiliate, we earn on qualifying purchases.
How the Six Reports Connect
The roundup is based on six stories selected from a 30-item Hacker News digest, rather than a single coordinated incident. Its author says they checked original advisories or research reports where available. Many of the numerical findings come from security companies that discovered or analyzed the activity; the article flags that these companies also sell security products.
The FortiBleed reporting describes a campaign centered on credentials and firewall configuration data. Fortinet’s October 22 software updates are a separate development: the company said they address critical- and high-severity flaws in several products. The source reports that Fortinet credited AI-assisted testing and named Anthropic, OpenAI, Google and SpaceX. It also says detailed public advisories were due November 10, so the full technical details were not yet public on October 29.
The remaining stories concern Android applications, a PDF lure, automated web requests and vulnerability prioritization. Their inclusion reflects the roundup’s focus on business and everyday-user exposure; it does not establish that all six threats are connected or affect every organization.
“FortiBleed is not a new Fortinet vulnerability.”
— Fortinet
What the Reports Do Not Establish
The reported counts do not establish how many current, distinct users or organizations were affected. Hudson Rock said its 40,573 password-bearing records were records rather than people, and some local accounts were marked disabled. The article does not provide a complete independently verified count of successful FortiBleed intrusions.
Details of Fortinet’s October 22 fixes were not due for public release until November 10, according to the source. The available material therefore does not identify each flaw or show how widely the affected products had been updated by October 29. It also does not establish that every reported Gotenberg attempt succeeded, or that every Android user faced the same exposure.
The source summarizes findings from researchers and vendors, but does not provide full technical reports for every item. The scope, duration and current activity level of the Android and automated-scanning threats may change as further advisories or investigations emerge.
Updates and Defensive Checks
Fortinet’s public advisories were expected on November 10, which should provide more detail about the October 22 updates. Organizations using Fortinet products can review the company’s current security guidance, apply relevant updates, check firewall accounts and configuration backups, and replace credentials that may have been reused or exposed. Multifactor authentication can add protection where supported.
Security teams can also check whether they run the affected Android, document-processing or web-facing software and follow the relevant vendor advisories. Because the reports describe both software flaws and credential-based access, patching should be paired with account review and monitoring. The source does not give a single confirmed remediation schedule for all six issues; organizations should use current guidance from the affected vendors and government agencies.
Key Questions
What is the main development in this security update?
ThorstenMeyerAI.com published a review of six security stories on October 29, including an active Fortinet firewall campaign and other risks affecting Android apps, authentication, PDFs and web services.
Is FortiBleed a newly discovered Fortinet software flaw?
Fortinet said FortiBleed is not a new Fortinet vulnerability. The source describes attackers using previously exposed or weak credentials to access firewall devices. Fortinet also released separate security updates for several products on October 22.
What should organizations using Fortinet products do?
Review Fortinet’s security guidance and apply updates relevant to the organization’s products. Check firewall accounts and configuration files for exposed or outdated credentials, and use multifactor authentication where available.
Has Microsoft fixed the Authenticator issue?
The source says Microsoft has fixed the Android Microsoft Authenticator issue identified as CVE-2026-80097. Users and administrators should follow Microsoft’s current guidance and keep the app updated.
Are all the reported attack counts independently confirmed?
No. Several figures come from security companies’ own analyses, including SOCRadar, Hudson Rock and VulnCheck. The source attributes those counts and notes that some records do not necessarily represent active accounts, successful attacks or distinct people.
Source: ThorstenMeyerAI.com
