🔍 Read the full analysis: AI Security Roundup: Firewall Patches, A Rented Trojan And Token Theft on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
This October 29 roundup highlights six security developments: Fortinet updates for critical and high-severity flaws alongside an active campaign stealing firewall credentials, a rented Android banking Trojan, and a fixed Microsoft Authenticator token-exposure issue. It also covers an invoice-themed PDF backdoor, fake AI-bot identities used to seek secrets, and gaps in CISA’s priority patch list.
Fortinet issued coordinated updates on October 22 for FortiOS, FortiManager and FortiAnalyzer, with fixes described as critical and high severity. Fortinet said the public advisories would follow on November 10. Separately, the FBI and U.S. Secret Service warned on October 6 that the FortiBleed credential-theft campaign remains active. Their advisory cites SOCRadar’s report of more than 86,644 compromised devices across 194 countries. That figure is attributed to the security company and should not be read as a government-verified count.
The campaign, as described in the advisory, relies on stolen or weak passwords, including credentials reused from earlier breaches, rather than a newly identified Fortinet software flaw. Attackers may use the access to create administrator accounts or lock out legitimate administrators. The agencies named the ransomware groups INC/Lynx and Payload as buyers of access. Hudson Rock separately reported analyzing 1,703 configuration reports from 1,689 devices and finding 40,573 password-containing records. It cautioned that these were records, not necessarily unique or active people or accounts; 7,437 local-account records were marked disabled.
The roundup also describes CloudSEK’s October 28 report on MR ROBOT, an Android crime kit rented by criminals to build fake banking apps. CloudSEK said the kit can steal one-time codes and secretly forward calls. Trellix reported on October 26 that a backdoor was hidden in an empty PDF presented as a FedEx tax invoice; its account says infection depended on a user accepting a PDF reader warning. Enclave researchers said an Android app with no permissions could trick Microsoft Authenticator into yielding work-account login tokens; Microsoft has fixed the issue, tracked as CVE-2026-80097.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Risks at the Network Edge and on Phones
The stories point to several ways attackers can reach business systems and personal accounts: exposed firewall credentials, malicious mobile apps, deceptive documents and software trust relationships. Firewall access can provide a foothold into an organization’s network, while stolen authentication tokens may let an intruder use an account without simply asking for its password. The reported activity does not establish that every vulnerable device or exposed record was successfully exploited.
For organizations, the immediate distinction is between patching software flaws and securing credentials. Fortinet’s updates address software vulnerabilities, while the FortiBleed warning describes account compromise through password theft, guessing and weak authentication. Applying a patch alone does not replace checking administrator accounts, changing exposed credentials and requiring multifactor authentication.
The roundup also warns against treating official priority lists as a complete inventory of risk. It says CISA gave federal agencies three days to address PHP2Shell, while a critical Gotenberg flaw with 1,358 recorded attack attempts over 30 days was not on CISA’s Known Exploited Vulnerabilities list. Those attack-attempt figures are attributed to VulnCheck; the roundup does not provide a comparable independent measure of exploitation.
Popular right now
Dyson Car+Boat Cordless Handheld Vacuum
Ninja Specialty Coffee Maker CM401, 10-Cup Carafe, Fold-Away Frother, Black
Roborock Qrevo CurvX Robot Vacuum and Mop
As an affiliate, we earn on qualifying purchases.
How the Six Reports Fit Together
The October 29 article says it selected six stories from a 30-item weekly digest published by The Hacker News and returned to original advisories or research reports for details. Its coverage spans firewalls, mobile devices, email and patch prioritization. The publication notes that many figures come from security firms that also sell protective services, and attributes those numbers to their sources.
In addition to the firewall and phone reports, Cequence said on October 28 that it tracked a scanner rotating through about 32 fake AI-bot identities while requesting password files and cloud keys from websites. The report frames this as a reminder that a claimed identity such as “ChatGPT” does not prove a web request comes from a legitimate service. The source material does not give a broader prevalence estimate for this behavior.
Fortinet said the FortiBleed campaign was not a new Fortinet vulnerability, attributing compromises to reused credentials and password guessing against weakly protected devices. The October 22 software updates are a separate development. Fortinet said the fixes include issues found with AI-assisted testing and credited Anthropic, OpenAI, Google and SpaceX for assistance.
““is not a new Fortinet vulnerability””
— Fortinet
Counts and Exposure Still Need Context
The reported figures measure different things and have different limitations. SOCRadar’s figure is a count of devices it said were compromised; Hudson Rock’s is a count of password-containing records across configuration reports. Hudson Rock said some local accounts were disabled, and the source material does not establish how many records correspond to currently active accounts or how many devices remain exposed.
Fortinet’s public advisories for the October 22 updates were scheduled for November 10, so the specific vulnerabilities and affected versions are not detailed in the supplied material. It is also unclear how many organizations have installed the updates, or how many of the reported FortiBleed compromises remain active. The source does not establish how widely MR ROBOT has been deployed or how many victims were affected.
The roundup reports a Gotenberg attack-attempt count and a missing CISA listing, but it does not say that the count represents confirmed successful compromises. Nor does absence from CISA’s list show that a flaw is safe to defer. The available material offers no independent comparison of the scanner activity Cequence observed or the total scale of the PDF campaign described by Trellix.
Patch, Review Accounts and Track Advisories
Organizations using Fortinet products should review the vendor’s security updates and prepare to apply relevant fixes, then check the November 10 public advisories for affected products and technical detail. Because the active campaign described by the FBI and Secret Service involves credentials, administrators should also review firewall accounts, replace exposed or reused passwords, remove accounts that are no longer needed, and require multifactor authentication where available.
Security teams should check whether they use the affected Android authentication setup and apply Microsoft’s fix for CVE-2026-80097, following Microsoft’s guidance. Users can avoid installing banking apps from untrusted sources and should treat unexpected invoice attachments and security prompts cautiously. Those steps address the reported attack methods without implying that every suspicious file or app is malicious.
Teams responsible for public-facing software should assess PHP2Shell and Gotenberg against their own systems rather than relying only on whether a flaw appears on a government list. The supplied reports do not give a single deadline for businesses outside the U.S. federal government; organizations will need to follow applicable vendor guidance and update plans as further advisories are published.
Key Questions
What is FortiBleed, according to the reports?
The FBI and U.S. Secret Service describe an active campaign targeting Fortinet firewalls through stolen or weak credentials. Fortinet says it is not a new Fortinet software vulnerability.
Are the Fortinet updates for the same issue as FortiBleed?
Not according to the source material. Fortinet’s October 22 updates address separate software flaws in FortiOS, FortiManager and FortiAnalyzer, while FortiBleed is described as credential-based compromise. Public details on the updates were scheduled for November 10.
What does the MR ROBOT Android kit do?
CloudSEK reported that criminals rent the kit to create fake banking apps that can steal one-time codes and secretly forward calls. The report does not establish how many people have been affected.
Has Microsoft fixed the Authenticator token issue?
Yes. The roundup says Microsoft fixed the Android issue reported by Enclave researchers and tracked as CVE-2026-80097. Users and administrators should follow Microsoft’s instructions to apply the fix.
Does CISA’s KEV list include every flaw that needs attention?
No. The roundup says Gotenberg was not on the list despite a VulnCheck report of 1,358 attack attempts over 30 days. A missing listing is not proof that a flaw is harmless, and the reported attempts do not by themselves establish successful compromises.
Source: ThorstenMeyerAI.com
