🔍 Read the full analysis: AI Security: A Weekly Guide To Fixes, Threats And Token Protection on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A security roundup dated October 29, 2026, selects six developments from the week’s security news and recommends practical responses. They include an active campaign targeting Fortinet firewalls, patches for Fortinet products, Android banking malware, a PDF-based backdoor, an Authenticator token flaw Microsoft says it fixed, and gaps in the official list of vulnerabilities requiring federal action.
ThorstenMeyerAI.com published a six-item security roundup on October 29, selecting developments from a 30-story weekly digest by The Hacker News and linking readers to original advisories and research. The report covers an active campaign targeting Fortinet firewalls, new product patches, Android banking malware, a malicious PDF, exposed work-account tokens and vulnerability-prioritization gaps, with one recommended action for each.
The roundup says the FBI and U.S. Secret Service warned on October 6 that the FortiBleed campaign remains active. The agencies cited SOCRadar, which reported verifying more than 86,644 compromised devices in 194 countries. Those figures are attributed to the security firms, not presented as an independent government count. The report says attackers reuse leaked or weak passwords to access Fortinet devices and create administrator accounts. Fortinet has said FortiBleed is not a new vulnerability in its products, attributing the activity to credential reuse and weak passwords without multifactor authentication.
Fortinet released coordinated security updates for FortiOS, FortiManager and FortiAnalyzer on October 22, including fixes rated critical and high severity, according to the source article. Fortinet said public advisories would follow on November 10. The roundup also cites Hudson Rock’s October 27 analysis of 1,703 configuration reports from 1,689 devices. Hudson Rock counted 40,573 records containing plaintext passwords; it cautioned that these were records, not necessarily active accounts, and said 7,437 local accounts were marked disabled.
Other items include CloudSEK’s report of MR ROBOT, an Android crime kit rented by criminals to make fake banking apps that can steal one-time codes and forward calls; Trellix’s account of a backdoor delivered through a blank PDF disguised as a FedEx tax invoice; and research by Enclave that an Android app could obtain Microsoft Authenticator work-account tokens. Microsoft says it fixed the latter issue, tracked as CVE-2026-80097. The roundup also reports that Cequence observed a scanner using about 32 false AI-bot identities to request sensitive files and keys. Those findings are attributed to the named security researchers and companies.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Protecting Firewalls and Work Tokens
The stories point to several ways organizations can lose access or sensitive information: stolen credentials, exposed configuration backups, deceptive files and weaknesses in app-to-app trust. A firewall configuration may contain more than network settings; Hudson Rock’s reported plaintext-password records show why backup files need careful handling and access controls. The reported Authenticator issue also matters because login tokens can provide access to work accounts without requiring a fresh password at every step.
The roundup’s practical value is its focus on actions rather than a single threat. For IT teams, that means prioritizing vendor patches, reviewing firewall accounts and enabling multifactor authentication. For individuals, it means treating unexpected files and requests for permissions with caution and installing software updates. The article does not establish that every listed weakness is being exploited in the wild; it distinguishes reported attacks from research findings and vendor advisories.
Its final warning concerns prioritization. CISA’s Known Exploited Vulnerabilities catalog helps federal agencies decide which flaws to patch, but the report says a critical Gotenberg vulnerability with 1,358 recorded attack attempts in 30 days, according to VulnCheck, was not on the catalog. The report says CISA gave federal agencies three days to address PHP2Shell. A catalog can guide decisions, but it cannot by itself represent every risk facing every organization.
Products Worth Considering
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Anker SOLIX S2000 Portable Power Station, 2,010Wh, 1,500W
Apple Watch Series 12 GPS Smartwatch, 46mm
As an affiliate, we earn on qualifying purchases.
How the Six Stories Fit Together
The source article frames the roundup as a response to the volume of weekly security coverage: The Hacker News published 30 stories, and Thorsten Meyer selected six he considered most relevant to businesses and ordinary users. It says the figures generally come from the security companies that discovered or analyzed the activity, which may also sell security products. Readers should treat those counts as attributed research findings and consult the linked advisories for scope and methodology.
The Fortinet issue combines two related but distinct developments. FortiBleed refers to a campaign using compromised or weak credentials, according to Fortinet and the government agencies cited; it is not, in Fortinet’s account, a newly discovered product vulnerability. Separately, Fortinet issued security updates on October 22 for multiple products. The source says the public advisories for those updates were scheduled for November 10, leaving the specific vulnerability details unavailable at the time of publication.
The remaining items span different stages of evidence. The Android crime kit and PDF backdoor are findings reported by security researchers. The Authenticator issue is described as a research finding with a Microsoft fix. The scanner impersonating AI bots is a company’s observation of traffic. The roundup’s six actions are the author’s recommendations based on these reports, not a single official public-safety directive.
““FortiBleed is not a new Fortinet vulnerability.””
— Fortinet
Counts, Exploitation and Disclosure Gaps
Several important details remain unsettled. Fortinet’s October 22 updates were issued before public advisories were scheduled for November 10, so the source article does not provide the underlying vulnerability identifiers, affected versions or full severity details. It also does not establish whether the newly patched flaws are being exploited. The claims about FortiBleed’s reach and the configuration records come from security firms cited by the agencies and article; the figures do not necessarily represent currently active accounts or devices.
The roundup does not provide independent verification of CloudSEK’s crime-kit findings, Trellix’s backdoor analysis, Cequence’s scanner observations or VulnCheck’s attack-attempt count. Nor does it give enough detail to assess the full scope of the Authenticator issue beyond saying Microsoft fixed it. It remains unclear from the supplied material how many users or organizations were affected, whether the reported access led to confirmed data theft, and what exact versions or configurations were vulnerable.
Patch Updates and Follow-up Advisories
Organizations using FortiOS, FortiManager or FortiAnalyzer should review Fortinet’s available security updates and apply the fixes that match their deployments. The source article said fuller public advisories were expected on November 10; those disclosures may clarify affected versions, vulnerability details and recommended mitigations. Administrators should also review firewall accounts, remove unnecessary or disabled credentials, protect configuration backups and require multifactor authentication where supported.
Users and security teams can check that Microsoft Authenticator and Android devices are updated, obtain banking apps from trusted sources, and avoid approving unexpected permission or security prompts. Email and document-handling processes should treat unsolicited invoices and unexpected PDF warnings cautiously. The report also recommends checking vulnerability exposure against vendor advisories and credible threat reporting, rather than relying on one catalog alone. Further confirmation of impacts, affected systems and exploitation activity depends on follow-up disclosures from vendors, researchers and government agencies.
Key Questions
What is the main development in this security report?
ThorstenMeyerAI.com published a six-story roundup on October 29, 2026, covering firewall attacks and fixes, Android banking malware, a malicious PDF, an Authenticator token issue and vulnerability prioritization.
Does FortiBleed exploit a newly discovered Fortinet flaw?
Fortinet said FortiBleed is not a new Fortinet vulnerability. The company attributed the campaign to reused or weak passwords and a lack of multifactor authentication, while the FBI and U.S. Secret Service warned that the activity remained ongoing.
What should organizations do about the Fortinet updates?
IT teams should review Fortinet’s security updates for FortiOS, FortiManager and FortiAnalyzer and apply the relevant fixes. The source article said detailed public advisories were expected November 10, 2026, so affected versions and technical details were not yet fully available there.
Was Microsoft Authenticator’s Android token issue fixed?
The roundup says Microsoft fixed the issue, identified as CVE-2026-80097. It does not specify how many users were affected or whether the reported weakness led to confirmed account compromises.
Does CISA’s vulnerability catalog cover every urgent threat?
No. The roundup describes CISA’s Known Exploited Vulnerabilities catalog as a useful federal prioritization tool, while reporting that a Gotenberg flaw with attack attempts cited by VulnCheck was not listed. The report’s point is that organizations may need to consult vendor notices and credible research as well.
Source: ThorstenMeyerAI.com
